E-Evidence in Practice: Balancing Tight Deadlines and Legal Review

Since 18 August 2026, digital service providers have had to adapt to new procedures for cross-border investigative requests. The European E-Evidence Regulation enables authorities to request electronic evidence directly from service providers in other EU Member States or to require them to preserve such evidence. With EPOC and EPOC-PR, companies now face specific procedures, deadlines and verification obligations.

In this interview, Mathias Handsche, Managing Director of EviGate, a new eco member, explains how the rules affect day-to-day operations, why smaller providers and those with little previous experience of requests from authorities face particular challenges, and where difficulties remain in implementation across Europe just over a month after the rules became applicable.

The European E-Evidence Regulation has applied since 18 August 2026. What specific changes does it bring for digital service providers in their day-to-day work?

To put it very simply, there is suddenly a new channel that service providers here must monitor for cross-border investigative requests to which they are legally required to respond. And they must comply with strict deadlines - if requests are not answered within the prescribed timeframes, fines may be imposed. The impact varies - large providers may receive dozens of requests a day, while smaller ones might receive one or two a year, or perhaps none at all. EviGate is particularly helpful for the latter, as we offer a kind of subscription that enables immediate action at any time, without any additional ongoing costs beyond the very low basic fee.

With EPOC (European Production Order Certificate) and EPOC-PR (European Preservation Order Certificate), there are two different instruments - one for the production of data, the other for its preservation. In practice, what are the key differences for service providers in terms of verification, processing and internal coordination?

EPOCs are broadly similar to the requests for subscriber and traffic data that providers in Germany have already been receiving from investigating authorities - except that orders to produce digital evidence now concern cross-border cases involving criminal offences committed abroad, and they come from a wide range of European institutions. EPOC-PR, on the other hand, is similar to a quick-freeze order: upon receipt of the order, the data is preserved and protected from routine deletion until a corresponding request for disclosure, usually issued by a judge, is received - or, if no such request is made, the data may be released for deletion after a specified period. One of the greatest difficulties, however, lies in verifying the legality of an order: is a request for information made, for example, under Spanish criminal law also permissible under German law? This is the key question that we at EviGate address with a pool of lawyers who can step in at short notice to assess legal compliance.

In the case of a European production order, very short deadlines can suddenly create pressure on legal review, technical data provision and internal coordination. What are the greatest practical challenges when a company has to respond to such a request? And how can EviGate support the companies concerned?

Under EPOC, there is indeed a special case involving an extremely short eight-hour deadline - the normal deadline is ten days - when investigations concern threats to life and limb or to critical infrastructure. The main problem here is that the legal review of admissibility is initially ineffective - you have to provide the requested data and can only request its deletion afterwards. And hope that those affected do not sue you for sending their data abroad without a legal basis…

E-Evidence brings together law, technical standards and operational processes across national borders. What must authorities, service providers and the Internet industry now learn together in a cross-border context?

The greatest hurdle is faced by companies that have never before had to deal with telecommunications interception measures. Because the definition of digital services within the scope of the E-Evidence Regulation is so much broader than the restriction previously customary at national level to telecommunications and Internet providers, the whole issue is new and unfamiliar to the vast majority of companies potentially obliged to disclose data. We provide assistance in all areas where there may be uncertainty: who needs to register where, which services, data types and formats are involved, and how communication takes place. EviGate supports the entire sequence of communication steps, including the necessary legal review of the orders.

The E-Evidence Regulation has now applied for just over a month. What is your initial assessment: what is already working well in practice, and where are there still difficulties?

It is somewhat embarrassing how little progress has been made with preparations in many European countries, even though the Regulation has been in force for three years - 18 August 2026 was, after all, merely the end of the transitional periods for introducing the technical and organisational procedures. On our website, we maintain a map of Europe showing the status of legislative implementation and technical readiness in the individual Member States - in theory, EPOC or EPOC-PR requests can so far only originate from the few countries coloured green. We hope that Europe-wide harmonisation will not take much longer. The current patchwork situation serves neither legal certainty for providers obliged to disclose information nor criminal investigations themselves: how can investigations succeed as long as the necessary conditions for obtaining digital evidence are not in place?