The EU's e-evidence rules became applicable on 18 August. A judicial authority in one member state can now order stored data straight from a provider in another, on a very short clock.
On 18 August 2026, Regulation (EU) 2023/1543, the e-evidence Regulation, became applicable across the European Union. It lets a judicial authority in one member state send an order directly to a service provider established in another, without first routing the request through that second country's government. The European Commission's summary of the framework describes the two instruments it creates: a European Production Order, which compels disclosure of stored data, and a European Preservation Order, which freezes data so it can be requested afterwards.
The clock is the part worth noticing. A provider that receives a production order has ten days to transmit the data, and eight hours where the issuing authority has declared an emergency.
The Regulation sorts data into tiers. Subscriber data, and data requested for the sole purpose of identifying a user, sit at the bottom; a public prosecutor can request them for any criminal offence. Traffic data and content data, meaning the messages, images and files themselves, sit at the top. As eucrim sets out, an order for those must clear a higher threshold: the offence has to carry a maximum custodial sentence of at least three years, or fall within a defined list covering terrorism, child sexual abuse, non-cash payment fraud and certain cybercrime offences. Preservation orders run for 60 days and can be extended by a further 30.
The scope of who receives these orders is wide. Reed Smith's briefing lists electronic communications services, internet domain name and IP services, and information society services where storing or processing user data is a defining component. Cloud storage and hosting sit squarely inside. Providers based outside the EU are not outside the regime either: the companion Directive (EU) 2023/1544 requires those offering services in the Union to designate an establishment or legal representative there to receive and act on orders. Penalties for non-compliance reach 2% of a provider's total worldwide annual turnover for the preceding financial year.
The legal deadline has arrived ahead of the machinery. By February 2026, according to a readiness review at ComplexDiscovery, only four member states (Croatia, Italy, Lithuania and Slovakia) had adopted implementing legislation, with Germany following in March. On 27 March 2026 the Commission opened infringement proceedings, sending formal notices to 22 member states over incomplete transposition of the Directive, whose deadline had been 18 February 2026. The e-CODEX channel the orders are meant to travel through is still being built out, and its transmission capacity is capped at 25 MB, which is modest next to what a content-data order can ask for.
A short deadline layered on unfinished plumbing tends to push work toward whatever path already functions. For providers, the eight-hour emergency window is the sharp end of that.
European Digital Rights argued during the negotiations that the final compromise weakened the safeguards to the point of thinness. Preservation orders carry no obligation to notify the country where the provider sits. Production orders for subscriber data, or for data used solely to identify a user, skip notification too. Where an executing state can object at all, EDRi notes it must do so on the basis of the information contained in the order itself, and fundamental rights become a ground for refusal only in exceptional cases of manifest breach supported by specific and objective evidence. That reading will now be tested through real cases rather than through drafting.
Cross-border evidence gathering is a legitimate function, and the previous route through mutual legal assistance was slow enough to obstruct ordinary investigations. The narrower question is what any of this can actually return. A production order compels a provider to hand over the data it holds. It does not create data the provider never had, and it does not make readable what the provider has no means to read. The scope of what an order yields is fixed long before the order is written, by an architectural decision about where the keys live.
For anyone moving sensitive files, that is the decision worth examining. If a provider can open your files to build a search index or generate a preview thumbnail, the same capability serves a production order, a subpoena, a curious employee, or an intruder who reaches that interface. Four different threats, one shared precondition.
An order reaches as far as the provider's own access, and no further.
SpaceBox is designed so that the provider's access is nothing. Files are encrypted on the sender's device with AES-256-GCM, and the file key is wrapped to the recipient's public key using ML-KEM-768, the post-quantum key exchange standardised by NIST as FIPS 203. Private keys are generated on the device and stay there. Our servers hold ciphertext. Post-quantum cryptography is not unique to us, and more services adopt it every year; what matters alongside the algorithm is who holds the key material, and that is a design choice rather than a cryptographic one.
SpaceBox Lite is free, requires no account and no personal data from senders, and is currently unavailable to residents of the EU and the EEA during the beta, which means the readers most directly affected by this Regulation cannot use it yet. For organisations that need custody to be physical rather than contractual, SpaceBox Ground is an on-premises, air-gapped appliance with append-only storage and N-approval release. See Why SpaceBox for how the pieces fit together.
The e-evidence Regulation does not change the cryptography. It changes how quickly and how directly a lawful request can arrive, and how many jurisdictions can send one. When the answer to a request is set by what a provider was ever able to read, that is a question worth settling before the request shows up.