The EU E-evidence Regulation: what it requires, and where it stands now

Until now, a foreign authority that wanted data from you usually went through mutual legal assistance: government to government, slow, often months.

EU E-evidence replaces that route inside the EU. From August 18, 2026, an authority in any member state can send a binding order directly to your company. The order arrives through a government system, and the deadline to act on it is measured in days or hours.

Two things about this are new for your team:

• Orders arrive from 26 member states, directly. No treaty process in between.
• The deadlines are short and enforceable. Miss one and you have failed to execute a binding order.

You are likely in scope if both of these are true:

• You offer services to users in the EU.
• You hold electronic data about those users: account data, traffic data, transactional data, or content.

That covers communication services, cloud and SaaS platforms, online marketplaces, crypto exchanges, fintechs, telecoms, and most consumer platforms.

Where you are headquartered does not matter. A US company with EU users is in scope. A provider with no establishment in the EU must appoint a legal representative there to receive orders on its behalf.

The regulation creates two binding instruments:

The penalty for non-compliance is set by each member state, up to 2% of your total annual worldwide turnover.

An order you never see still counts against you. That detail matters more than any other on this page, and the next section explains why.

The regulation uses a home-base model:

1. You register in one EU member state. That state is your home base.
2. Every EU order for your company, from any member state, arrives through your home-base state’s system.
3. Your team logs into that government portal to receive and answer orders.

One registration, one portal. You will not operate 27 systems.

That is the design. The ground looks different: the Commission’s readiness list of August 27 shows four member states ready in any capacity, and where a state’s system is not operational, Article 19(5) of the Regulation moves transmission to the most appropriate alternative means. Where the portal does exist, it sits outside the tools your team uses today. Someone has to watch it, because a binding order can arrive at any hour, and the clock starts when the order arrives, not when you notice it. An unwatched channel plus an eight-hour emergency deadline is how a company fails this regulation without ever deciding to.

Five things, in order:

1. Confirm you are in scope. Services to EU users, plus electronic data held. The guide below includes a scoping walkthrough.
2. Choose your home-base member state and, if you have no EU establishment, appoint a legal representative there.
3. Notify the authorities. Register your designated contact and accepted languages with your home-base state. The deadline was August 18; if you have not registered, that is now overdue.
4. Decide how you will receive orders. The government portal, a system you build, or an existing network. This is the build-vs-buy decision, and the window to build is now short.
5. Set up the response process. Who reviews an order, who pulls the data, who answers, and who is on call for the eight-hour emergency window. Legal, compliance, trust & safety, and product all own a piece; name the owner for each.

Kodex is the network where law enforcement data requests get handled. More than 40,000 law enforcement agents across Europe work through it today.

Kodex is the network for law enforcement data requests, and for EU E-evidence it operates a receiving endpoint registered to your designated establishment. Orders are addressed to you, certificates are issued in your name, and every decision on every order stays with you. Where a member state’s system is not operational, Article 19(5) of the Regulation moves transmission to the most appropriate alternative means, and the Commission’s contingency guidance lists secure platforms run for law enforcement data requests among them. In practice, that means: