What does the European Union framework for electronic evidence create, and does it operate yet?

The Union stated the reason itself. Recital 8 of the Regulation records that Directive 2014/41/EU establishing the European Investigation Order, and the Convention on Mutual Assistance in Criminal Matters, both allow evidence to be requested from another Member State — but that "the procedures and timelines" they provide "might not be appropriate for electronic evidence, which is more volatile and could more easily and quickly be deleted".

Two orders exist, and their definitions carry the distinction between them. Article 3(1) defines a European Production Order as a decision ordering the production of electronic evidence, issued or validated by a judicial authority of a Member State, "addressed to a designated establishment or to a legal representative of a service provider offering services in the Union, where that designated establishment or legal representative is located in another Member State bound by this Regulation". Article 3(2) defines a European Preservation Order identically as to addressee, but as ordering preservation "for the purposes of a subsequent request for production".

The addressee exists because a second instrument requires it to. Article 3(1) of Directive (EU) 2023/1544 obliges Member States to ensure that providers offering services in the Union designate or appoint at least one addressee for the receipt of, compliance with and enforcement of such orders — a designated establishment where the provider is established in the Union with legal personality, and a legal representative where it is not established in the Union, or is established in a Member State not taking part.

Who may issue an order depends on what is sought. Under Article 4(1), a production order for subscriber data, or for data requested for the sole purpose of identifying the user, may be issued by a judge, a court, an investigating judge or a public prosecutor — or by another competent investigating authority, whose order must then be validated by one of those. Under Article 4(2), a production order for traffic data other than identification data, or for content data, may be issued only by a judge, a court or an investigating judge — not a public prosecutor — or validated by one of those.

And Article 4(3) does something the domestic layer has no equivalent for: a European Preservation Order for data of any category — including content — may be issued by a judge, a court, an investigating judge or a public prosecutor.

The other Member State is brought back in for the sensitive categories

Article 8(1) requires the issuing authority to notify the enforcing authority — the authority of the Member State where the addressee is — by transmitting the order to it at the same time as to the addressee, where the order seeks traffic data other than identification data, or content data. Article 8(2) disapplies that where the issuing authority has reasonable grounds to believe both that the offence was, is being or is likely to be committed in the issuing State and that the person whose data are requested resides there. Article 8(4) gives the notification suspensive effect on the addressee’s obligations, except in emergencies.

The person is told, with exceptions that must be recorded

Article 13(1) requires the issuing authority to inform the person whose data are being requested, without undue delay. Article 13(2) permits delaying, restricting or omitting that under the conditions of Article 13(3) of Directive (EU) 2016/680, with reasons recorded in the case file and a short justification added to the certificate. Article 13(3) requires the information, when given, to include information about available remedies.

Remedies lie in the issuing State

Article 18(1) gives any person whose data were requested the right to effective remedies against the order, and a suspect or accused person the right to remedies during the criminal proceedings in which the data are used. Article 18(2) provides that the right is exercised "before a court in the issuing State" and includes challenging legality, "including its necessity and proportionality", without prejudice to fundamental-rights guarantees in the enforcing State.

And a conflict with a third country has a defined route

Article 17(1) lets an addressee that considers compliance would conflict with the applicable law of a third country inform the issuing and enforcing authorities by reasoned objection. Article 17(2) provides that the objection may not be based merely on the absence of similar provisions in that third country’s law.

On timing, the instruments answer separately. Article 34(2) of the Regulation provides: "It shall apply from 18 August 2026." The same paragraph carries a later and separate trigger — the obligation to use the decentralised IT system established in Article 19 for written communication applies "from one year after the adoption of the implementing acts referred to in Article 25". Article 7(1) of the Directive required Member States to bring transposing measures into force "by 18 February 2026".

• Common belief: A European Production Order is a European Investigation Order for data.

  In practice: An EIO is a judicial decision to have measures carried out in another Member State by that State, on mutual recognition. A European Production Order is addressed to a provider’s designated establishment or legal representative. Recital 8 of the Regulation states why both exist.

• Common belief: The Regulation and the Directive are two names for the same measure.

  In practice: A Regulation is directly applicable; a Directive requires transposition. The Regulation addresses orders to an addressee, and the Directive is what obliges providers to designate or appoint one.

• Common belief: The same authority can issue any of these orders.

  In practice: Article 4(1) allows a public prosecutor to issue a production order for subscriber or identification data; Article 4(2) does not allow a prosecutor to issue one for traffic data other than identification data, or for content data.

• Common belief: If a prosecutor cannot order content produced, a prosecutor cannot reach it at all.

  In practice: Article 4(3) allows a European Preservation Order for data of any category, including content, to be issued by a public prosecutor. Preserving is not producing, and the Regulation prices them differently.

• Common belief: Because the order goes to a company, the other Member State is not involved.

  In practice: Article 8(1) requires the enforcing authority to be notified where the order seeks traffic data other than identification data, or content data, and Article 8(4) suspends the addressee’s obligations meanwhile except in emergencies.

• Common belief: Because the Regulation applies, every part of the framework is in operation.

  In practice: The Article 19 decentralised IT system obligation applies one year after implementing acts adopted under Article 25, and whether those acts exist was not researched. Whether Member States have transposed the Directive, and whether providers have designated addressees, was not researched either.

  The Regulation’s own application date, 18 August 2026, is established from Article 34(2).

What the framework establishes, provision by provision.

• A production order and a preservation order, both addressed to a designated establishment or legal representative in another Member State — Reg. Art. 3(1)–(2).
• The obligation on providers to have such an addressee at all — Dir. (EU) 2023/1544, Art. 3(1)(a)–(c).
• A prosecutor may issue a production order for subscriber or identification data — Reg. Art. 4(1) — but not for traffic data other than identification data, or content — Art. 4(2).
• A prosecutor may issue a preservation order for data of any category — Reg. Art. 4(3).
• The enforcing authority notified, with suspensive effect, for traffic and content data — Reg. Art. 8(1), (4), subject to the Art. 8(2) carve-out.
• The person informed without undue delay, with recorded exceptions, and told their remedies — Reg. Art. 13(1)–(3).
• Remedies before a court in the issuing State, covering necessity and proportionality — Reg. Art. 18(1)–(2).
• A reasoned objection where compliance would conflict with a third country’s law — Reg. Art. 17(1)–(2).

AnalysisThe framework’s safeguards do not sit in one place, which is worth noticing because the addressee is a company. Some are on the issuing side — the authorisation ladder and the duty to inform the person. Some are on the enforcing side — notification with suspensive effect for the more sensitive categories. And one is on the addressee itself, in the reasoned-objection route for conflicting obligations.

• Whether any Member State has transposed Directive (EU) 2023/1544, and whether any provider has designated an establishment or appointed a legal representative, was NOT RESEARCHED for any Member State or any provider.
• The Regulation’s Article 19 obligation to use a decentralised IT system applies one year after implementing acts adopted under Article 25. Whether those acts have been adopted was not researched, so that date is not established and is not stated here.
• Articles 5, 6, 7, 9, 10, 11, 12, 14, 15, 16 and 19 to 33 of the Regulation were not read in full, and no Member State’s implementing arrangements were read.

Related: asking a state and ordering a provider, when a cooperation instrument starts to operate, and data categories across instruments. The other instrument that addresses a provider in another country directly, and reaches a narrower category than these orders do, is direct cooperation with foreign providers.