Council Decision (EU) 2026/2256 of 24 September 2026 on the position to be adopted on behalf of the European Union within the EEA Joint Committee concerning the amendment of Protocol 10 to the EEA Agreement, on simplification of inspections and formalities in respect of carriage of goods, and Protocol 31 to the EEA Agreement, on cooperation in specific fields outside the four freedoms (CBAM financial contribution) (Text with EEA relevance)

Article 1

The position to be adopted on the Union’s behalf within the EEA Joint Committee concerning the proposed amendment of Protocol 10 to the EEA Agreement, on simplification of inspections and formalities in respect of carriage of goods, and Protocol 31 to the EEA Agreement, on cooperation in specific fields outside the four freedoms, shall be based on the draft decision of the EEA Joint Committee attached to this Decision.

Definitions

Article 1

Protocol 10 to the EEA Agreement is amended as follows: (1) in Article 2, the following paragraph is added: ‘5.   Provisions in Annex III to this Protocol related to the application of Regulation (EU) 2023/956 apply between the Community, Iceland and Norway.’ ; (2) the following annex is added after Annex II: ‘Annex III Technical and financial arrangements for the application of Regulation (EU) 2023/956 Article 1 Definitions For the purposes of this Annex: (a) “CBAM Registry” shall mean the registry of authorised CBAM declarants in the form of a standardised electronic database containing the data regarding the CBAM certificates of those authorised CBAM declarants, as established pursuant to Article 14 of Regulation (EU) 2023/956; (b) “common central platform” shall mean the platform established for the sale and repurchase of CBAM certificates, pursuant to Article 20 of Regulation (EU) 2023/956; (c) “CRMS” shall mean the customs risk management system referred to in Article 36 of Commission Implementing Regulation (EU) 2015/2447; (d) “CCN2” shall mean the Common Communication Network 2; (e) “CRS” shall mean the Customer Reference Services system; (f) “Datalab” shall mean the system used for risk management analysis and for data aggregation and transformation regarding customs transactions data. Article 2 CBAM processes related to customs controls and risk management 1.   For the exchange and storage of information pertaining to the communication between the Commission and the customs authorities of Norway and Iceland, the CBAM Registry shall be used. For CBAM customs risk-related information, CRMS shall be used. 2.   CRMS shall be used for communication between the customs authorities and between the customs authorities and the Commission for the application of Regulation (EU) 2023/956, and for the exchange of CBAM customs risk-related information and risk analysis as referred to in Regulation (EU) 2023/956. Article 3 Uniform User Management and Digital Signature platform 1.   The authentication and access verification of economic operators, officials of Iceland and Norway and officials of the EFTA Surveillance Authority, for the purposes of access to the CBAM Registry, shall be effected using the Uniform User Management and Digital Signature (UUM&DS) platform. 2.   The UUM&DS platform shall enable the communication between the Contracting Parties’ identity and access management systems referred to in paragraph 7 for the purpose of providing secure authorised access to the electronic systems to economic operators and the Contracting Parties’ officials. 3.   The UUM&DS platform shall consist of the following common components: (a) an access management system; (b) an administration management system. 4.   The UUM&DS platform shall be used to ensure the authentication and access verification of: (a) economic operators for the purpose of having access to the CBAM Registry; (b) the Contracting Parties’ officials, including officials of the EFTA Surveillance Authority, for the purpose of having access to the common components of the CBAM Registry and for the purposes of maintenance and management of the UUM&DS platform. 5.   The Contracting Parties shall set up the access management system provided by the Commission to validate the access requests submitted by economic operators and Contracting Parties’ officials, including officials of the EFTA Surveillance Authority, within the UUM&DS platform by interoperating with the Contracting Parties’ identity and access management systems referred to in paragraph 7. 6.   The Contracting Parties shall set up the administration management system to manage the authentication and authorisation rules for validating the identification data of economic operators for the purpose of allowing access to the electronic systems. 7.   The Contracting Parties shall set up identity and access management systems to ensure: (a) secure registration and storage of identification data of economic operators; (b) secure exchange of signed and encrypted identification data of economic operators, used in the identity and access management platform for the purpose of granting them access to the platform by the administrator of the platform. Article 4 Protection of professional secrecy and personal data 1.   The information exchanged by the Contracting Parties as part of the measures provided for in this Chapter shall enjoy the protection extended to professional secrecy and personal data as defined in the relevant laws applicable in the territory of the recipient Contracting Party. 2.   In particular, that information shall not be further transferred to persons other than the competent authorities in the recipient Contracting Party, nor shall it be used by those authorities for purposes other than those provided for in the EEA Agreement. Article 5 Data management, ownership and security The Contracting Parties shall ensure that the data registered at national level correspond to the data registered in the common components and are kept up to date. Article 6 Financing Arrangements concerning the responsibilities, commitments and expectations upon the implementation and operation of the CBAM Registry components and services, communications systems and underlying systems required for the operation of CBAM Regarding the extension of the use of the CBAM Registry to Iceland and Norway, these Financing Arrangements (hereinafter referred to as the “Arrangements”) define the elements of collaboration between the Contracting Parties related to the CBAM Registry and services, communication systems and underlying systems required for the operation of CBAM. (a) The Commission shall develop, test, deploy, manage and operate the specific adjustments to CBAM Registry components, including the applications and services, communication systems and underlying customs systems, such as UUM&DS, CCN2, CRMS, CRS and analytics (Datalab), that are necessary for the EFTA States’ operation of CBAM, including any specific adjustments related to the common central platform. (b) Iceland and Norway shall develop, test, deploy, manage and operate any national components that are deemed necessary for the interconnection to the CBAM Registry and operation of the common central CBAM processes, such as: (1) providing customs data compatible with the relevant data structure needed for communications with the CBAM Registry; (2) providing the relevant corporate identifier, and all related data, compatible with the relevant data structure needed for communications with the CBAM Registry, and regular updates of those data. (c) Iceland and Norway agree to cover the one-off costs incurred by specific adjustments in point (a) that are necessary for the EFTA States’ operation of CBAM, including any specific adjustments related to the common central platform, as follows from the indicative amounts annexed to Decision of the EEA Joint Committee No …/… of xx.xx.2026 (this Decision). Iceland and Norway shall share the amount between them applying the standard proportionality factor, except for the delivery costs for the CCN2 system, which shall be supported only by Iceland. (d) Iceland and Norway agree to cover a share of 0,625 %, as of 2027, of the operational costs of the communications and customs systems mentioned in point (a), with an annual indexation of 2 %. For UUM&DS and CRS, the operational costs shall be covered as of 2026. Iceland and Norway shall share the amount between them applying the standard proportionality factor, except for the operational costs of the CCN2 system, which shall be supported only by Iceland. The indicative amounts are annexed to Decision of the EEA Joint Committee No …/… of … 2026 (this Decision). (e) The Commission shall calculate the costs in accordance with its contracts with contractors established under the current procedures for the award of contracts. (f) Costs referred to in point (d) may be subject to a review in 2028, at the initiative of the Commission, without prejudice to the EU’s Multiannual Financial Framework. (g) The development and operational costs of national components shall be entirely borne by Iceland and Norway. (h) By 30 June each year, starting from 30 June 2026, or after the entry into force of Decision of the EEA Joint Committee No …/… of … 2026 (this Decision), whichever is the later, the Commission shall request Iceland and Norway to pay the one-off costs incurred for the development of the adjustments, including the applications and services, to CBAM Registry components that are necessary for the EFTA States, and communication systems and underlying customs systems, referred to in point (a), that are required for the EFTA States operation of CBAM, on the basis of a duly documented debit note issued by the Commission. (i) Iceland and Norway agree to participate in the operational costs of the applications and services and underlying customs systems that are interconnected with the operation of the CBAM Registry, referred to in point (a). For the purpose of fulfilling point (d), the following applies: (1) By 30 June each year, starting from 30 June 2026, or after the entry into force of Decision of the EEA Joint Committee No …/… of … 2026 (this Decision), whichever is the later, the Commission shall inform Iceland and Norway of the estimated operational costs for that year and the estimated operational costs for the next year in writing. (2) By 30 June 2027 only, the Commission shall request Iceland and Norway to each pay their annual contribution for the operational costs of year 2026, as well as the estimated annual contribution for 2027. By 30 June each year, starting from 30 June 2028, the Commission shall request Iceland and Norway to each pay their annual contribution for that year plus the amount of the balance (negative or positive) of the previous year on the basis of a duly documented debit note issued by the Commission. (3) By 31 January each year, starting from 31 January 2028, the Commission shall: — clear the accounts relating to the past annual costs on the basis of the sum already paid by Iceland and Norway as against actual costs incurred by the Commission, and provide Iceland and Norway with a statement of account containing a breakdown of costs identifying the different services and the supply of software; and — provide Iceland and Norway with the actual annual costs, i.e. real operational costs, for the past year. The Commission shall calculate the actual and estimated costs in accordance with its contracts with contractors established under the current procedures for the award of contracts. The balance (negative or positive) between the actual costs and the estimated amount of the previous year shall be calculated and communicated to Iceland and Norway via a statement of account from the Commission. The statement of account shall include the estimated annual amount for the contribution, plus the amount of the balance (negative or positive), resulting in a net amount that the Commission shall invoice to Iceland and Norway via the annual debit note. (j) The payment made by Iceland and Norway shall take place after the issuing date of the debit note. All payments shall be made to the Commission’s bank account indicated on the debit note within 60 days. In the Union, the utilisation of the appropriations arising from the participation of the EFTA States shall be in accordance with the provisions of the Financial Regulation. (k) If Iceland and Norway pay the amounts provided for in points (c) and (d) later than the dates specified in point (j), the Commission may charge interest on the arrears (at the rate applied by the European Central Bank to its operations in euro, published in the “C” series of the Official Journal of the European Union , on the day on which the deadline for repayment expires, plus one-and-a-half points). (l) If Iceland and Norway request specific adjustments to or new IT products for the CBAM Registry components, applications or services, the initiation and completion of those developments shall be subject to a separate mutual agreement regarding resource needs and development costs. (m) The Contracting Parties agree to acknowledge and fulfil their respective responsibilities in relation to the usage of the IT systems as described in this Annex. Article 7 Monitoring the implementation of this Annex The EEA Joint Committee shall determine how the Contracting Parties are to monitor the implementation of this Annex and to verify compliance with its provisions.’.

Article 2

This Decision shall enter into force on the date of its adoption.

Article 2

The following paragraph is inserted after paragraph 17 (Regulation (EU) 2025/2643 of the European Parliament and of the Council) of Article 7 of Protocol 31 to the EEA Agreement: ‘18.   The EFTA States shall, as from 1 January 2025, participate in the Union actions related to the following budget line, entered into the general budget of the European Union, for the financial years of 2025, 2026 and 2027. — Budget line 9.20.04.01 : “Carbon border adjustment mechanism”. This paragraph shall not apply to Liechtenstein.’.

Article 3

This Decision shall enter into force on the day following the last notification under Article 103(1) of the EEA Agreement  ( *1 ) . It shall apply from 1 January 2025.

Article 4

This Decision shall be published in the EEA Section of, and in the EEA Supplement to, the Official Journal of the European Union .

Indicative amounts to be paid by the EFTA States under Protocol 10 to the EEA Agreement

ANNEXSupplementary provisions

ANNEX Indicative amounts to be paid by the EFTA States under Protocol 10 to the EEA Agreement Post-2027 amounts do not prejudge the outcome of the ongoing negotiations on the next MFF proposal   Combined EFTA contributions (EUR) CBAM Registry 2025 Cost of EFTA specific features 500 000,00 2026 Cost of EFTA specific features 700 000,00 2027 Cost of EFTA specific features 250 000,00 2028 Cost of EFTA specific features tbd Common Central Platform 2026 - 2030 Cost of EFTA specific features Not yet identified at this stage CBAM Risk Management - Datalab 2026 Delivery cost 50 000,00 2027 Operational costs 40 000,00 2028 Operational costs 40 000,00 2029 Operational costs 40 000,00 2030 Operational costs 40 000,00 etc     UUM&DS costs 2026 Delivery cost 135 000,00 Operational costs 20 000,00 2027 Operational costs 20 000,00 2028 Operational costs 20 000,00 2029 Operational costs 20 000,00 2030 Operational costs 20 000,00 etc     CRS costs 2026 Delivery cost 150 000,00 Operational costs 12 500,00 2027 Operational costs 12 500,00 2028 Operational costs 12 500,00 2029 Operational costs 12 500,00 2030 Operational costs 12 500,00 etc     CCN2 costs 2026 Delivery cost 100 000,00 2027 Operational costs 10 000,00 2028 Operational costs 10 000,00 2029 Operational costs 10 000,00 2030 Operational costs 10 000,00 etc