What Is the EU e-Evidence Regulation? What Service Providers Need to Know
The EU “e-Evidence package” (Regulation (EU) 2023/1543 and Directive (EU) 2023/1544) makes it faster for judicial authorities investigating crime to obtain electronic evidence, such as emails, app messages and subscriber or traffic data, directly from service providers, wherever in the EU that provider or its representative is located.
For providers based outside the EU, it introduces something familiar from the GDPR, the DSA and NIS 2: an obligation to appoint a legal representative inside the Union. Below we walk through what the Regulation actually requires, who it applies to, and what the deadlines look like in practice.
What are European Production and Preservation Orders?
The EU e-Evidence package lets judicial authorities obtain electronic evidence directly from service providers, wherever in the EU the provider or its representative is based. The Regulation has applied across every EU Member State since 18 August 2026. This guide covers what it requires, who is in scope, how tight the response deadlines are, and when you need to appoint a legal representative.
The Regulation introduces two new instruments:
- The European Production Order: Which compels a service provider to hand over specified data.
- The European Preservation Order: Which requires a provider to preserve data pending a follow-up request, for up to 60 days, extendable by a further 30 days (Regulation (EU) 2023/1543, Article 11).
Both are issued directly to the provider or its designated representative, rather than routed through another Member State’s authorities.
How quickly do you have to respond?
Addressees must generally respond within 10 days, or within 8 hours in emergencies. That is a significant departure from the procedures it replaces: a European Investigation Order can take up to 120 days to produce a result, and a mutual legal assistance request can take around 10 months.
In practice, this means an order can arrive with an 8-hour clock attached. Whoever receives it on your behalf needs to be reachable at short notice and able to escalate internally straight away.
Who does the EU e-Evidence Regulation apply to?
Like the EU GDPR, the EU DSA, and EU NIS 2, the e-Evidence Regulation has extra-territorial scope. It applies to:
- Providers of electronic communications services
- Internet domain name and IP numbering services
- Other information society services that let users communicate with each other, or store or process data on their behalf, for example social networks, online marketplaces, cloud computing and other hosting services, and online gaming or gambling platforms
This applies wherever in the world the provider is established, as long as it offers these services in the EU. Financial services are excluded from scope.
Whether you are "offering services in the EU" depends on factors such as having a significant number of EU users, or targeting the EU market, for example through EU languages, currencies, local advertising, or customer service offered in an EU language.
Do you need an e-Evidence legal representative?
Under Directive (EU) 2023/1544, service providers without an establishment in a participating EU Member State must appoint a legal representative in writing. That representative becomes the addressee for receiving, complying with, and enforcing European Production Orders and European Preservation Orders on the provider's behalf, and must be notified to the competent authority together with accepted contact details and languages.
When does the EU e-Evidence Regulation apply?
The Regulation came into effect on 18 August 2026. The transition worked in two steps:
- Providers already offering services in the EU on 18 February 2026 needed to have appointed a representative by 18 August 2026.
- Providers that start offering services in the EU after that date have six months from starting to appoint a representative.
If your organisation falls into the first group and does not yet have a representative in place, this is overdue and worth prioritising.
What happens if you do not comply?
There are two distinct penalty regimes here, and it is worth keeping them apart.
Failing to designate a representative at all is subject to penalties set by each Member State's own national law. These must be effective, proportionate, and dissuasive, but they never include a suspension of service (Directive (EU) 2023/1544, Article 5).
Once a representative is appointed, failing to comply with an actual Production or Preservation Order is a separate matter. That can trigger fines of up to 2% of the provider's annual worldwide turnover (Regulation (EU) 2023/1543, Article 15), with the provider and its representative potentially held jointly and severally liable for that failure.
Preparing for the e-Evidence Regulation
If you offer electronic communications, hosting, cloud, online marketplace, or similar digital services in the EU without an establishment there, the practical starting point is appointing a representative who can receive orders, meet the response deadlines, and handle notification to the competent authority.
Prighter acts as your EU e-Evidence legal representative, giving judicial authorities a single, reliable point of contact and giving you full visibility over every order you receive. Get started with Prighter today.