Last week, on August 18, 2026, the EU’s e-Evidence Package officially went into effect. It marks a major change in how EU authorities can obtain electronic evidence across borders. By allowing authorities in one Member State to serve binding Production and Preservation Orders directly on a provider’s designated establishment or legal representative in another Member State, the new rules establish a harmonized, direct cross-border legal compulsion framework. For U.S. providers, the important shift is that an EU authority may now be able to compel production through the provider’s EU addressee (described below) without first pursuing evidence through traditional state-to-state channels.
If your company provides cloud, communications, marketplace, or other data-driven online services to EU users, the e-Evidence framework may apply. Here is what you need to know:
Who Is Captured by the Law?
The e-Evidence framework applies to any natural or legal person qualifying as a “service provider” that “offers services in the Union.” This definition includes electronic communications services (like email, VoIP, and messaging), internet domain and IP numbering services, and information society services that facilitate user communication or store/process data as a defining component of their service (such as many cloud-hosting, online marketplace, gaming, and SaaS services). Financial services are excluded from the definition of “service provider.”
Crucially, you do not need a physical office or servers in Europe to be in scope. The Regulation applies regardless of where your data is stored. To bring a non-EU company into scope, the provider must “offers services in the Union” which requires a “substantial connection”. Under Article 3 of the Regulation, a “substantial connection” exists where the provider has an EU establishment or, absent one, where there is a significant number of users in one or more Member States or a targeting of activities by the service provider towards one or more Member States.
Note: The mere accessibility of your website, app, online interface, or contact details in the EU, taken in isolation, is expressly insufficient.
The Core Obligations
If your platform crosses the “substantial connection” threshold, you face immediate, legally binding operational duties:
Appointing an EU Representative
Non-EU established providers offering services in the Union must formally appoint a legal representative in a participating Member State where they offer services. Providers established in the EU instead designate an appropriately constituted establishment. Whether a provider must register a legal representative or a designated establishment, turns on the establishment of the specific contracting legal entity that provides the covered service, not simply the location of the corporate parent. The addressee must have the powers and resources necessary to receive and comply with orders.
Joint and Several Liability
Member States must ensure that both the service provider and its appointed EU representative can be held jointly and severally liable for relevant non-compliance. The representative therefore cannot function merely as a mailbox: it needs genuine authority, resources, and procedures to receive and handle orders. A provider also cannot rely on inadequate internal procedures or communication failures between the provider and representative to excuse non-compliance.
Shorter Response Windows
Under a European Production Order Certificate (EPOC), providers must generally produce the requested data within 10 days of receiving the EPOC. In emergency cases, defined as an imminent threat to the life, physical integrity or safety of a person or to critical infrastructure, the compliance window shrinks to 8 hours.
A European Preservation Order Certificate (EPOC-PR) requires preservation without undue delay, generally for 60 days, subject to a possible additional 30-day extension or a subsequent production request.
Providers should therefore build 24/7 escalation process for emergency orders and cannot simply rely on an ordinary business hours subpoena workflow.
U.S. Providers Still Need a U.S.-Law Check.
Whilst an EPOC may seek data stored outside the EU or data controlled by a U.S. affiliate, a valid EU order does not necessarily mean a U.S. provider can lawfully disclose the data. In particular, production of communications content may implicate the U.S. Stored Communications Act. Providers should build a conflict-of-laws review into their EPOC workflow and be prepared to use the Regulation’s third-country law objection procedure where appropriate. Preservation generally presents a different issue because it does not itself require disclosure of the preserved data.
The Possible Fines
Ignoring an order is not a viable option. Following the Regulation’s enforcement process, non-compliance with a recognized and enforceable order can result in pecuniary penalties. Member States must provide for maximum penalties of at least 2% of the service provider’s total worldwide annual turnover from the preceding financial year.
Enforcement takes place through the competent authority in the Member State where the designated establishment or legal representative is located (for example, the Irish Central Authority). The Commission has acknowledged that Member States are at different stages of legal and technical readiness, so providers may encounter temporary service channels, onboarding delays, or other workarounds. Those practical gaps do not postpone the underlying obligations, so providers should still be ready to receive, preserve, escalate, and respond to orders.
Practical Checklist
In-scope companies should take the following steps now:
- Perform a Scoping Assessment: Audit your EU user base, EU establishments, localized languages/currencies, shipping options, app-store availability, advertising, customer support, and other EU-targeting activity to determine whether you meet the “substantial connection” test.
- Set Up Your Representative Structure: If in scope, identify the relevant service-provider entity, determine whether it requires a designated establishment or legal representative, ensure the addressee has the required authority and resources, and complete the required notification to the relevant Member State central authority.
- Establish an Intake Protocol: Determine how the Member State in which your addressee is located is implementing access to the decentralized e-Evidence IT system and establish an interim intake channel where necessary. The Commission has developed a web-based service-provider interface (WISP), while higher-volume providers may use bespoke API integrations, but availability and onboarding currently vary by Member State.
- Build Response and Privilege Procedures: Map which systems hold subscriber, traffic, and content data and applicable retention periods; establish 24/7 emergency escalation; train reviewers to spot incomplete or defective orders, privilege and press-freedom issues, and conflicts of law issues; and determine in advance how potentially conflicting U.S. Stored Communications Act obligations will be escalated.
- Test the Workflow: Run a tabletop exercise using a mock emergency EPOC to confirm that an order can reach the right people, responsive data can be identified and preserved immediately, legal issues can be escalated, and an authorized decision-maker is available within the 8-hour window.