# What Is a European Production Order? e-Evidence | Kodex

Source: https://www.kodexglobal.com/glossary/european-production-order

> European Production Orders let EU authorities request evidence from providers directly, with 10-day and 8-hour deadlines. Learn what compliance requires.

Compliance & Regulation

## European Production Order (EU e-Evidence)

A European Production Order lets a judicial authority in one EU member state require a service provider in another to hand over electronic evidence directly, without routing through the second state’s government. Introduced by the EU e-Evidence Regulation, it carries short deadlines: generally ten days, or eight hours in an emergency.

Also known as
EPOC, e-Evidence Regulation, European Preservation Order

The e-Evidence Regulation is the EU’s answer to the same problem the CLOUD Act addressed: criminal evidence sits with providers in another jurisdiction, and the government-to-government route is too slow to be useful.

### What the Regulation created

Two instruments:

- European Production Order (EPOC): compels a provider to hand over specified electronic evidence.

- European Preservation Order (EPOC-PR): compels a provider to preserve data pending a subsequent production order.

Both are issued by a judicial authority in one member state and served directly on a provider’s designated establishment or legal representative in another. The receiving state’s government is not an intermediary in the way it is under an MLAT.

### The deadlines are the story

European Production OrderMLAT request

Served on the provider by The issuing authority directly Domestic authority after review

Standard deadline 10 days No fixed deadline in practice

Emergency deadline 8 hours Not applicable

Typical real-world elapsed time Days Many months

An eight-hour emergency window is the operational headline. It is shorter than many providers’ escalation paths, and it does not pause for weekends. Meeting it is a staffing and tooling question before it is a legal one.

### Categories of data and thresholds

The Regulation distinguishes between categories, with subscriber data and data requested solely to identify a user available on a broader basis, and traffic and content data subject to tighter conditions, generally limited to more serious offences. As with the Stored Communications Act’s tiers, matching the request to the category is the substantive review step.

### What it means for a company

- Designate an establishment or legal representative. Without one there is no valid service address, and this is a precondition rather than a formality.

- Build for eight hours, not ten days. The emergency path needs a named owner, out-of-hours coverage, and a decision route that does not depend on one person being reachable.

- Verify the issuing authority. A short deadline is exactly the pressure a fraudulent request exploits, and the same verification logic that applies to emergency disclosure requests applies here.

- Know the refusal grounds and the procedure for raising them. They exist, but they must be invoked properly and within the timeline.

FAQ

### Frequently asked questions

What are the response deadlines?

The standard deadline is ten days from receipt. In cases of emergency, involving imminent threat to life, physical integrity, or critical infrastructure, the deadline drops to eight hours. Those windows are far shorter than most providers’ existing legal process workflows were built for.

Does a provider need an establishment in the EU?

Providers offering services in the EU are required to designate an establishment or a legal representative in a member state to receive and respond to orders. That designated point is where orders are served, which makes designating one a prerequisite rather than an optional step.

Can a provider refuse a European Production Order?

There are defined grounds for refusal, including where the order is manifestly abusive, where compliance would conflict with fundamental rights under the EU Charter, or where it conflicts with the law of a third country. Grounds must be raised through the Regulation’s procedure rather than by simply not responding.

Glossary

### Related terms

#### MLAT Request

An MLAT request is a formal request for evidence made by one country to another under a mutual legal assistance treaty. Rather than a foreign agency contacting a company directly, the request travels government to government and is executed using the receiving country’s own legal process.

#### CLOUD Act

The CLOUD Act establishes that US providers must produce data they control regardless of where it is stored, and creates a framework for bilateral agreements letting qualifying foreign governments serve orders on US providers directly. It also gives providers a route to challenge orders that conflict with foreign law.

#### Emergency Disclosure Request (EDR)

An emergency disclosure request asks a company to voluntarily hand over user data without legal process, on the basis that someone faces an immediate risk of death or serious injury. It is not compulsory and no judge reviews it, which makes it both genuinely useful and the most abused request type companies receive.

Kodex has a dedicated guide to preparing for EU e-Evidence.
Learn more