**Executive Summary**
This document is a Decision of the EEA Joint Committee (No 146/2025) of 13 June 2025, amending Annex XIII (Transport) to the EEA Agreement. It incorporates Commission Delegated Regulation (EU) 2022/1645 and Commission Implementing Regulation (EU) 2023/203 into the EEA Agreement. The decision enters into force on 14 June 2025, provided all notifications under Article 103(1) of the EEA Agreement have been made.
**Key Points / Main Content**
* **Amendment to Annex XIII:**
* The Decision amends Annex XIII to the EEA Agreement by adding references to specific Commission Regulations.
* **Incorporation of Regulations:**
* Commission Delegated Regulation (EU) 2022/1645 of 14 July 2022 (OJ L 248, 26.9.2022, p. 18) is incorporated, addressing requirements for managing information security risks with a potential impact on aviation safety.
* Commission Implementing Regulation (EU) 2023/203 of 27 October 2022 (OJ L 31, 2.2.2023, p. 1) is incorporated, also addressing requirements for managing information security risks with a potential impact on aviation safety.
* **Language Authenticity:**
* The Icelandic and Norwegian language versions of Delegated Regulation (EU) 2022/1645 and Implementing Regulation (EU) 2023/203 will be published in the EEA Supplement to the Official Journal of the European Union and are deemed authentic.
* **Entry into Force and Publication:**
* The Decision enters into force on 14 June 2025, conditional upon all notifications under Article 103(1) of the EEA Agreement being made.
* The Decision is to be published in the EEA Section of, and in the EEA Supplement to, the Official Journal of the European Union.
**Impact Analysis**
**EEA Member States**
* **Impact:** EEA Member States must incorporate the provisions of Commission Delegated Regulation (EU) 2022/1645 and Commission Implementing Regulation (EU) 2023/203, related to information security risks in aviation safety, into their national laws and regulations.
* **Action Required:** Ensure timely notification under Article 103(1) of the EEA Agreement to enable the Decision's entry into force.
**Aviation Organizations within the EEA**
* **Impact:** Aviation organizations covered by the referenced Commission Regulations (EU) No 748/2012, (EU) No 139/2014, (EU) No 1321/2014, (EU) No 965/2012, (EU) No 1178/2011, (EU) 2015/340, (EU) 2017/373, and (EU) 2021/664 must comply with the information security risk management requirements outlined in the incorporated regulations.
* **Action Required:** Review and update information security management practices to align with the requirements of Delegated Regulation (EU) 2022/1645 and Implementing Regulation (EU) 2023/203.
**Competent Authorities within the EEA**
* **Impact:** Competent authorities responsible for overseeing aviation activities must ensure that aviation organizations comply with the information security risk management requirements.
* **Action Required:** Update oversight and enforcement procedures to reflect the new requirements introduced by Delegated Regulation (EU) 2022/1645 and Implementing Regulation (EU) 2023/203.
Key Entities Referenced
EEA Agreement: Agreement on the European Economic Area
Annex XIII (Transport): Annex to the EEA Agreement related to Transport
Commission Delegated Regulation (EU) 2022/1645: Regulation laying down rules for the application of Regulation (EU) 2018/1139 of the European Parliament and of the Council, as regards requirements for the management of information security risks with a potential impact on aviation safety for organisations covered by Commission Regulations (EU) No 748/2012 and (EU) No 139/2014
Commission Implementing Regulation (EU) 2023/203: Regulation laying down rules for the application of Regulation (EU) 2018/1139 of the European Parliament and of the Council, as regards requirements for the management of information security risks with a potential impact on aviation safety for organisations covered by Commission Regulations
EEA Joint Committee: Committee responsible for making decisions related to the EEA Agreement
Official Journal EN
of the European Union L series
2025/1840 2.10.2025
DECISION OF THE EEA JOINT COMMITTEENo 146/2025
of 13 June 2025
amending Annex XIII (Transport) to the EEA Agreement [2025/1840]
THE EEA JOINT COMMITTEE,
Having regard to the Agreement on the European Economic Area (“the EEA Agreement”), and in particular Article 98
thereof,
Whereas:
(1) Commission Delegated Regulation (EU) 2022/1645 of 14 July 2022 laying down rules for the application of
Regulation (EU) 2018/1139 of the European Parliament and of the Council, as regards requirements for the
management of information security risks with a potential impact on aviation safety for organisations covered by
Commission Regulations (EU) No 748/2012 and (EU) No 139/2014 and amending Commission Regulations (EU)
No 748/2012 and (EU) No 139/2014(1)is to be incorporated into the EEA Agreement.
(2) Commission Implementing Regulation (EU) 2023/203 of 27 October 2022 laying down rules for the application of
Regulation (EU) 2018/1139 of the European Parliament and of the Council, as regards requirements for the
management of information security risks with a potential impact on aviation safety for organisations covered by
Commission Regulations (EU) No 1321/2014, (EU) No 965/2012, (EU) No 1178/2011, (EU) 2015/340,
Commission Implementing Regulations (EU) 2017/373 and (EU) 2021/664, and for competent authorities covered
by Commission Regulations (EU) No 748/2012, (EU) No 1321/2014, (EU) No 965/2012, (EU) No 1178/2011,
(EU) 2015/340 and (EU) No 139/2014, Commission Implementing Regulations (EU) 2017/373 and (EU) 2021/664
and amending Commission Regulations (EU) No 1178/2011, (EU) No 748/2012, (EU) No 965/2012, (EU)
No 139/2014, (EU) No 1321/2014, (EU) 2015/340, and Commission Implementing Regulations (EU) 2017/373
and (EU) 2021/664(2)is to be incorporated into the EEA Agreement.
(3) Annex XIII to the EEA Agreement should therefore be amended accordingly,
HAS ADOPTED THIS DECISION:
Article 1
Annex XIII to the EEA Agreement is amended as follows:
1. The following indent is added in points 66ne (Commission Regulation (EU) No 1178/2011), 66nf (Commission
Regulation (EU) No 965/2012), 66nj (Commission Regulation (EU) 2015/340), 66q (Commission Regulation (EU)
No 1321/2014) and 66xg (Commission Implementing Regulation (EU) 2017/373):
‘— 32023 R 0203: Commission Implementing Regulation (EU) 2023/203 of 27 October 2022 (OJ L 31,
2.2.2023, p. 1).’
2. The following indents are added in points 66nh (Commission Regulation (EU) No 139/2014) and 66p (Commission
Regulation (EU) No 748/2012):
‘— 32022 R 1645: Commission Delegated Regulation (EU) 2022/1645 of 14 July 2022 (OJ L 248,
26.9.2022, p. 18),
— 32023 R 0203: Commission Implementing Regulation (EU) 2023/203 of 27 October 2022 (OJ L 31,
2.2.2023, p. 1).’
(1) OJ L 248, 26.9.2022, p. 18.
(2) OJ L 31, 2.2.2023, p. 1.
ELI: http://data.europa.eu/eli/dec/2025/1840/oj 1/2EN
OJ L, 2.10.2025
3. The following is added in point 66zbe (Commission Implementing Regulation (EU) 2021/664):
‘, as amended by:
— 32023 R 0203: Commission Implementing Regulation (EU) 2023/203 of 27 October 2022 (OJ L 31,
2.2.2023, p. 1).’
4. The following points are inserted after point 66zbf (Commission Delegated Regulation (EU) 2024/1403):
‘66zbg. 32022 R 1645: Commission Delegated Regulation (EU) 2022/1645 of 14 July 2022 laying down rules for
the application of Regulation (EU) 2018/1139 of the European Parliament and of the Council, as regards
requirements for the management of information security risks with a potential impact on aviation safety
for organisations covered by Commission Regulations (EU) No 748/2012 and (EU) No 139/2014 and
amending Commission Regulations (EU) No 748/2012 and (EU) No 139/2014 (OJ L 248,
26.9.2022, p. 18).
66zbh. 32023 R 0203: Commission Implementing Regulation (EU) 2023/203 of 27 October 2022 laying down
rules for the application of Regulation (EU) 2018/1139 of the European Parliament and of the Council, as
regards requirements for the management of information security risks with a potential impact on aviation
safety for organisations covered by Commission Regulations (EU) No 1321/2014, (EU) No 965/2012, (EU)
No 1178/2011, (EU) 2015/340, Commission Implementing Regulations (EU) 2017/373 and
(EU) 2021/664, and for competent authorities covered by Commission Regulations (EU) No 748/2012,
(EU) No 1321/2014, (EU) No 965/2012, (EU) No 1178/2011, (EU) 2015/340 and (EU) No 139/2014,
Commission Implementing Regulations (EU) 2017/373 and (EU) 2021/664 and amending Commission
Regulations (EU) No 1178/2011, (EU) No 748/2012, (EU) No 965/2012, (EU) No 139/2014, (EU)
No 1321/2014, (EU) 2015/340, and Commission Implementing Regulations (EU) 2017/373 and
(EU) 2021/664 (OJ L 31, 2.2.2023, p. 1).’
Article 2
The texts of Delegated Regulation (EU) 2022/1645 and Implementing Regulation (EU) 2023/203 in the Icelandic and
Norwegian languages, to be published in the EEA Supplement to the Official Journal of the European Union, shall be authentic.
Article 3
This Decision shall enter into force on 14 June 2025, provided that all the notifications under Article 103(1) of the EEA
Agreement have been made(*).
Article 4
This Decision shall be published in the EEA Section of, and in the EEA Supplement to, the Official Journal of the European
Union.
Done at Brussels, 13 June 2025.
For the EEA Joint Committee
The President
Nicolas VON LINGEN
(*) No constitutional requirements indicated.
2/2 ELI: http://data.europa.eu/eli/dec/2025/1840/oj