“This takes effect… as far as I know… immediately. Without delay.”
Günter Schabowski’s legendary line from the 1989 press conference announcing the opening of the Berlin Wall gets wheeled out whenever something takes effect to general surprise: as of today, 18 August 2026, the e-Evidence Regulation (EU) 2023/1543 applies in full. The what, now? Come again? “E-Evidence” refers to the obligation, now in force, for all providers of digital communication services within the European Union to supply, on request from any EU member state investigating a cross-border case: customer information, usage data and traffic data.
In truth, it isn’t nearly as surprising as the sudden freedom to travel was for East German citizens back then. After all, following a three-year transition period, nobody should feel caught off guard by the e-Evidence obligations. Yet awareness still leaves a great deal to be desired, even among those affected, and plenty of companies are rubbing their eyes in disbelief once they finally grasp what’s actually coming their way – rather like ten years ago with the General Data Protection Regulation, which many companies only really took on board a full two years after it entered into force.
The new obligation to hand over subscriber data and traffic data doesn’t only affect the usual suspects – the big platforms and telecoms providers. From now on, service providers of every size must accept and respond to cross-border orders, regardless of turnover, customer numbers, or whether they’ve ever previously dealt with a request from the authorities for an IP address or similar user data. European Production Orders, known as EPOCs, oblige every operator to hand over existing electronic evidence, while the EPOC-PR variant – a Preservation Order – requires the data to be provisionally retained before a production order is issued. The deadlines: ten days as a rule, but just eight hours in emergencies – including nights and weekends.
Electronic evidence has become considerably more important for criminal prosecutions. At the same time, national investigative powers quickly hit their limits once the relevant data sits with a service provider in another member state. The Regulation creates a uniform framework across Europe and is meant to simplify and speed up cross-border access to electronic evidence. It’s complemented by Directive (EU) 2023/1544, which obliges member states to put in place the legal framework needed so that designated representatives can receive and act on these orders.
The deadline for service providers to designate such an establishment or legal representative to the authorities expired today. Anyone not yet registered is therefore already in default and even risks fines. Yet implementation across the EU member states is far from complete – many are still completely unprepared, some are still stuck in the national legislative process, and others are nowhere near ready organisationally. Only Germany and Belgium, though not yet flawless, are reasonably ready for e-Evidence exchange by the deadline.
EviGate is stepping in as a service provider for those newly subject to the obligation, handling both registration and communication with the decentralised e-Evidence platform built on e-CODEX – including legal review of orders to check whether disclosure is even permissible under the national law of the operator’s home country. For German providers, this process chain via EviGate is already up and running – in many other parts of the EU it’s barely functioning yet, and in some you can’t even register at all…
The legal obligations apply regardless. Service providers therefore already have to meet the requirements, even while parts of the organisational and technical infrastructure are still being built. Registering via EviGate and integrating the disclosure processes open up… as far as we know… immediately. Without delay.