New EU Regulations Enter Into Force – Foreign Authorities Can Request Digital Evidence

A new EU regulation that changes how authorities can access electronic evidence has now come into force. Since August 18, judicial authorities in the EU can use new European production orders to directly request digital information from service providers in other member states. Sweden has also introduced supplementary national legislation.

This refers to the EU’s so-called e-evidence package, which now moves from legislation to practical implementation. The EU regulation on European Production and Preservation Orders for electronic evidence took effect on August 18, 2026, following a three-year transition period. This has been confirmed by both the European Commission and EUR-Lex.

The change means that authorities in an EU country, in certain criminal investigations, can directly address a European production order to a service provider in another member state. Previously, cross-border access to electronic evidence generally required cooperation between the authorities of the involved countries.

Eurojust describes the new arrangement as a way to make access to electronic evidence significantly simpler and faster.

The rules apply to electronic evidence in criminal proceedings. This may, for example, involve data held by providers of electronic communications services and other digital services.

What information can be requested and what requirements must be met depend, among other things, on the type of data involved. The EU framework distinguishes, for example, between subscriber data, data that can identify a user, traffic data, and the content of electronic communication.

The regulation creates two key tools: European production orders, which are used to obtain specified electronic evidence, and European preservation orders, which allow data to be preserved so that it is not deleted before it can be requested.

Sweden Has Introduced Its Own Supplementary Law

The change is not merely an EU rule on paper. Sweden has also introduced the legislation needed for the system to function nationally.

The Swedish law (2026:1094) with supplementary provisions to the EU regulation on European production and preservation orders for electronic evidence came into force on August 18. The law regulates, among other things, how European production and preservation orders are to be issued in Sweden and how orders from other member states are to be handled.

There is also a separate Swedish law, law (2026:966) on designated establishments and legal representatives for the collection of electronic evidence. Among other things, it requires certain service providers to have a designated establishment or a legal representative who can receive decisions and requests regarding electronic evidence.

Those parts of the law that include supervision and sanctions took effect on August 19. Service providers covered by the rules were also required to have designated an establishment or legal representative by August 18.

Authorities Can Go Directly to the Provider

This change is central to the new system. The European Commission describes the new system as a way to make cross-border access to electronic evidence faster. Eurojust also highlights that the new rules provide judicial and law enforcement authorities with new tools to obtain information needed for criminal investigations.

The Swedish government has previously stated that electronic data is increasingly crucial as evidence in criminal investigations, and that such data is often stored by service providers outside Sweden. This was one of the motivations for the Swedish legislation.

The new arrangement therefore marks a clear shift: electronic evidence held by a service provider in another EU country can be obtained using a standardized European procedure, without the entire process having to go through traditional judicial assistance between states.

New Obligations for Tech Companies

The rules also introduce new obligations for the service providers they cover. Swedish law empowers a central authority to supervise compliance. If a provider fails to fulfill its obligations, it can, for instance, be ordered to take corrective action and be subject to administrative fines.

Swedish law specifies that the administrative fine may amount to at most two percent of the company’s total global annual turnover for the previous financial year.

The reform has now moved past the planning stage. The EU regulation has begun to be applied, the Swedish supplementary law has come into force, and providers subject to the framework must have the necessary functions in place to receive European orders.

This means that the new model for cross-border access to electronic evidence is now part of the European legal system, and that Swedish users’ digital data can be covered when such information is requested in a criminal legal process.