top of page

EU e-Evidence: How the New Ecosystem Will Work & What to Expect in Volume

  • Writer: Tina Rosén
    Tina Rosén
  • 2 days ago
  • 3 min read
EU flag

Following our first post on why the new EU e-evidence regulation is a game-changer for telecom operators, Part 2 dives into the operational reality. How will the digital chain of custody function? Who is actually participating? And why might "IP Tracing" be your biggest volume challenge?


The deadline is set: August 18, 2026. By this date, the era of voluntary cooperation and slow paper trails will come to an end. It will be replaced by a mandatory, digitized European ecosystem for preserving and producing electronic evidence.



The new EU e-evidence process: A digital chain of custody


The core shift is moving from requests to orders. The new European Production Orders (EPOC) and Preservation Orders (EPOC-PR) are legally binding instructions transmitted directly from a judicial authority in one country to a Service Provider in another.



For the Police investigator (issuing authority)

Instead of mailing letters or faxing requests, the investigator uses a national case management system connected to e-CODEX. They select the Service Provider from a verified directory (the European Judicial Network Atlas), digitally sign the order, and transmit it. The system automatically tracks strict deadlines: 10 days for standard cases, 8 hours for emergencies.



For the CSP (Communication Service Provider)

You receive the order instantly through your e-CODEX access point. "Internal policy" is no longer a valid reason to refuse.


  • Action: You must preserve the data immediately.

  • Response: You must transmit the requested data back via the same secure channel within the deadline.

  • Sanctions: Non-compliance can result in fines of up to 2% of global annual turnover.



Geographic EU scope: The "Denmark exception"

While this is an EU-wide regulation, not every neighbor is on the digital grid. It is important to note that Denmark has a permanent opt-out from EU Justice and Home Affairs policies. Due to this, Denmark has opted out of the e-Evidence Regulation and the mandatory e-CODEX system; you will not receive digital Production Orders from Danish police via this platform. Instead, any requests from Denmark will continue to arrive through traditional, slower channels like Mutual Legal Assistance or European Investigation Orders (EIO), requiring your team to maintain manual handling processes for these specific cases.


Abstract geometric iceberg design with yellow and orange triangles on a white background, creating a vibrant and modern look.


The "Iceberg" effect: analyzing e-evidence request volumes


A critical question for operators is: "How many requests will we actually get?"

To answer this, we must look at both current baselines and the "frictionless" future. Most telecom operators are "Net Exporters" of evidence, meaning you will primarily receive requests for roaming data (e.g., a tourist using your network) or IP address.


The EU Commission estimates that over 50% of all criminal investigations involve cross-border evidence, yet many are never requested today because the MLAT process is too slow.


Once e-CODEX removes the friction, expect a surge in "routine" requests. While you may not see the volume of a global OTT like Meta, even a modest volume of 500–1,000 requests per year becomes a crisis if 5% of them are 8-hour Emergency Orders arriving on weekends.


While the absolute volume for a Swedish operator is lower, the operational risk per request is higher if manual processes are used. A German operator likely has an automated "factory" for requests due to domestic volume. A Swedish operator might still rely on a small team of experts. If that team is offline when one of the 50 annual emergency orders arrives, the 2% turnover fine applies regardless of the low volume.



Diagram of EU e-evidence estimated request volumes

Metric

🇸🇪 Sweden (Mid-Sized Operator)

🇩🇪 Germany (Large Operator)

Population

~10.5 Million

~84 Million

Std. Subscriber/Traffic Requests

~15,000 – 20,000 / year

> 1.5 Million / year

IP Address Tracing Requests

~5,000 – 10,000 / year

~290,000 / year

Est. Incoming e-CODEX Orders

~1,000 – 2,000 / year

~15,000 – 25,000 / year

Emergency Orders (8h)

~25 – 50 / year

~250 – 750 / year

e-CODEX Status

Active (Centralized)

Active (Decentralized)


*Estimates based on 2024 transparency reports (Deutsche Telekom and Telia Company) and EU Commission impact assessments for "Net Exporter" countries. Note: Swedish figures for IP tracing are often lower per capita due to different copyright enforcement legal frameworks compared to Germany.



Sources

Regulations

Reports




bottom of page