EEE updates digital regulations 2025: what service companies must review

Key data

Spanish companies with operations in the European Economic Area outside the EU have new obligations to review. The Decision 307/2025 of the EEA Joint Committee, adopted on 5 December 2025 and published on 16 April 2026, extends updated European regulations to Norway, Iceland and Liechtenstein in three key areas: services in general, electronic communication and information society.

The decision does not create new regulation from scratch: it incorporates into the EEA Agreement framework European regulations already in force in the EU, requiring the three non-EU EEA countries to apply it. For Spanish companies operating in these markets, this means that the rules of the game are harmonized, but also that they must verify that their operations already comply with the new standards.

What does this regulation establish?

Decision 307/2025 modifies three elements of the EEA Agreement:

The mechanism is the usual one in the EEA: when the EU approves new regulations in areas covered by the EEA Agreement, the Joint Committee adopts decisions to incorporate them into the legal system of the three non-EU countries. This decision is the result of that process for digital and services regulations recently approved in the EU.

Economic and operational impact

The direct impact depends on the degree of exposure of each company to the markets of Norway, Iceland and Liechtenstein. The most relevant operational effects are:

• Contract review: Contracts for the provision of cross-border services with counterparties in these three countries may require adjustments to reflect the new regulatory obligations.
• Digital regulatory compliance: Companies providing electronic communication, audiovisual or information society services in these countries must verify that their operations comply with European regulations now incorporated into the EEA.
• Regulatory interaction: The update of Protocol 37 modifies the list of competent bodies under Article 101 of the EEA Agreement, which may affect authorization, notification or supervision procedures in these markets.
• Regulatory harmonization: In the medium term, the extension of EU regulations to the EEA reduces regulatory fragmentation and can simplify operations for companies that already comply with European regulations in their operations within the EU.

Who does it affect?

This decision directly affects:

• Telecommunications and electronic communication companies with operations or customers in Norway, Iceland or Liechtenstein.
• Platforms and audiovisual services companies (streaming, video on demand, digital content) that distribute in these countries.
• Information society services companies (e-commerce, digital intermediation, cloud services) with presence in the non-EU EEA.
• Companies providing services in general that provide cross-border services in the EEA and are subject to Annex X of the Agreement.
• Legal and compliance advisors managing the regulation of clients with operations in these markets.
• CFOs and operations directors of business groups with subsidiaries or active contracts in Norway, Iceland or Liechtenstein.

Practical example

A Spanish electronic communication services company operating in Norway has service provision contracts signed under the previous EEA regulatory framework. With the entry into force of Decision 307/2025 on 5 December 2025, the European regulations incorporated into Annex XI are now applicable in Norway.

This company must: first, identify what specific European regulations have been incorporated into Annex XI through this decision; second, verify whether its contracts and operating procedures in Norway already comply with that regulation (given that it probably already applies it in its operations within the EU); and third, review whether the Norwegian regulatory bodies with which it interacts have changed according to the update of Protocol 37.

If the company already complies with the equivalent European regulations in Spain, the effort to adapt will be limited. If it operates in Norway with a differentiated model compared to its operations in the EU, the impact may be more significant.

What should companies do now?

1. Identify exposure: Determine whether your company has active contracts, subsidiaries or customers in Norway, Iceland or Liechtenstein in the digital services, electronic communication or audiovisual sectors.
2. Review cross-border contracts: Analyze service provision contracts with counterparties in these three countries to identify clauses that may require updating in light of the new regulations incorporated into the EEA.
3. Verify digital regulatory compliance: Check that operating procedures in these markets comply with European regulations now enforceable in the EEA, especially in electronic communication and information society services.
4. Update regulatory interlocutors: Review the updated list of competent bodies in Protocol 37 to ensure that authorization, notification or supervision procedures are directed to the correct bodies.
5. Consult the full text of the decision: Access the Decision 307/2025 published in EUR-Lex to identify the specific European regulations incorporated into Annexes X and XI, which will determine the exact scope of the new obligations.