EEA Agreement 2026: new digital obligations for Spanish companies in Norway, Iceland and Liechtenstein

Key data

If your company provides digital or telecommunications services in Norway, Iceland or Liechtenstein, there are regulatory changes you need to know about now. The Decision No. 98/2026 of the EEA Joint Committee, published on 25 June 2026 with effect from 20 March 2026, updates Annex XI of the Agreement on the European Economic Area and incorporates new EU digital regulation into the legal framework of these three countries.

The practical result: the rules of the European single digital market extend to Norway, Iceland and Liechtenstein, and companies operating there—including Spanish ones—must comply with them just as in any EU Member State.

What does this regulation establish?

The Agreement on the European Economic Area (EEA) allows Norway, Iceland and Liechtenstein to participate in the EU internal market without being Member States. For this to work, the EEA Joint Committee periodically updates the annexes of the Agreement to incorporate new European legislation.

This Decision specifically modifies Annex XI, which regulates electronic communication, audiovisual services and the information society. By incorporating new EU digital regulation, it ensures that:

• The rules applicable to digital services are the same in all 30 EEA countries (27 EU + Norway, Iceland and Liechtenstein).
• Companies operating in these markets do not face divergent regulatory frameworks depending on the country.
• The free provision of digital services in the EEA is maintained on a homogeneous and updated legal basis.

The modification of Annex XI means that EU regulatory acts on digital matters incorporated have binding effect in the three non-EU EEA countries, in the same way as they do in the Member States of the Union.

Economic and operational impact

The direct impact depends on which specific EU regulation has been incorporated into Annex XI through this Decision. What is clear from an operational perspective is that any Spanish company with active presence in Norway, Iceland or Liechtenstein in the affected sectors must conduct a compliance review.

The most relevant operational effects are:

• New compliance requirements: Commercial, technical or contractual practices that already comply with EU digital regulation must also be verified in non-EU EEA markets, as the same framework now applies.
• Regulatory harmonization: For companies already operating in accordance with European digital regulation, the additional burden may be limited if their processes are uniform across all EEA markets.
• Risk of retroactive non-compliance: The entry into force is 20 March 2026, prior to publication on 25 June 2026. This means that obligations are already active and any period of non-conformity from that date may be relevant.

Who does it affect?

• Spanish technology companies with subsidiaries, branches or customers in Norway, Iceland or Liechtenstein.
• Telecommunications operators with cross-border activity in the EEA.
• Digital services providers (platforms, SaaS, marketplaces, audiovisual services) that provide services in these three countries.
• Audiovisual services companies with distribution in non-EU EEA markets.
• Legal and compliance advisors managing clients with operations in the EEA.
• CFOs and operations directors of business groups with presence in the three affected countries.

Practical example

A Spanish B2B software company that markets its SaaS platform in Norway and already complies with EU digital regulation in Spain must now verify the following:

1. Identify which specific EU regulatory acts have been incorporated into Annex XI through Decision 98/2026.
2. Check whether its service contract with Norwegian customers, its terms of use and its technical processes comply with the new incorporated requirements.
3. Confirm that the effective compliance date is 20 March 2026—not the publication date—so any pending adjustments must be addressed urgently.

If the company already applies EU digital regulation uniformly across all its markets, the additional impact may be minimal. If, on the other hand, it maintained differentiated practices for the Norwegian, Icelandic or Liechtenstein markets, it must now align them.

What should companies do now?

1. Verify if you operate in the affected countries: Confirm whether your company has commercial, contractual or technical activity in Norway, Iceland or Liechtenstein in the telecommunications, digital services or audiovisual sectors.
2. Identify the incorporated regulatory acts: Consult the full text of Decision 98/2026 in the EU Official Journal to learn which specific EU regulation has been incorporated into Annex XI.
3. Conduct a compliance review: Assess whether your contracts, technical processes and commercial practices in these markets comply with the new requirements. Prioritize areas where differences already existed compared to your EU operations.
4. Update documentation and processes: If compliance gaps are detected, implement the necessary adjustments. Remember that entry into force was 20 March 2026.
5. Inform local teams: If you have teams or representatives in these countries, ensure they are aware of the new requirements and apply them in their daily operations.
6. Consult with a specialized advisor: To determine the exact scope of the new obligations in your specific case, consult with a legal advisor specialized in European digital law and EEA regulation.

Official source

Consult complete regulation in official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=OJ:L_202601238