Centre for International Security
and Economic Strategy
Sanctions Tracker

The EU E-Evidence Regulation: Security and Operational Implications

By

Executive Summary:

A report published by Europol/Eurojust under the SIRIUS framework shows how cross-border requests to online service providers are increasing and that obtaining electronic evidence is becoming the norm in all investigations, thereby putting a great deal of pressure on creating common mechanisms for fast and standardized cross-border access to such evidence. 

The E-Evidence Regulation (Regulation (EU) 2023/1543) responds to this operational need by enabling competent authorities to have service providers offering services in the EU issue binding European Production and Preservation Orders rather than having to rely solely on slow procedures using mutual legal assistance channels. 

As previously noted, however, published legal and policy research indicates that the design of direct cooperation also shifts to the private sector the task of making sensitive assessments, diminishes the normal role of the executing State and increases the risk of jurisdictional conflicts and variable protections. Risks that can manifest as operational delays, refusals or litigation that may reduce the benefits of increased speeds. 

Key Points: 

  • There is a real operational need: reports by SIRIUS on increasing volumes and complexities of cross-border access to electronic evidence and the key role of service providers in daily criminal investigations are documented.
  • The main operational transformation brought by the Regulation is the creation of an EU-wide system for Production and Preservation Orders, which may be served directly on service providers through their established presence within the EU or their appointed legal representatives with the aim of accelerating cross-border access to evidence. 
  • Risk to security/operational process-1: studies have identified that in many cases where the executing authority has been circumvented, there will be conflict of laws and/or oversight issues which will develop into potential challenges to the legality and admissibility of the requested evidence and therefore create delay. 
  • Risk to security/operational process-2:  research into the e-evidence model emphasizes that in many cases service providers will act as de facto gatekeepers (legal evaluation, tight timeframes, competing obligations) and thus will likely adopt cautious compliance or even refusal in cases where uncertainty exists. 
  • Published reviews of the Regulation’s rights safeguards also conclude that the lack of clarity around the remedies available will increase the likelihood of litigation and cooperation issues; i.e., rights issues become operational issues when they impede or destabilize the cross-border execution of requests for electronic evidence. 

Analysis: 

In light of existing electronic evidence situation reports (Europol/Eurojust/EJN), the enforcement environment described provides a basis upon which investigators frequently rely on cross-border provider cooperation; however, they encounter significant operational hurdles (training gaps, operational complexity, differing processes, and fragmentation) when attempting to obtain data from those providers both quickly and lawfully. 

The European Parliament’s Research Briefs explain that the E-Evidence Framework proposes two types of measures to facilitate the collection of digital evidence, regardless of where that data resides, as long as the provider offers its services within the EU and has some form of establishment/representation within the Member States where the data is located. 

Research publications concerning the post-adoption package for the Regulation emphasize that the primary operational advantage of the Regulation is in terms of time (particularly for volatile digital evidence); however, time is dependent on clear and predictable execution pathways for the providers who have been tasked with collecting the data in order to provide legal certainty for those providers. Therefore, the “fast track” is at risk of becoming congested due to provider defense strategies, disputes or non-compliance. 

An additional theme found throughout the literature is that the Regulation redistributes many of the responsibilities of screening for rights/compliance away from public authority bodies and towards private service providers, as such, it is an operational disadvantage as service providers may take a conservative view regarding their obligations to avoid liability, thus creating operational delay/refusal and creating inconsistency in cross border results. 

As highlighted by published critical issues analyses of the Regulation, the presence of safeguards and review mechanisms are not merely design choices based on regulatory norms; rather, if individuals or providers can initiate a review process on specific grounds and there is ambiguity in the standards that apply, it will create a mechanism for dispute resolution that requires cross-border communication, thereby turning legal uncertainty into operational hindrance. 

From an enforcement operational perspective, reporting from SIRIUS and communications from Eurojust/Europol indicate that in order to provide for the cross-border exchange of e-evidence, operational support tools (in standardized formats), and trained contacts, they will need to be developed in order to enable the use of the Regulation for the purpose of speeding up investigations.

Policy Implications: 

  • Reduce the risk of fragmentation: It is likely that both the use of legal text and the application of consistent workflow and common practice are equally important in creating a culture of compliance with the Regulation as reflected in SIRIUS’s published operational reporting. To avoid differing procedural approaches from being the new bottleneck to effective access to cross-border e-evidence across Member States, they should agree on political implementing guidance, contract points and training. 
  • Reduce the risk of provider compliance: Research into the role of “the provider gatekeeper” in academic literature suggests that providers will engage in less defensive non-compliance if there is clear compliance guidance and predictable review grounds. Operationally, such clarity in compliance guidance and predictable review grounds will enable quicker response times and fewer disputes. 
  • Treat safeguards as operational enablers: Both academic research and EPRS analysis suggest that the design of safeguards and remedies directly impacts both the usability of evidence and the level of cooperation in cross-border cases; therefore, designing those safeguards and remedies to be clear and functional will also reduce litigation costs and improve cross-border predictability. 
  • Incorporate the implementation within existing operational ecosystems: As SIRIUS has been established as an EU knowledge base for cross-border e-evidence, utilizing the templates/tools/training developed by SIRIUS represents a practical method to operationalize the Regulation prior to 2026. 

Reference List:

CISES

The Centre for International Security & Economic Strategy provides rigorous, independent analysis on geopolitical risk, economics defence, and security.

Registered in England and Wales (Company No. 17041572) at 205 Regent Street, Westminster, London W1B 4HB.

© 2026 Centre for International Security & Economic Strategy (CISES). All rights reserved.