DECISION OF THE EEA JOINT COMMITTEE No 77/2025

of 14 March 2025

amending Annex IX (Financial services) to the EEA Agreement [2025/1001]

THE EEA JOINT COMMITTEE,

Having regard to the Agreement on the European Economic Area (‘the EEA Agreement’), and in particular Article 98 thereof,

Whereas:

(1) Commission Delegated Regulation (EU) 2024/1772 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the criteria for the classification of ICT-related incidents and cyber threats, setting out materiality thresholds and specifying the details of reports of major incidents ( 1 ) is to be incorporated into the EEA Agreement.

(2) Commission Delegated Regulation (EU) 2024/1773 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the detailed content of the policy regarding contractual arrangements on the use of ICT services supporting critical or important functions provided by ICT third-party service providers ( 2 ) is to be incorporated into the EEA Agreement.

(3) Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework ( 3 ) is to be incorporated into the EEA Agreement.

(4) Annex IX to the EEA Agreement should therefore be amended accordingly,

HAS ADOPTED THIS DECISION:

Article 1

The following points are inserted after point 31q (Regulation (EU) 2022/2554 of the European Parliament and of the Council) of Annex IX to the EEA Agreement:

‘31qa.

32024 R 1772 : Commission Delegated Regulation (EU) 2024/1772 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the criteria for the classification of ICT-related incidents and cyber threats, setting out materiality thresholds and specifying the details of reports of major incidents ( OJ L, 2024/1772, 25.6.2024 ).

31qb.

32024 R 1773 : Commission Delegated Regulation (EU) 2024/1773 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the detailed content of the policy regarding contractual arrangements on the use of ICT services supporting critical or important functions provided by ICT third-party service providers ( OJ L, 2024/1773, 25.6.2024 ).

31qc.

32024 R 1774 : Commission Delegated Regulation (EU) 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework ( OJ L, 2024/1774, 25.6.2024 ).’

Article 2

The texts of Delegated Regulations (EU) 2024/1772, (EU) 2024/1773 and (EU) 2024/1774 in the Icelandic and Norwegian languages, to be published in the EEA Supplement to the Official Journal of the European Union , shall be authentic.

Article 3

This Decision shall enter into force on 15 March 2025, provided that all the notifications under Article 103(1) of the EEA Agreement have been made ( *1 ) , or on the day of the entry into force of Decision of the EEA Joint Committee No 40/2025 of 20 February 2025 ( 4 ) , whichever is the later.

Article 4

This Decision shall be published in the EEA Section of, and in the EEA Supplement to, the Official Journal of the European Union .

Done at Brussels, 14 March 2025.

For the EEA Joint Committee

The President

Nicolas VON LINGEN

( 1 ) OJ L, 2024/1772, 25.6.2024, ELI: http://data.europa.eu/eli/reg_del/2024/1772/oj .

( 2 ) OJ L, 2024/1773, 25.6.2024, ELI: http://data.europa.eu/eli/reg_del/2024/1773/oj .

( 3 ) OJ L, 2024/1774, 25.6.2024, ELI: http://data.europa.eu/eli/reg_del/2024/1774/oj .

( *1 ) No constitutional requirements indicated.

( 4 ) OJ L, 2025/770, 8.5.2025, ELI: http://data.europa.eu/eli/dec/2025/770/oj .

ELI: http://data.europa.eu/eli/dec/2025/1001/oj

ISSN 1977-0677 (electronic edition)