Summary
- Regulation (EU) 2023/1543 applies from 18 August 2026.
- European Production Orders normally require a response within 10 days and within eight hours in emergencies.
- The regime places more of the operational burden for cross-border criminal evidence requests directly on service providers.
A new European regime for obtaining electronic evidence in criminal investigations is now applicable, allowing judicial authorities to issue binding cross-border production and preservation orders directly to service providers.
Regulation (EU) 2023/1543 applies from 18 August 2026 and creates European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings and the execution of custodial sentences following criminal proceedings.
The framework is intended to reduce delays where information relevant to an investigation is held by a provider established or represented in another participating EU country. It covers categories including subscriber information, traffic data, and content data under the conditions established by the Regulation.
A European Production Order normally has to be fulfilled within 10 days. In an emergency, the requested information must be transmitted without undue delay and no later than eight hours after receipt of the relevant certificate.
The Regulation also establishes procedures around enforcement, refusal, notification, protected information, and conflicts of law. The mechanism does not give authorities an unrestricted route to digital information: necessity, proportionality, jurisdiction, and fundamental-rights safeguards continue to apply.
Evidence handling becomes an operational discipline
The regime changes the practical position of technology and communications providers receiving criminal-evidence demands. Requests that previously depended more heavily on cooperation between authorities in different countries can now arrive directly at designated establishments or legal representatives.
That increases pressure on internal processes capable of identifying the correct data, preserving it without alteration, establishing whether an order is legally valid, escalating protected or privileged material, and responding inside the statutory deadline.
The eight-hour emergency window is particularly demanding. Legal, security, compliance, and operational teams may need to coordinate across jurisdictions and outside ordinary business hours while retaining a defensible record of how the request was handled.
The Regulation also gives failures a potentially material financial dimension. Member states must provide for sanctions that are effective, proportionate, and dissuasive, with the framework allowing maximum financial penalties of at least 2% of the service provider’s total worldwide annual turnover in the preceding financial year for serious non-compliance.
The measure sits alongside Directive (EU) 2023/1544, which deals with designated establishments and legal representatives for certain service providers offering services in the Union. Together, the measures create the organisational and procedural structure needed for orders to cross borders without relying exclusively on conventional mutual legal-assistance routes.
The regime reflects the geography of modern digital services. Communications, hosting, cloud storage, and online platforms can place the provider, the user, the investigator, and the underlying infrastructure in several different jurisdictions at once. Electronic information can also disappear far faster than traditional physical evidence.
Those characteristics have made delays in cross-border evidence gathering an increasingly practical constraint on criminal investigations. The new framework seeks to reduce that friction without removing judicial oversight and formal challenge mechanisms.
From 18 August, those requirements move from implementation planning into live operational responsibility. Providers within scope now need their legal representation, evidence-handling processes, technical access, and escalation routes to work at the speed prescribed by the Regulation.
