Key takeaways for service providers
The entry into force of the e-Evidence Regulation (EU) 2023/1543 (the Regulation) marks a significant shift in the landscape of cross-border law enforcement access to electronic evidence. Service providers operating in the EU should:
- Prepare for EPOs from 18 August 2026, even if their legal representative is established in a Member State that has not yet finalised its implementing legislation.
- Be aware that implementation gaps do not excuse non-compliance. The Regulation is directly applicable, and other Member States may issue EPOs regardless of the implementation status in the country where the service provider’s legal representative is established.
- Assess the GDPR implications of disclosing data in response to EPOs, particularly where the IT system is not yet available and complying with EPOs may be perceived as a voluntary disclosure of personal data.
- Engage proactively with authorities. Good-faith engagement with the authorities involved is the most effective way to manage enforcement risk during the interim period.
- Monitor legislative developments in the Netherlands and other Member States as the implementing framework continues to take shape.
Together with Directive (EU) 2023/1544, the Regulation establishes a harmonised framework for the cross-border gathering of electronic evidence in criminal proceedings. Under this framework, a judicial authority in one EU Member State can issue an EPO directly to a service provider’s legal representative in another Member State, requiring the production of subscriber data, traffic data or content data. The Regulation is intended to replace the often slow and cumbersome mutual legal assistance procedures that have traditionally governed cross-border requests for electronic evidence.
The Dutch implementation gap
While the Regulation becomes directly applicable on 18 August 2026, many Member States have not yet finalised the national legislation required to make the framework fully operational. One element of the Dutch implementation package, which is not expected to enter into force until early 2027, is the designation of the Netherlands Authority for Consumers and Markets (ACM) as the competent authority to oversee the requirement for communications service providers and other service providers established or active in the Netherlands to register a legal representative. The goal of this registration is to have a point of contact when issuing EPOs. Since the Dutch implementation package is not yet applicable, companies cannot yet comply with the registration requirement in the Netherlands, and ACM is not yet authorised to enforce this requirement.
IT system
Another issue, common across the EU, is that the decentralised IT system envisaged for the submission of EPOs is not yet operational, with the European Commission itself acknowledging practical and security-related complications. As a result, the local authorities issuing EPOs are not yet formally in a position to submit them, while the local authorities in the recipient Member State cannot perform their review function under the Regulation.
Other Member States may still issue EPOs
Critically, the fact that the Netherlands has not yet implemented the Regulation does not necessarily prevent other EU Member States from issuing EPOs. Several countries – including Germany, Sweden Croatia, Italy, Lithuania and Slovakia – have already adopted their implementing legislation, which enters into force on 18 August 2026. Although the European Commission indicated in guidance that this is not formally possible, authorities may still try to issue EPOs from that date and may require service providers to identify alternative means through which orders can be received while the IT system is being developed.
The Regulation requires Member States to ensure that non-compliance with EPOs can be subject to fines of up to 2% of global annual turnover. In the Netherlands, whilst the Dutch Implementation Act (Uitvoeringswet elektronisch bewijsmateriaal) is not yet in force, failure to comply with an EPO issued by a competent authority may technically already constitute a criminal offence under the existing Dutch Criminal Code, even in the absence of the Dutch implementation package.