The eight-hour clock starts today: EU e-evidence orders now land on covered U.S. providers’ EU addressees

Editor’s Note: Starting today, where national arrangements are in place, judicial authorities in any of 26 EU member states can compel a covered service provider in another participating member state to produce data on a 10-day clock, or an eight-hour one in emergencies, with the certificate served on the provider’s designated EU addressee. The e-Evidence Regulation’s application date arrived alongside penalties of up to 2 percent of a provider’s total worldwide annual turnover for the preceding financial year, a designation deadline that fell the same day, and a transposition map showing implementing laws adopted in 11 of 27 member states as of late July, Denmark among them though it sits outside the regulation itself.

For cybersecurity, privacy, compliance and eDiscovery professionals, the operational surface is familiar territory: intake and authentication, escalation clocks, legal hold mechanics, records governance, and a live conflict with the U.S. Stored Communications Act that Article 17 now channels into a formal objection procedure.

Watch three fronts this fall: the first enforcement actions under national penalty statutes, the pace of the remaining transpositions, and whether the EU-U.S. e-evidence negotiations produce the agreement that would defuse the content-data standoff.

Industry News – Data Privacy and Protection Beat

The eight-hour clock starts today: EU e-evidence orders now land on covered U.S. providers’ EU addressees

ComplexDiscovery OÜ Staff

Judicial authorities in 26 EU member states can now serve binding data demands directly on covered providers’ addressees in other member states, where national arrangements allow: 10 days to produce, eight hours in an emergency. Service is direct rather than government-to-government, and ignoring a certificate can cost a provider up to 2 percent of total worldwide annual turnover for the preceding financial year.

Regulation (EU) 2023/1543, the e-Evidence Regulation, became fully applicable today after a three-year transition, putting the European Production Order and European Preservation Order into service. Denmark stands apart under Protocol No 22, its criminal-justice opt-out, so the orders run among 26 of the EU’s 27 member states; Ireland, a digital hub for global technology companies, opted in. In an Aug. 11 client alert, Reed Smith attorneys Johannes Berchtold and Andreas Splittgerber wrote that mutual legal assistance and the European Investigation Order “will no longer serve as the primary mechanisms” for provider-held evidence. The older channels remain, and the Commission’s own comparison shows the intended speed advantage: 10 days for a production order, against up to 120 days for a European Investigation Order and an average of 10 months for mutual legal assistance.

Two certificates, two clocks

A European Production Order compels production of specified data within 10 days, and in emergencies without undue delay and at the latest within eight hours; it travels as a European Production Order Certificate, or EPOC. An emergency means an imminent threat to a person’s life, physical integrity, or safety, or to critical infrastructure whose disruption would create such a threat. A European Preservation Order, transmitted as an EPOC-PR, puts the addressee under a duty to preserve the specified data for 60 days, with one 30-day extension available, while investigators pursue a production request.

Sensitivity sets the bar. Subscriber data and data sought solely to identify a user are available for any criminal offense, on an order a prosecutor can issue or validate. Orders for traffic data beyond identification and for content data must be issued or validated by a judge, a court or an investigating judge and, as a rule, involve an offense carrying at least a three-year maximum sentence in the issuing state; payment fraud, child sexual abuse offenses and attacks on information systems qualify below that bar when committed wholly or partly through an information system, terrorism offenses with no such condition. Traffic and content orders are also simultaneously sent to the enforcing authority where the addressee resides, unless the offense and the person’s residence both anchor the case in the issuing state. The notified authority has 10 days, or 96 hours in emergencies, to raise one of four refusal grounds: immunities, privileges and criminal-liability rules tied to press freedom or expression in other media; a manifest breach of fundamental rights; the ne bis in idem principle, or double jeopardy; and lack of dual criminality, subject to the regulation’s listed-offense exception. The notification suspends the production duty in ordinary cases but not emergencies, one reason the eight-hour scenario is the drill to rehearse first.

Who must answer, and where

Scope turns on two questions: does a company offer services in the EU, and what kind. The regulation reaches electronic communications services, domain name and IP infrastructure services, and other information society services that let users communicate or that store or process user data, provided storage is a “defining component” of the service. Depending on service design and EU nexus, that category could include cloud platforms, hosting, marketplaces and legal technology services such as eDiscovery review, legal hold and archiving, where storing or processing user data is an essential part of the service, a reach ComplexDiscovery flagged last week. The recitals put remote legal and accounting advice outside the definition where storage is not a defining component; a platform hosting the same evidence is assessed on its own functions and EU nexus.

The companion Directive (EU) 2023/1544 provides for the delivery address in two ways: a provider established in the EU designates a designated establishment, and a provider without an EU establishment appoints a legal representative in a participating member state. Providers already serving the EU on Feb. 18, 2026, had until today. Designations are filed with the receiving state’s central authority and published through the European Judicial Network; provider details are fed into a Commission-run court database linked to the decentralized IT system that carries the certificates. No member state had built its own back-end as of Aug. 11, with all relying on JUDEX, the Commission’s reference software, according to Bird & Bird, which advises providers on e-evidence compliance.

Ireland expects scale. “It is expected that over 600 service providers could designate their ‘addressee’ in the State, and it’s estimated that the number of production orders issued to those service providers will be in the hundreds of thousands annually,” Jim O’Callaghan, Ireland’s justice minister, said at an e-evidence symposium last October.

Live in some capitals, latent in others

Application day arrived with the plumbing unfinished. The directive’s transposition deadline was Feb. 18, 2026, and the Commission sent letters of formal notice to 22 member states in late March, as ComplexDiscovery reported in April. Bird & Bird’s July 24 tracker, which covers all 27 EU member states, showed implementing legislation adopted in 11, among them Germany, Ireland, Italy, Sweden and, though it sits outside the regulation itself, Denmark; drafts in six; and no publicly available developments in 10. A Potomac Law Group client alert notes a Berlin wrinkle: separate German legislation that would create a similar domestic preservation power is still before parliament, so the first preservation certificate a German provider sees could come from abroad before German prosecutors can issue a domestic equivalent.

The Commission services mapped the consequences in an informal Q&A dated July 24 and contingency-arrangements guidance Aug. 11. The Q&A is guidance rather than law and says so, without prejudice to any formal Commission position, with authoritative interpretation reserved to the Court of Justice. Its reading, as analyzed by Bird & Bird: where the addressee sits in a transposed state and the issuing authority’s state has finished its own transposition, the framework operates as designed, and an unfinished IT rollout changes nothing, because certificates can move by alternative means with the clocks running. A provider left unable to designate because the member state where it would do so has not transposed cannot presently be addressed with certificates; the Commission urges central authorities to hold off, at least initially, on designation-related penalties where intent to designate is documented. It also calls issuing risky for authorities in states that have not notified their competent authorities. Each new transposition redraws that map without notice.

The American collision the regulation saw coming

Penalties give the regime its weight. Member states must ensure pecuniary penalties of up to 2 percent of a provider’s total worldwide annual turnover for the preceding financial year for violations of the production, preservation, and confidentiality duties, and the directive allows the provider and its EU addressee to be held jointly and severally liable. Enforcement runs through the addressee’s member state: absent an accepted excuse or refusal ground, the issuing authority can ask that state’s enforcing authority to step in, and recognition follows without further formalities save narrow objections. Penalty rules are national implementing law, so exposure varies by country until the remaining statutes land. A shield accompanies the stick: providers are protected from liability to users and third parties for harm resulting solely from good-faith compliance with a certificate.

For U.S. providers, a separate problem is the one the regulation itself anticipates. The Stored Communications Act generally bars American providers from disclosing the content of communications to foreign authorities, and no EU-U.S. agreement under the CLOUD Act yet bridges the gap; the Commission’s e-evidence page describes negotiations with the United States as ongoing. The regulation’s answer is Article 17: an addressee that believes compliance would violate third-country law must file a reasoned objection within 10 days, which suspends execution while a court in the issuing state reviews the conflict. The objection cannot rest on the mere fact that the data are stored outside the EU. Legal teams should treat the Article 17 memo as a template to draft now, not after the first content order arrives.

Before the first certificate lands

The operational to-do list is unforgiving because the clocks are. Providers need an around-the-clock intake point wired to the decentralized IT system and its fallbacks, authentication that confirms a certificate is complete and genuine, and an escalation path that puts legal, privacy and security in one room inside hours. Scope mapping comes first, because designation decides which member state supervises and sanctions.

Legal hold teams already own a working analogue. An EPOC-PR behaves like an externally imposed preservation hold on a statutory clock and belongs inside existing hold workflows: who logs it, who scopes affected accounts, who tracks the 60-day expiry and single extension, who screens for collisions with parallel U.S. preservation and production duties. Security teams own a piece too: the emergency definition centers on imminent threats to life, safety and critical infrastructure, and a hospital ransomware incident can qualify when the disruption creates one of those threats. A certificate arriving outside the authenticated channel, by email for instance, deserves the scrutiny of any unauthenticated law enforcement demand.

The paper trail needs design attention of its own. Potomac Law cautions that EPOC handling records, internal assessments, correspondence and execution logs may themselves draw GDPR Article 15 access requests, freedom-of-information requests and civil discovery, subject to exemptions argued file by file. They are a record category that existing retention schedules do not contemplate.

When the first certificate reaches a U.S. legal technology vendor’s Dublin addressee at 4 p.m. on a Friday with an eight-hour fuse, will the decision about hour six have been made in advance, or will it be improvised while the clock runs?

News sources

• Regulation (EU) 2023/1543 on European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings (EUR-Lex)
• Directive (EU) 2023/1544 laying down harmonised rules on the designation of designated establishments and the appointment of legal representatives (EUR-Lex)
• E-evidence, cross-border access to electronic evidence (European Commission)
• Q & A legal contingency, e-evidence package (European Commission)
• Commission Implementing Regulation (EU) 2025/1550 establishing the technical specifications and other requirements for the decentralised IT system (EUR-Lex)
• EU e-Evidence: New service provider obligations from 18 August 2026 (Reed Smith)
• EU e-Evidence Rules Become Operational on August 18, 2026: U.S. Companies with European Operations Should Prepare Now (Potomac Law Group)
• e-Evidence day one is approaching: what applies, where, and what service providers should do now (Bird & Bird)
• e-Evidence Implementation Tracker (Bird & Bird)
• Strengthening Justice in the Digital Age: Ireland’s Leadership under the EU e-Evidence Regulation (gov.ie)
• Europol: expanded powers lead to greater risks to privacy (Eunews)
• Seven days out: the EU’s e-evidence regime goes live Aug. 18 (ComplexDiscovery)
• The EU’s E-Evidence Framework Goes Live in August and Most of Europe Isn’t Ready (ComplexDiscovery)

Assisted by GAI and LLM Technologies

Additional reading

• California’s AI Transparency Act arrives alongside Europe’s Article 50
• Federal magistrate judge treats LinkedIn’s Relativity aiR workflow as TAR
• One benchmark, three directions: 2026 legal rates rise, flatten and fall at once
• Confidence cools, commitment holds: full results from the 1H 2026 eDiscovery Business Confidence Survey
• Complete look: ComplexDiscovery OÜ’s 2025 to 2030 eDiscovery market size mashup
• The workstream of eDiscovery: Considering processes and tasks

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more understandable for practitioners, policymakers, and business leaders.