Council Decision (EU) 2023/271 of 30 January 2023 on the position to be adopted, on behalf of the European Union, within the EEA Joint Committee concerning an amendment to Annex XI (Electronic communication, audiovisual services and information society) and Protocol 37 (containing the list provided for in Article 101) to the EEA Agreement (NIS) (Text with EEA relevance)

The position to be adopted, on the Union’s behalf, within the EEA Joint Committee on the proposed amendment to Annex XI (Electronic communication, audiovisual services and information society) and Protocol 37 (containing the list provided for in Article 101) to the EEA Agreement, shall be based on the draft decision of the EEA Joint Committee attached to this Decision.

This Decision shall enter into force on the date of its adoption.

The following is inserted after point 5cp (Regulation (EU) No 526/2013 of the European Parliament and of the Council) of Annex XI to the EEA Agreement: ‘5cpa. 32016 L 1148: Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (OJ L 194, 19.7.2016, p. 1). Modalities for association of the EFTA States in accordance with Article 101 of the Agreement: The EFTA States shall participate fully in the Cooperation Group and shall within it have the same rights and obligations as EU Member States, except for the right to vote. 5cpaa. 32018 R 0151: Commission Implementing Regulation (EU) 2018/151 of 30 January 2018 laying down rules for application of Directive (EU) 2016/1148 of the European Parliament and of the Council as regards further specification of the elements to be taken into account by digital service providers for managing the risks posed to the security of network and information systems and of the parameters for determining whether an incident has a substantial impact (OJ L 26, 31.1.2018, p. 48).’.

The following point is added in Protocol 37 to the EEA Agreement: ‘43. The Cooperation Group (Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union).’.

The texts of Directive (EU) 2016/1148 and Implementing Regulation (EU) 2018/151 in the Icelandic and Norwegian languages, to be published in the EEA Supplement to the Official Journal of the European Union, shall be authentic.

This Decision shall enter into force on […], provided that all the notifications under Article 103(1) of the EEA Agreement have been made .

This Decision shall be published in the EEA Section of, and in the EEA Supplement to, the Official Journal of the European Union.