Publications — European criminal law — 17 August 2026

E-Evidence Regulation and Criminal Judicial Cooperation: First Observations for the Defence

Since 18 August 2026, a French investigating judge may order a provider established in Dublin, Amsterdam or Luxembourg to produce the messages and connection data of a person under investigation, without any judicial authority in the State where that data is held having any say in the matter. For the defence, this is not a mere technical development. It is the disappearance of a ground of challenge that seemed settled, and the opening of another, which the defence has yet to learn how to occupy.

By Naguin Zekkouti, Attorney at the Paris and Lyon Bars

Introduction

18 August 2026 remained, for many firms, just another date on the European Union's legislative calendar. It deserves closer attention, because it marks a change in kind, not merely in degree, in the way criminal evidence circulates between Member States.

Until that date, the cross-border transmission of evidentiary data followed an interstate logic. One judicial authority addressed another, which executed the measure under its own law, subject to review by its own courts. This model, that of the European Investigation Order, generated substantial litigation, of which the Sky ECC and EncroChat cases were the laboratory. It also produced, in October 2024, a decision of the European Court of Human Rights recognising the existence of an effective remedy in France for persons prosecuted abroad on the basis of data intercepted on French territory.

Regulation (EU) 2023/1543, known as e-Evidence, breaks with that logic. The judicial authority now addresses the service provider directly, whatever Member State it is established in. The involvement of a foreign judicial authority, which until now anchored review and, often, supplied the basis for a remedy, disappears from the equation in most configurations.

This instrument is not devoid of safeguards, and it would be inaccurate to present it as a scheme built against the rights of the defence. It organises several, with genuine care. But these safeguards, as will be seen, all bear on the lawfulness of the issuing act. None bears on the conditions under which the data itself was constituted, structured and retained by the operator holding it. It is this shift, from the act to the data, that now governs defence strategy in any case with a cross-border digital dimension.

The purpose of this study is to draw out its practical consequences. We shall first present the architecture of the scheme and the safeguards it organises (I), before examining what disappears compared with the previous regime, and what Article 18 of the Regulation does or does not restore in that respect (II), in order finally to set out the reflexes this new landscape imposes on the conduct of the defence (III).

I. Architecture of the scheme and formal safeguards

A. Architecture of the scheme

Regulation (EU) 2023/1543 of 12 July 2023, known as e-Evidence, has been applicable since 18 August 2026¹. It creates two instruments, whose logic must be carefully distinguished.

The European Production Order, transmitted by a certificate known as an EPOC, requires the production of data already stored.

The European Preservation Order, notified by an EPOC-PR certificate, serves a different purpose: it is designed to prevent the removal, deletion or alteration of data, pending a subsequent request for production, and that request may take three distinct routes — classical mutual legal assistance, a European Investigation Order, or a European Production Order under the same Regulation². The preservation obligation lasts sixty days, extendable by thirty. It must itself be necessary and proportionate, having regard to the rights of the suspect or accused person³.

This point deserves emphasis, as it is often overlooked in cursory presentations of the text: freezing data under the Regulation does not necessarily foreshadow a production order under the same Regulation. Subsequent production may equally proceed by the older route of the European Investigation Order, or even by traditional mutual legal assistance. The applicable regime for challenging production therefore depends on the instrument actually chosen, which requires the defence to follow closely, in the cases concerned, the relationship between the preservation measure and the production measure that follows it.

The essential point, for the production order, can be stated in one sentence: it is addressed not to a foreign judicial authority, but directly to the designated establishment or legal representative of the service provider⁴. The addressee of the judicial order is a private operator.

The time limits give the measure of the scheme. The addressee has ten days to respond. This is reduced to eight hours in urgent cases, but that notion is strictly defined by the Regulation: it presupposes an imminent threat to the life, physical integrity or safety of a person, or to critical infrastructure⁵. It is neither the mere convenience of the investigation nor a wish to move quickly. The defence will therefore check, whenever urgency is invoked, whether the circumstances alleged genuinely meet this definition, failing which the procedure followed is irregular. Classical mutual legal assistance was measured in months, the European Investigation Order in weeks. The Regulation organises a scale that materially excludes any adversarial debate at the enforcement stage.

B. Formal safeguards and their limits

The Regulation is not devoid of safeguards, and it would be inaccurate to present it as indifferent to rights. Several of them deserve attention, because they will constitute the first ground of litigation.

The first concerns the status of the issuing authority, and here the text organises a two-tier regime rather than a straightforward exclusion of the public prosecutor. For subscriber data and data requested for the sole purpose of identifying the user, a judge, a court, an investigating judge or a public prosecutor may issue the order directly⁶. For traffic data and content data, those which underpin convictions, direct issuance is reserved to a judge, a court or an investigating judge. The public prosecutor is excluded at this stage, which directly reflects the Prokuratuur judgment of 2 March 2021⁷. The Regulation nonetheless allows another competent authority, acting as the authority in charge of the investigation, to issue the order, provided it is subsequently validated by a judge, a court, an investigating judge or a public prosecutor⁸. The defence will therefore verify, less the identity in principle of the signatory than compliance with this architecture: direct issuance by a judicial authority for sensitive data, or issuance followed by validation, the quality of whose author must be scrupulously checked.

The second concerns the offence threshold. For traffic and content data, an offence punishable in the issuing State by a custodial sentence of a maximum of at least three years is required, save for a list of specific offences set out in an annex, notably fraud, child sexual exploitation, attacks on information systems and terrorism⁹. An order relating to content data in a case not meeting this threshold, and not falling within that list, is irregular.

The third concerns the statement of reasons. The order must be necessary and proportionate, and may be issued only if a similar measure could have been ordered under the same conditions in a comparable domestic case. The reasons establishing compliance with these conditions must appear in the act itself¹⁰. A vague or formulaic statement of reasons is, on that ground alone, open to challenge.

The fourth concerns legal professional privilege, and it concerns lawyers directly. The Regulation organises a specific regime for data protected by professional privilege where it is hosted by a provider on infrastructure intended for professionals bound by such privilege, which covers in particular messaging services and case-management software specific to the profession. In that situation, an order relating to traffic or content data may be issued only if the professional resides in the issuing State, or if approaching that professional could prejudice the investigation, or if privilege has been waived in accordance with the applicable law¹¹. The protection therefore exists, but it is conditional rather than absolute. The second ground, based on the risk to the investigation, sets a relatively low threshold, capable of being invoked in most serious investigations. Lawyers who advise service providers, or who are simply concerned to protect their own communications with their clients, would do well to know precisely the real extent of this safeguard, which is narrower than it first appears.

A fifth point, finally: the Regulation provides grounds for refusal not only for the benefit of the provider or the enforcing State. Among those grounds is, "in exceptional situations", the existence of serious grounds to believe, on the basis of specific and objective evidence, that execution of the order would entail a manifest breach of a fundamental right enshrined in the Charter¹². The threshold is high, the phrase "exceptional situations" leaving little doubt as to the legislature's intention to confine its use strictly. But the ground exists, and it may be invoked before the enforcing authority, which should be stated with precision rather than merely implied.

These five safeguards will generate real litigation, particularly in the first months of application. On 27 March 2026 the Commission sent letters of formal notice to twenty-two Member States for failure to transpose Directive (EU) 2023/1544, which requires providers to designate the addressee empowered to receive orders¹³. The Regulation therefore entered into application while the infrastructure meant to ensure its receipt remains, in most Member States, legally incomplete. The regularity of the designation of the addressee will be contested, and all the more easily since the irregularity here requires no complicated proof: it suffices to check whether the provider concerned appears on the lists the Commission must publish.

These safeguards nonetheless share a common limitation. They all bear on the order, never on what the order extracts. It is this limitation that governs what follows.

II. The shift in judicial review

A. The remedy under the European Investigation Order

Under the European Investigation Order, the defence had a tangible object to challenge. Article 694-41 of the French Code of Criminal Procedure opens a remedy against any measure taken on French territory in execution of an investigation order, on the same conditions and following the same procedures as if it had been executed in domestic proceedings¹⁴. An act existed, it was contestable, and its annulment had to be brought to the attention of the issuing State, which was required to draw the consequences¹⁵.

It was on this whole that the European Court of Human Rights relied, in its decision A.L. v. France and E.J. v. France of 17 October 2024, in holding that EncroChat users prosecuted in the United Kingdom had an effective remedy available in France¹⁶. It expressly noted that, since the Court of Justice precludes the issuing State from reviewing the separate collection procedure¹⁷, the remedies available in the executing State assumed decisive importance.

B. Article 18 and the question of the forum

Under the Regulation, this whole disappears, and two features of the text reinforce that conclusion further.

On the one hand, there is no longer any measure taken on the territory of the State where the data is held, since the order is executed by a private operator. No mechanism informs the issuing State of a challenge that has succeeded elsewhere, and nothing requires it to take that into account.

On the other hand, the mechanism for notifying the enforcing State, which gave that State a power of objection for traffic and content data, does not even apply in a significant number of cases. The Regulation dispenses the issuing authority from it where it has reasonable grounds to believe that the offence was committed in the issuing State and that the person concerned resides there¹⁸. Yet that criterion is satisfied by the mere domestic appearance of the case, even where the data remains held abroad. Many proceedings that are nonetheless transnational in substance will thus escape any mechanism of objection, however imperfect.

There remains Article 18 of the Regulation, which enshrines a right to effective remedies and which will inevitably be raised against this conclusion¹⁹. It must be read to the end. Paragraph 2 provides that this right is exercised before a court of the issuing State in accordance with the law of that State. The forum is designated, and it is a single one: precisely the one which, under the M.N. case law, is barred from reviewing the conditions of collection.

The remedy therefore exists, but its scope is truncated. The person prosecuted may challenge the legality, necessity and proportionality of the order. They cannot challenge, before that same court, the conditions under which the provider constituted, structured and retained the data extracted by the order.

A further difficulty, which practice will encounter early, compounds this: notice to the person concerned is itself deferred. The Regulation provides that the issuing authority shall inform, without undue delay, the person whose data has been requested, but it may delay, restrict or omit that information for as long as the conditions laid down by the directive on data protection in criminal matters are met, stating the reasons for that deferral in the case file²⁰. In practical terms, a client may be prosecuted on the basis of data obtained by EPOC without the defence having been informed at the time the file was constituted. Systematically checking for the existence of such an order, in any proceedings with a transnational dimension, even one that appears purely domestic, becomes a first-access reflex, on a par with checking the conditions of police custody.

For the defence, the practical consequence is clear: litigation shifts from the lawfulness of the act to the authenticity and integrity of what it produces.

III. Practical implications for the criminal defence

1. Demand traceability of the extraction

French law requires, under Article 230-3 of the Code of Criminal Procedure, a certificate of accuracy signed by the head of the technical body concerned. Nothing equivalent applies to the provider addressed by an EPOC. It is neither a body designated by the judicial authority, nor a neutral third party, but a private undertaking subject to a compliance obligation backed by penalties that may reach 2% of its total worldwide annual turnover²¹. It is therefore necessary to ask systematically by what process the data was extracted, by whom, with what guarantee of integrity, and through what chain of custody between the provider's system and the case file. The absence of an answer is not a difficulty for the defence. It is its argument.

2. Base exclusion on the impossibility of debate, not on irregularity

This is the point of convergence between the two European legal orders, sufficiently rare in evidentiary matters to be worth noting. The Court of Justice held, in M.N., that the national court must disregard evidence on which a party is not in a position to comment effectively. The European Court of Human Rights does not rule on the admissibility of evidence, which is a matter for domestic law, but examines whether the proceedings as a whole were fair, treating as decisive the opportunity given to the applicant to challenge the authenticity of the evidence and to oppose its use²². The two criteria converge: a party who knows neither the extraction process, nor the conditions of retention, nor the reasoning behind the order, may deny the evidence but cannot usefully challenge it. The argument draws its strength from resting simultaneously on EU law and on Convention law.

3. Anticipate a conflict with the law of a third State

This issue will be of particular interest in cases with a non-European dimension, common in transnational organised crime matters. The Regulation organises a review procedure where the provider considers that compliance with the order would conflict with an obligation under the applicable law of a third country. The addressee has ten days to raise a reasoned objection; the issuing authority reviews the order; if it intends to maintain it, it refers the matter to the competent court of its own State, enforcement being suspended in the meantime²³. The court then assesses, among other things, the degree of connection between the case and each of the two legal orders concerned, as well as the interest protected by the foreign provision relied upon. The defence has an interest in knowing this mechanism and in seeking its application whenever a US provider, or one from another third country, is involved, since this is one of the rare instances in which the Regulation allows a court to rule on a question going beyond the mere formal legality of the order.

4. Do not overestimate the argument based on the mass character of the collection

The experience of the Sky ECC litigation counsels caution on this precise point. By judgment of 7 January 2025, the Criminal Chamber upheld the trial judges' finding that an applicant lacked standing to seek annulment of the entire body of interceptions concerning third-party users, in separate proceedings not directly concerning either his own interests or the protection of his private life²⁴. The obstacle is one of admissibility, not of substance: it is not held that mass collection would be lawful, but that whoever suffers its effects lacks standing to contest it as a whole. This obstacle will re-form under the Regulation, at even lower cost, since the person concerned will be entitled to challenge the order that targets them, not the conditions under which the body of data from which it was extracted was constituted. It is better to concentrate effort on what directly concerns the client, and on what the prosecuting authority cannot produce about them.

5. Use the Regulation itself, in the client's interest

A final point is too rarely raised: the Regulation is not merely an instrument the defence must endure. Article 1(2) expressly provides that the issuing of a European Production Order or Preservation Order may also be requested by a suspect, by an accused person, or by a lawyer acting on their behalf²⁵.

The practical scope of this provision deserves precise assessment. The Regulation does not confer on the defence an autonomous power of issuance: the order remains issued or validated by a judicial authority, subject to the substantive and formal conditions described above. What Article 1(2) opens up is the ability to request such issuance, leaving it to the competent authority to assess the request. The interest nonetheless remains real, particularly for preservation. Where data potentially favourable to the defence — a message, a geolocation record, evidence of a connection — risks being deleted by the provider before the investigation turns its attention to it, the defence now has an explicit textual basis for asking the competent authority to preserve that data immediately, pending subsequent production. This is a reflex to build into the investigative phase, whenever a case has a cross-border digital dimension and the pace of judicial proceedings threatens to work against the client's interest.

Conclusion

One question remains, whose answer will determine the value of all these arguments.

On 16 September 2025, the Criminal Chamber stayed proceedings and referred to the Court of Justice two preliminary questions concerning the existence, in the State executing a European Investigation Order, of a remedy allowing a person prosecuted elsewhere to challenge the lawfulness and necessity of the evidence obtained. The case is pending under number C-625/25²⁶.

This question is not rendered obsolete by the Regulation's entry into application. The Regulation does not repeal Directive 2014/41, which it complements²⁷, and proceedings based on data transmitted since 2021 will still number in the thousands for several years to come.

The significance of the answer will depend above all on its legal basis, more than on its outcome. The Criminal Chamber raised two questions of different footing. The first invokes Article 47 of the Charter. The second, in the alternative, invokes the principle of equivalence of remedies under Article 14 of the Directive. A solution grounded in Article 47 would state a requirement of primary law, applicable to any instrument organising the cross-border circulation of evidence, the e-Evidence Regulation included. A solution grounded solely in Article 14 would remain an interpretation of secondary law, confined to the instrument that carries it. The Advocate General's Opinion will, in that respect, be more instructive than the question itself.

Criminal defence has long been conducted from the Code of Criminal Procedure alone. That era is over for a growing share of the caseload. A case resting on data produced by a foreign provider pursuant to an EPOC simultaneously mobilises domestic law, EU law, Convention law and the technique of digital evidence. None of these fields suffices on its own, and the most effective argument will often arise from their combination.

This area of law will not remain fixed in its current state. The Regulation requires Member States to collect, from its entry into application, detailed statistics, including the number of remedies brought against European Production Orders, both in the issuing State and in the enforcing State. The Commission must publish an annual compilation from 18 August 2027²⁸. This deadline deserves to be noted: it will provide, for the first time, an empirical measure of the real use of the remedies the text organises, and will make it possible to verify, with figures in hand, whether the foregoing analysis is confirmed in the practice of the courts²⁹.

Notes

This piece was first published, in French, in Le Village de la Justice on 17 August 2026: « Règlement e-Evidence et coopération judiciaire pénale : premières observations pour la défense ». This is its full English version, published on zekkouti-avocat.com. A longer, doctrinal study on the same Regulation is also available: “From the Sky ECC litigation to the e-Evidence Regulation” (English version).