From 18 August 2026, a new EU framework will change how law enforcement authorities obtain electronic evidence from service providers. If your organisation offers services to users in the European Union – whether as a cloud provider, hosting company, messaging platform or domain name service provider – the e-Evidence Package may affect you.
The e-Evidence Package consists of Regulation (EU) 2023/1543 and Directive (EU) 2023/1544. Together, they enable judicial authorities in one EU Member State to directly request electronic evidence from service providers operating in the EU, regardless of where the data is stored. The framework introduces two new legal instruments:
The framework applies broadly. It covers providers of electronic communications services, internet domain name and IP numbering services, and other information society services that enable user communications or store and process data on behalf of users, including hosting and cloud services. If your organisation provides such services, the e-Evidence Package is likely to apply.
1. Designate an establishment or appoint a representative
Service providers established in the EU must designate an establishment responsible for receiving and responding to orders. Service providers outside the EU but offering services within the EU must appoint a legal representative in a Member State.
2. Register the establishment or representative
The designated establishment or legal representative must be registered through the European Commission’s central registration platform.
3. Prepare for electronic communication
Orders will be exchanged through a decentralised EU-wide IT-system (for the technical specifications, see Commission Implementing Regulation (EU) 2025/1550). In the Netherlands, the planned web-based interface and API are still under development and are expected to become fully operational in Q1 2027. Until then, requests for electronic evidence will continue to be handled through existing international legal assistance channels.
4. Respond within strict deadlines
Once a valid order is received, service providers must act quickly. The standard deadline for Production Orders is ten days, which is reduced to eight hours in emergency situations involving an imminent threat to life, physical integrity, or critical infrastructure. The Regulation provides only limited grounds to challenge or refuse an order, such as manifest errors, incomplete requests or factual impossibility of compliance.
5. Build internal compliance processes
Service providers should implement procedures to receive, authenticate and process orders, identify and preserve relevant data, produce information within the applicable deadlines and, where necessary, raise objections through the mechanisms provided by the Regulation.
The Regulation will apply from 18 August 2026. Although Member States were required to transpose the Directive by 18 February 2026, several have yet to do so, including the Netherlands. The Dutch implementing legislation is still pending before the House of Representatives, which may affect the practical registration of Dutch designated establishments or legal representatives.
The e-Evidence Package reflects a broader trend towards direct cooperation between technology companies and law enforcement authorities. Organisations that fall within scope should start preparing now. Early action will help ensure compliance with the new framework and avoid operational challenges once the first requests start arriving.
Want to learn more about the e-Evidence Package? Feel free to contact one of our specialists within team IT, Privacy & Cybersecurity.
Would you like to receive a monthly overview of our latest legal updates and blog articles? Subscribe to our newsletter.
