E-Evidence Act in Force – What Service Providers Need to Know

Since 18 August 2026, the E-Evidence Regulation (Regulation (EU) 2023/1543) has been fully applicable following the expiry of the three-year transitional period. The Regulation entered into force on 18 August 2023 but only became directly applicable in all Member States – with the exception of Denmark – as of today. This establishes a largely uniform legal framework for cross-border access to electronic evidence, intended to significantly shorten the previously often protracted mutual legal assistance procedures in criminal investigations. Law enforcement authorities can now request electronic evidence directly from service providers in other Member States.

While Germany has established the necessary national legal framework through the EBewMG (Elektronische-Beweismittel-Umsetzungs- und Durchführungsgesetz), implementation in numerous other Member States has not yet been completed. The following article examines the regulatory framework, the current status of registration and notification obligations, and highlights the measures that service providers should now take.

I. Regulatory Framework of the E-Evidence Regulation

The E-Evidence Regulation addresses a broadly defined group of service providers. Under Article 3(3) of the E-Evidence Regulation, this includes in particular providers of electronic communications services, providers of internet domain name and IP numbering services, and certain information society services. In addition to traditional telecommunications companies, this may include messenger and email services, domain registrars, as well as cloud and hosting providers. Platforms that provide their users with communication functionality or the ability to store or process data may also fall within the scope of the Regulation. What is decisive is therefore not the formal classification of the company, but the specific design of the service offered (as reported in Data Protection Update No. 249).

At the core of the new regulatory framework are the European Production Order and the European Preservation Order, which are transmitted to the service provider by means of EPOC and EPOC-PR certificates. The Production Order allows law enforcement authorities to request electronic evidence directly from a service provider or its designated addressee. The Preservation Order, by contrast, serves to provisionally preserve data in order to prevent its deletion or alteration pending a subsequent production request.

The Production Order must generally be complied with within ten days, while in emergencies a reduced period of eight hours applies. Following a Preservation Order, the affected data must initially be preserved for 60 days, with an extension of a further 30 days possible.

The direct addressing of orders to the service provider requires that the provider designates an appropriate addressee or representative within the European Union (Article 3(1) of the E-Evidence Directive). Orders are then addressed directly to this addressee (Article 7 of the E-Evidence Regulation). This addressee must have the necessary powers and resources to receive orders and to facilitate their execution.

II. Current Status of the Registration and Notification Procedure

1. German Implementation

Germany established the national legal framework for the application of the E-Evidence Regulation through the Act transposing Directive (EU) 2023/1544 and implementing Regulation (EU) 2023/1543, which was published in the Federal Law Gazette on 12 March 2026. The centrepiece is the EBewMG.

This Act specifies in particular the obligations of service providers under the E-Evidence Directive to designate an addressee or representative and the related notifications to the competent authority. Service providers with an establishment in the European Union must generally designate an appropriate establishment as addressee. Providers without an establishment in the Union must appoint a representative. The addressee must be equipped with the necessary powers and resources to receive European Production and Preservation Orders and to facilitate their execution.

The central authority for registration and monitoring of the relevant obligations is the Federal Office of Justice (Bundesamt für Justiz, BfJ). It monitors in particular compliance with the designation and notification obligations of service providers and cooperates with the competent authorities of other Member States. In the event of breaches of these obligations, fines of up to EUR 500,000 may be imposed under Section 18 EBewMG, and for service providers with a global annual turnover exceeding EUR 5 million, fines of up to 2 per cent of global annual turnover.

At the point of application, however, a significant discrepancy is apparent between the expected and the actually registered group of providers: according to the Federal Ministry of Justice, only 193 registrations had been received by the BfJ as of 18 August 2026, whereas the Federal Government had originally anticipated around 9,000 covered service providers.

The technical infrastructure for implementation is also fundamentally operational in Germany at the point of application. The EU-wide exchange between the judiciary, law enforcement authorities and service providers is to take place via a decentralised IT system with interoperable access points, based on the European e-CODEX infrastructure. Germany is connected to this system via a national access point. This point, including its connection to the specialist application Judex, has been operational since 18 August 2026. The technical prerequisites for securely transmitting and receiving orders between the parties involved are therefore in place.

Organisational coordination is carried out by the E-Justice Coordination Office Europe (EKE), located in North Rhine-Westphalia. All 952 courts and central offices reported by the state justice administrations are already connected to it. In addition, police as well as other federal and state authorities are being connected to the reference implementation software. Germany thus has in place at the point of application not only the necessary national legal framework, but also a largely established technical and organisational infrastructure for the practical implementation of the E-Evidence procedure.

2. European Comparison

A uniformly functioning EU-wide procedure does not yet exist, however. According to the current state of implementation, only eleven other Member States besides Germany have adopted implementing legislation. In six further Member States, draft legislation has already been presented, while in the remaining nine Member States no publicly discernible implementation activity can be identified to date. This has immediate practical consequences for cross-border exchange: according to the Federal Ministry of Justice, initially only Germany is expected to be able to both transmit and receive orders via the secure decentralised IT system. Orders may be transmittable to Ireland, but Ireland itself is not yet expected to be able to issue orders, as the legal bases for issuing and validating authorities have not yet been fully established there.

Ireland is of particular practical importance due to the European headquarters of numerous large US technology companies located there.

A further limitation arises from the scope of the E-Evidence Directive itself. Under Article 1(2), second sentence, of the E-Evidence Directive, the Directive does not apply to service providers that are established in the territory of only one Member State and offer their services exclusively there. This may be particularly relevant for corporate groups with national subsidiaries. If a group operates its services in the individual Member States through separate companies active exclusively at national level, the relevant company may in certain circumstances be regarded as a purely domestic provider falling outside the scope of the Directive, and thus be exempt from the obligation to designate an addressee. For cross-border investigations, this means that an addressee may be lacking and that not every service provider established in the Union can necessarily be reached via the E-Evidence regime by authorities of another Member State.

At the point of application, an ambivalent picture thus emerges: while Germany has established the legal, organisational and technical prerequisites for the new procedure, significant differences in the state of implementation and actual scope of application persist at European level.

III. Recommendations for Service Providers

For service providers, the need for action at the point of application of the E-Evidence Regulation is not limited to formal registration. What is critical is that the designated addressee is actually capable of receiving an EPOC or EPOC-PR at short notice, assigning it internally and processing it within the required timeframes. Companies should therefore take the following practical precautions in particular:

• Addressee and Accessibility: First, it should be verified that the registered addressee actually has the necessary powers and resources. For internationally active corporate groups, it should be clearly established which company or establishment is responsible for orders. Merely forwarding to a general legal or support address is insufficient given the short response times. For emergencies, a reachable point of contact must exist that can respond outside normal business hours.
• Rapid Internal Routing: When an EPOC is received by the addressee, it must be possible to determine within a short time which internal unit is responsible for review and execution. A clearly defined process is therefore advisable, providing for automatic escalation to legal, law enforcement teams and, where applicable, IT. This is particularly relevant for the eight-hour deadline in emergencies: an order received at night or on a weekend, for example, must not reach the responsible specialist department only on the next working day.
• Determining Data Category and Storage Location: Before production, it should also be immediately established which data are affected and where they are stored or technically accessible. This is particularly relevant for cloud and platform providers whose data may be distributed across different systems or Member States. A provider should therefore be able to document comprehensibly, for its own products, which subscriber, identification, traffic and content data are processed and which systems can access that data.
• Technical Capability to Execute Preservation Orders: In the case of an EPOC-PR, it must also be ensured that the affected data are actually protected from deletion or overwriting for the specified period. This is particularly relevant for services with automated deletion or rotation processes, such as for log or traffic data. Companies should therefore examine whether an incoming Preservation Order can be automatically forwarded to the systems responsible for data retention and how the preservation is documented.

IV. Conclusion and Outlook

With the point of application of the E-Evidence Regulation, a fundamentally capable instrument for cross-border access to electronic evidence is now available, though its practical effectiveness is currently still limited by the uneven state of implementation across Member States. While Germany has largely established the legal, organisational and technical prerequisites, it remains to be seen how quickly the remaining Member States follow suit and whether the registration rate of service providers – which has so far fallen significantly short of expectations – increases.

For practice, it will therefore initially be decisive that service providers complete their registration and design their internal processes so that Production and Preservation Orders can actually be processed within the required timeframes. Only when both the legal framework and technical connectivity are in place EU-wide will it become apparent whether the E-Evidence Regulation can fulfil the expectations associated with it for faster and more effective cross-border evidence gathering.

This article was created in collaboration with our student employee Emily Bernklau.