Background
On 18 August 2026 the EU e-Evidence Regulation (EU) 2023/1543 (the “e-Evidence Regulation”) entered into application and is now binding in its entirety and directly applicable in participating Member States. The e-Evidence Regulation and Directive (EU 2023/1544) (the “e-Evidence Directive”) (together, the “e-Evidence Package”) allow authorities in one EU Member State to issue an order directly to a service provider based in another Member State requesting the production of electronic evidence. For further information on the background of the e-Evidence Package, see our previous analysis.
e-Evidence Regulation
The e-Evidence Regulation establishes a framework under which a judicial authority in one Member State may, in criminal proceedings, order a service provider offering services in the EU and established or legally represented in another participating Member State to produce electronic evidence via a European Production Order Certificate (“EPOC”) and / or to preserve electronic evidence via a European Preservation Order Certificate (“EPOC-PR”) pending a subsequent request for production.
A valid EPOC / EPOC-PR will be addressed to the service provider’s designated establishment or legal representative and applies irrespective of where the data are located. On receipt of a valid order, the addressee must preserve the requested data expeditiously and, subject to the applicable notification procedure, transmit them to the authority identified in the order.
The mechanisms under the e-Evidence Regulation remain subject to necessity, proportionality, due process, privacy, data protection and communications confidentiality safeguards.
e-Evidence Directive
The e-Evidence Directive complements the e-Evidence Regulation and lays down rules for the nomination of designated establishments and the appointment of legal representatives by service providers. These “addressees” will be responsible for responding to EPOCs or EPOC-PRs. Existing service providers that are established in and offer services in the EU must designate at least one establishment as their designated establishment. Service providers that are not established in an EU Member State, but nevertheless offer services within the EU, must appoint a legal representative within a Member State in which the service provider offers its services.
The e-Evidence Directive was signed into Irish law on 15 July 2026 via the Criminal Justice (International Cooperation on Electronic Evidence and Other Matters) Act 2026 (the “e-Evidence Act”). Under article 27(4) of the e-Evidence Act, the deadline for existing service providers to notify an addressee via the EU Commission’s registration portal was 18 August 2026. Service providers who begin offering services in Ireland or the EU after this date are required to notify an addressee within 6 months from the date they begin offering such services.
Establishment of the Office of the Director of Criminal Justice International Cooperation
The e-Evidence Act designates the Office of the Director of Criminal Justice International Cooperation (the “CJICO”) as the “enforcing authority” for the purposes of the e-Evidence Package. The CJICO’s role includes monitoring compliance with the e-Evidence Act and the e-Evidence Regulation, taking enforcement action as necessary, issuing guidance to support service providers in meeting their statutory obligations, and liaising with other central and enforcing authorities across the EU. Where issues arise in relation to requests for electronic evidence or service provider registration, the CJICO will serve as the central point of contact linking law enforcement authorities, service providers, and central authorities in other EU countries.
On 22 July 2026, the Minister for Justice announced the appointment of Helen Martin as Director of the CJICO.
In scope data
Electronic evidence under the e-Evidence Regulation means subscriber, traffic or content data stored by or on behalf of a service provider in electronic form when the EPOC or EPOC-PR is received. There is no custodial sentence threshold for subscriber data to be subject to a valid order request. The same applies to IP addresses, access numbers and related information requested for the sole purpose of identifying the user. For traffic or location data, generally the offence must be punishable in the issuing Member State by a maximum custodial sentence of at least three years. There remains legal uncertainty about how this will work in practice under existing Irish law. Schedule 2 data under the Communications (Retention of Data) Act 2011 restricts access to certain data to investigations of offences which carry a five year custodial sentence. This means that there is a potential compatibility issue where an EPOC seeks Irish retained traffic or location data for an offence that satisfies the e-Evidence Regulation’s three year threshold but does not satisfy the equivalent Irish five year threshold.
Non-compliance
A service provider can seek clarification from the issuing authority on an EPOC or EPOC-PR and may refuse to comply on grounds of a de facto impossibility due to circumstances not attributable to the service provider. The e-Evidence Regulation expressly recognises lawful deletion before receipt as an example of factual impossibility. The service provider may also raise a limited number of legal grounds for non-compliance, namely privilege or immunity issues or a third country law conflict. Where the issuing authority has notified the enforcing authority, the enforcing authority may raise one of the following grounds for refusal: privilege or press protection, a manifest fundamental rights breach, ne bis in idem (prohibition against double prosecution) or dual criminality.
Service providers who fail to comply with a valid EPOC can face penalties of up to 2% of the service provider’s total worldwide annual turnover for the preceding financial year.
Decentralised IT system
The e-Evidence Regulation introduces a secure, decentralised IT system for the transmission of EPOCs / EPOC-PRs between judicial authorities and service providers’ designated legal representatives. Member States are in the process of developing their national access systems to ensure connection with the decentralised IT system; during the transition period communication should take place through the most appropriate secure alternative means.
Principal deadlines
The below table outlines the principal deadlines for service providers under the e-Evidence Regulation:
Principal deadlines under the e-Evidence Regulation
| Event | Principal deadline |
| Ordinary EPOC | Within 10 days of receipt |
| Emergency EPOC | Without undue delay and within eight hours |
| Enforcing authority emergency objection | Within 96 hours of notification |
| Addressee notification of an incomplete
or defective EPOC / EPOC-PR | Without undue delay |
| Issuing authority response to request for
clarification | Within five days |
| Initial EPOC-PR period | 60 days |
| Permitted extension of EPOC-PR | One additional 30-day period |
| Third country law reasoned objection | Within 10 days after receipt of the EPOC |
| Recording an alternative channel
transmission in the IT system | Without undue delay |
| Mandatory use of the decentralised IT
system | One year after adoption of the article 25 implementing acts |
Challenges faced by service providers
While having a single point of contact in Ireland for law enforcement requests from other EU countries may be a positive development for service providers based in Ireland who currently deal with multiple authorities, the new regime will impose very challenging deadlines including a general 10 day deadline for production.
There is a lot of detail for service providers to get familiar with in the e-Evidence Package, including the rules on (i) who can issue EPOCs / EPOC-PRs, (ii) what data can be covered, (ii) where data covered can be stored (in some cases relating to data stored for State authorities, only the EU Member State in the storage location can issue an EPOC / EPOC-PR), and (iii) what limited reasons can be relied on by a provider for not producing or preserving data sought by an order.
Commentators have raised concerns about the balance struck by the e-Evidence Package between (i) law enforcement authorities’ wish for urgent production of evidence, and (ii) the fundamental rights of citizens. The regime is based on mutual trust (ie, the rule of law across all EU Member States ensuring that requests made under the regime are lawful) and accordingly leaves limited scope for companies to refuse requests based on user rights concerns. Unfortunately, the e-Evidence Package currently provides no practical guidance for service providers on how they can query the application of exemptions, including the foreign law regime’s compatibility with fundamental rights law, and therefore service providers will need to learn by doing and monitor how practice, guidelines and legal precedent develops in this area.
Providers may need to seek legal advice on the interpretation of these rules, and may need to do so pre-emptively given the above-noted 10 day deadline and the recent implementation of the Irish regime.
Contact us
As Ireland’s leading advisor on regulatory compliance in the telecoms sector for many years, Matheson is deeply familiar with the relevant challenges arising from this new regime. Please get in touch with your regular Matheson contact or the authors of this piece, Kate McKenna, Simon Shinkwin or Connor Cassidy with any queries.
