Thought Leadership
Since August 18, 2026, the EU’s E-Evidence Regulation (2023/1543) has been fully applicable following a three-year transition period. The rules allow law enforcement authorities to request electronic evidence directly from service providers in other EU countries.
The regulation affects more than traditional telecommunications providers. Messenger and email services, cloud providers, hosting companies, and domain registrars are also covered.
Two new instruments govern the disclosure and preservation of data:
- European Production Order (EPOC): Providers generally have ten days to respond. In emergencies, the deadline is reduced to just eight hours.
- European Preservation Order (EPOC-PR): Data must be protected from deletion for 60 days, with a possible extension of another 30 days.
To ensure that authorities can reach providers, affected companies must designate an establishment or legal representative in the EU to receive such orders. That designated addressee must have sufficient authority and resources to process orders within the required deadlines.
Germany Is Ready, but Many Providers Are Not
Germany created the necessary legal framework back in March 2026 with the EBewMG. The Federal Office of Justice (BfJ) is the competent authority and can impose fines of up to €500,000 or 2 percent of a company’s global annual turnover for violations of the registration requirement. The technical connection through the European e-CODEX system is also in place. The problem is provider participation: while the German government expected around 9,000 service providers to register, only 193 had done so with the BfJ by the deadline.
A Patchwork of Implementation Across the EU
The situation remains inconsistent across Europe. In addition to Germany, only eleven other member states have adopted their implementing legislation. Six more are still working on draft laws, while nine have shown no visible progress so far. Ireland presents a particularly sensitive case. Home to the European headquarters of many major US technology companies, the country can receive E-Evidence orders but, due to the lack of a complete legal framework, cannot yet issue them itself.
Service providers should therefore review their arrangements now. In particular, they need to ensure that their designated EU addressee is genuinely reachable and able to act, including through emergency procedures outside normal business hours.
(Editorial Team)
