EFTA Court rules Iceland breached EEA law on cybersecurity regulation

The EFTA Court has declared that Iceland failed to fulfil its obligations under the EEA Agreement by not making the Cybersecurity Act part of its internal legal order. The judgment, delivered on 3 July 2026 in Case E-21/25, EFTA Surveillance Authority v Iceland, was published in the Official Journal of the European Union on 8 October 2026 under reference C/2026/5260.

The dispute concerns Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification, which repealed Regulation (EU) No 526/2013 — the so-called Cybersecurity Act. Under the EEA Agreement, the act is listed at point 5cp of Annex XI and point 48 of Protocol 37, and applies to the EEA EFTA States as adapted by Protocol 1. Article 7 of the EEA Agreement obliges the contracting parties to make EEA-relevant acts part of their internal legal order.

The operative part of the judgment

The Court declared that Iceland has failed to fulfil its obligations under Article 7 of the EEA Agreement by failing to make the act referred to at point 5cp of Annex XI and point 48 of Protocol 37 to the EEA Agreement part of its internal legal order.

The operative part of the ruling contains two points:

• A declaration that Iceland has failed to fulfil its obligations under Article 7 of the EEA Agreement.
• An order that Iceland bear the costs of the proceedings.

The case and the bench

The proceedings were brought by the EFTA Surveillance Authority in Case E-21/25, on an application seeking a declaration that Iceland had failed to adopt the measures necessary to make the act part of its internal legal order.

The case is classified under the headings of failure by an EFTA State to fulfil its obligations, failure to implement, Article 3 EEA, the principle of sincere cooperation, the duty to provide information, cybersecurity, and electronic communication, audiovisual services and information society.

The Court was composed of:

• Páll Hreinsson, President
• Bernd Hammermann, Judge
• Michael Reiertsen, Judge-Rapporteur

What the regulation covers

Regulation (EU) 2019/881 concerns ENISA, the European Union Agency for Cybersecurity, and the European framework for information and communications technology cybersecurity certification. It replaced Regulation (EU) No 526/2013.

Because the act was incorporated into the EEA Agreement at point 5cp of Annex XI and point 48 of Protocol 37, it became binding on the EEA EFTA States once adapted by Protocol 1. Iceland’s failure to transpose it is what the EFTA Surveillance Authority challenged before the Court.

Consequences of the ruling

The judgment is a declaration of non-compliance with the EEA Agreement, and it places the costs of the proceedings on Iceland. The publication of the ruling in the Official Journal of the European Union gives it public and general effect across the EEA.

For readers, the decision confirms that EEA EFTA States are bound to transpose EU cybersecurity rules and that the EFTA Surveillance Authority will pursue non-implementation before the EFTA Court. It also signals that gaps in national cybersecurity certification frameworks carry a direct legal and financial cost for the states concerned.

Source: Official Journal of the European Union, C series, C/2026/5260, 8 October 2026, Section I (official reference: C/2026/5260).