EU e-Evidence
The EU “e-Evidence package” — Regulation (EU) 2023/1543 and Directive (EU) 2023/1544 — makes it faster for judicial authorities investigating crime to obtain electronic evidence, such as emails, app messages and subscriber or traffic data, directly from service providers, wherever in the EU that provider or its representative is located.
It introduces two instruments: the European Production Order, which compels a service provider to hand over specified data, and the European Preservation Order, which requires a provider to preserve data pending a follow-up request for up to 60 days, extendable by a further 30 days (Regulation (EU) 2023/1543, Article 11). Addressees must generally respond within 10 days, or within 8 hours in emergencies.
Like the GDPR, DSA and NIS 2, the e-Evidence Regulation has extra-territorial scope. It applies to providers of electronic communications services, internet domain name and IP numbering services, and other information society services that let users communicate with each other or store or process data on their behalf — for example social networks, online marketplaces, cloud computing and other hosting services, and online gaming or gambling platforms — wherever in the world they are established, provided they offer these services in the EU. Financial services are excluded from scope.
Under Directive (EU) 2023/1544, service providers without an establishment in a participating EU Member State must appoint a legal representative in writing. That representative is the addressee for receiving, complying with and enforcing European Production Orders and European Preservation Orders on the provider’s behalf, and must be notified to the competent authority together with accepted contact details and languages.
Failing to designate a representative at all is subject to penalties set by each Member State’s national law — effective, proportionate and dissuasive, though never a suspension of service (Directive (EU) 2023/1544, Article 5). Once a representative is appointed, failing to comply with an actual Production or Preservation Order can trigger fines of up to 2% of the provider’s annual worldwide turnover (Regulation (EU) 2023/1543, Article 15).
EU e-Evidence Representative FAQ
Does my company need an e-Evidence Representative?
If your organisation provides electronic communications services, internet domain name or IP numbering services, or other information society services that let users communicate with each other or store or process data on their behalf — such as social networks, online marketplaces, cloud computing or other hosting services, or online gaming and gambling platforms — and offers these in the EU without an establishment there, you will generally need to appoint an e-Evidence legal representative. Financial services are excluded from scope.
What does an e-Evidence legal representative do?
Your representative receives, complies with and enforces European Production Orders and European Preservation Orders issued by judicial authorities anywhere in the EU, and supports you in meeting the Regulation’s response deadlines — 10 days for standard requests, 8 hours for emergencies.
When does the EU e-Evidence Regulation apply?
Regulation (EU) 2023/1543 applies from 18 August 2026. Providers already offering services in the EU by 18 February 2026 must appoint a representative by 18 August 2026; providers that start offering services after that date must appoint one within six months.
What happens if I don’t appoint a representative?
Failing to designate a representative is subject to penalties under national law (Directive (EU) 2023/1544, Article 5) — effective, proportionate and dissuasive, though never a suspension of service. Once a representative is appointed, failing to comply with an actual order can trigger fines of up to 2% of your annual worldwide turnover (Regulation (EU) 2023/1543, Article 15), with joint and several liability between you and your representative for that failure.
