The European Production Order (EPOC): definition, regime, deadlines and remedies

A French investigating judge can now write directly to a provider established in Dublin or Luxembourg and obtain, within ten days, the contents of a messaging account. With no international letter of request, no foreign enforcing authority, and, in a great many cases, without the State where the company is established even being informed. The e-Evidence Regulation has applied since 18 August 2026. This article sets out the mechanism in full.

A European Production Order allows a judicial authority in one Member State to order a service provider established in another Member State to hand over electronic evidence directly, without going through mutual legal assistance. It is governed by Regulation (EU) 2023/1543 of 12 July 2023, which has applied since 18 August 2026¹. The following are examined in turn: what the certificate carries, who it is addressed to, what data it may cover, within what deadlines, on what conditions the addressee may resist it, and what remedies are available to the person whose data is sought.

Definition: production order, preservation order, EPOC certificate

Two notions must be distinguished which it would be easy to confuse, and which the vocabulary of the Regulation itself invites one to confuse. The European Production Order is the decision taken by the judicial authority. The EPOC is the standardised certificate that carries it and that is actually transmitted to the addressee². The addressee never receives the decision itself, only the certificate³.

The same scheme applies to the European Preservation Order, transmitted by a certificate designated by the acronym EPOC-PR, which orders data to be frozen for sixty days, extendable by thirty, for as long as it takes for a production request to be made⁴. This second order may be issued for any criminal offence, with no seriousness threshold⁵.

The Regulation applies in twenty-six Member States, Denmark not taking part⁶ — Ireland, which hosts most of the European headquarters of the major platforms, does take part⁷, whereas it is not bound by the Directive on the European Investigation Order⁴³. It is supplemented by Directive (EU) 2023/1544, which organises the designation of addressees.

Who the order is addressed to

This is the keystone of the scheme. Every provider already offering services in the Union on 18 February 2026 had to have designated in writing, by 18 August 2026 at the latest, an addressee responsible for receiving and enforcing orders, and to have notified that designation to the authority of the State where it is situated; providers entering the market since then have six months⁸. A provider established in the Union designates an establishment with legal personality. A provider not established there appoints a legal representative. The order is addressed to them directly⁹.

A single addressee may cover the whole Union, the provider being free to choose the State of designation among those where it offers its services, provided that it can be subject to enforcement proceedings there. The Directive requires those designations to be published on a dedicated page of the European Judicial Network in criminal matters, but that publication is not yet effective¹⁰. Designation is therefore a formal act, one that is demonstrated and not presumed.

The designated addressee cannot fall back either on the absence of internal procedures with the provider, or on the fact that it would not be authorised to deliver the data. Both may be held jointly and severally liable¹¹.

Exceptionally, in cases of emergency and where the designated addressee does not react within the deadlines, the order may be addressed to any other establishment or legal representative of the provider in the Union¹².

Which companies are covered

The scope goes well beyond the major platforms. It covers electronic communications services, including instant messaging, electronic mail and voice over IP, internet domain and IP numbering services, as well as other information society services which enable their users to communicate with each other, or which store data on their behalf where storage is a defining component of the service.

Online marketplaces allowing users to communicate, hosting and cloud computing services, and online gaming and gambling platforms therefore fall within the scope. Excluded are services which allow communication only with the provider itself, and those for which storage is not an essential component, such as legal or accounting services supplied online.

The provider must also have a substantial connection with the Member State concerned, which presupposes either an establishment, or a significant number of users, or the targeting of activities. The mere accessibility of a website is not enough¹³.

What data can be requested

The Regulation distinguishes four categories, falling under two regimes. This distinction governs everything else.

The exemption from the three-year threshold does not derive from an annex, but from Article 5(4), which refers to four directives: fraud and counterfeiting of non-cash means of payment, child sexual abuse, and attacks against information systems — these first three categories on condition that the offence is committed wholly or partly by means of an information system — as well as terrorist offences. Annex IV, for its part, comes into play only in respect of the ground for refusal based on the absence of double criminality¹⁸.

The exclusion of the public prosecutor for traffic and content data is the translation, within the instrument, of the case law of the Court of Justice according to which access to connection data must be subject to prior review by a court or an independent administrative body. The Court has also held, in relation to the European Investigation Order, that the executing authority cannot cure a lack of competence on the part of the issuing authority.

Substantive conditions

The order must be necessary and proportionate, and those grounds must appear in the act itself. It may be issued only if a similar measure could have been ordered in a comparable domestic procedure in the issuing State, a condition often overlooked which makes for a useful point of scrutiny¹⁹. Finally, it presupposes an offence already committed and identified, no prospective measure being permitted²⁰.

Notification to the enforcing State, and the exemption from it

For traffic and content data, the order is notified simultaneously to the authority of the State where the addressee is situated²¹. That notification suspends the obligation to transmit²².

The exemption is nonetheless broad. It applies where the issuing authority has reasonable grounds to believe that the offence has been, is being or will be committed in its own State, and that the person whose data is sought resides there. These two conditions are cumulative and are assessed on the day of issue, a subsequent change of residence being of no effect. Residence is given an autonomous interpretation, taking account of official registration, the length and conditions of presence, and family or economic ties²³.

It follows that a case with a purely domestic appearance will escape any objection mechanism, even though the data is hosted abroad.

Deadlines

The obligation to preserve arises upon receipt of the certificate. Transmission takes place within ten days, or within eight hours in an emergency²⁴, a notion strictly defined as an imminent threat to the life, physical integrity or safety of a person, or to critical infrastructure²⁵.

Where notification is required, the addressee transmits on expiry of the ten-day period if no ground for refusal has been raised, or upon earlier confirmation. In an emergency, notification does not have suspensive effect and the authority of the enforcing State has ninety-six hours to object, data already transmitted having then to be deleted or its use restricted²⁶.

If the certificate is incomplete, contains manifest errors or is insufficient to be enforced, the addressee informs the issuing authority using the form in Annex III. The issuing authority must react within five days at the latest²⁷. The production obligations are suspended pending clarification or correction; the obligation to preserve remains.

Grounds for refusal

Those of the enforcing State. They are available only where a notification has been made, and there are four of them: immunities and privileges under its law, or rules on freedom of the press and freedom of expression; manifest breach of a fundamental right under the Charter in exceptional situations, on the basis of specific and objective evidence; infringement of the ne bis in idem principle; absence of double criminality, save for offences listed in the categories set out in Annex IV and punishable by at least three years in the issuing State²⁸.

Those of the addressee. The addressee has grounds of its own. Factual impossibility releases it where that impossibility is due to circumstances not attributable to it²⁹, and it is presumed where the person whose data is sought is not a customer of the provider or where the data was lawfully deleted before receipt³⁰.

The addressee may also raise a reasoned objection within ten days where enforcement would place it in conflict with an obligation arising from the law of a third country. That objection suspends enforcement and opens a review by the competent court of the issuing State, which assesses in particular the degree of connection of the case with each legal order, the interest protected by the foreign provision and the consequences for the addressee. Two grounds are expressly excluded: the absence of a similar provision in the law of the third country, and the mere fact that the data is stored there³¹.

The regime for professions bound by privilege

Where data is hosted in infrastructure intended for professionals bound by professional secrecy, in particular lawyers, doctors or journalists, the Regulation organises a protection that remains conditional. An order covering traffic or content data remains possible if the professional resides in the issuing State, if approaching the professional “might be detrimental to the investigation”, or if the privilege has been lifted in accordance with the applicable law³². The second scenario is drafted in terms of mere possibility — it is enough that approaching the professional “might” be detrimental to the investigation — which lowers the threshold considerably.

Encryption

Data must be produced whether encrypted or not, but no obligation to decrypt rests on the provider³³. On an end-to-end encrypted messaging service, the provider will therefore hand over a container which it is not itself in a position to open, and it will have discharged its obligation. Backups hosted in an online storage service are, by contrast, the weak link in the protective scheme, their security depending on the options enabled by the user.

Penalties

Member States must provide for effective, proportionate and dissuasive pecuniary penalties, which may reach 2 % of the provider’s total worldwide annual turnover for the preceding financial year³⁴. The designated addressee and the provider may be held jointly and severally liable under Article 3(5) of Directive (EU) 2023/1544. In return, a provider which complies in good faith is not liable for damage that this may cause to its users or to third parties³⁵.

France, however, has published no text giving effect to this scheme, so that the national penalty regime does not yet exist⁴². On 27 March 2026, the European Commission sent a letter of formal notice to twenty-two Member States, including France, for incomplete transposition of Directive (EU) 2023/1544.

The firm assists addressee companies in characterising the certificate and formulating objections. Contact the firm →

The rights of the person whose data is sought

The issuing authority informs the person whose data has been produced, without undue delay, indicating the available remedies. It may, however, delay, restrict or omit that information for as long as the conditions laid down in Article 13(3) of Directive (EU) 2016/680 are met, the reasons being placed on the file³⁶.

The remedy is exercised before a court of the issuing State and covers the lawfulness of the measure, including its necessity and proportionality³⁷. The Regulation further requires the issuing State, like any other Member State to which the evidence has been transmitted, to ensure respect for the rights of the defence and the fairness of the proceedings when assessing that evidence³⁸.

A point rarely noted is that the issuing of a production or preservation order may also be requested by the person under investigation or by their lawyer³⁹. This is not an autonomous power to issue, the order remaining issued or validated by the judicial authority, but it is a textual basis for seeking the immediate freezing of exculpatory data threatened with deletion.

The firm acts for the defence in criminal proceedings founded on cross-border digital evidence. Contact the firm →

Interaction with the other instruments

The Regulation does not repeal the Directive on the European Investigation Order, which it supplements⁴⁰. The two routes coexist, and the choice of instrument has consequences for the applicable regime of challenge. It should be recalled that, under French domestic law, a French authority may issue a European Investigation Order only for measures which it is itself empowered to order.

Frequently asked questions

What is an EPOC?

The EPOC is the standardised certificate that carries a European Production Order. It is transmitted directly to the designated addressee of the service provider, who never receives the judicial decision itself. Its variant, the EPOC-PR, carries a preservation order.

Since when has the e-Evidence Regulation applied?

Since 18 August 2026, in twenty-six Member States. Denmark does not take part in the Regulation.

Can a public prosecutor obtain the content of messages?

No. For traffic data and content data, the order may be issued or validated only by a judge, a court or an investigating judge. The public prosecutor has competence only for subscriber data and data requested for the sole purpose of identifying a user.

What is the deadline for responding to a European Production Order?

Ten days from receipt of the certificate, or eight hours in an emergency. An emergency presupposes an imminent threat to the life, physical integrity or safety of a person, or to critical infrastructure. The obligation to preserve the data arises, for its part, upon receipt.

What penalty does a company face if it fails to respond?

A pecuniary penalty of up to 2 % of the provider’s total worldwide annual turnover for the preceding financial year. The designated addressee and the provider may be held jointly and severally liable under Article 3(5) of Directive (EU) 2023/1544. In France, however, no implementing text has been published to date.

Does the Regulation require data to be decrypted?

No. Data must be delivered whether encrypted or not, but no obligation to decrypt rests on the provider. On an end-to-end encrypted messaging service, the provider hands over a container which it is not in a position to open and thereby discharges its obligation.

Can compliance be refused on the ground that the data is stored outside the Union?

No. The obligation applies irrespective of the location of the data⁴¹, and the Regulation expressly prohibits basing an objection on the mere fact that the data is stored in a third country. A conflict with an obligation arising from the law of a third country may, by contrast, give rise to a reasoned objection, raised within ten days and suspensive.

Is the State where the provider is established informed?

Only for traffic and content data, and subject to an exemption. That exemption applies where the issuing authority has reasonable grounds to believe that the offence was committed in its own State and that the person whose data is sought resides there. For identification data, no notification is provided for.

Has France transposed the e-Evidence Regulation?

A regulation is not transposed: it is directly applicable. But it calls for national accompanying measures — designation of a central receiving authority, penalty regime, internal circuit — and the accompanying Directive (EU) 2023/1544 did have to be transposed. No French text has been published to date on either count. On 27 March 2026, the European Commission sent a letter of formal notice to twenty-two Member States, including France.

Can the defence request that an order be issued?

Yes. The Regulation provides that the issuing of a production or preservation order may be requested by the person under investigation or by their lawyer. The order remains issued or validated by the judicial authority, but this basis allows the freezing of exculpatory data threatened with deletion to be sought.

The European Production Order is not one more instrument of mutual assistance: it substitutes, for cooperation between States, a direct obligation borne by a company, coupled with a short deadline and a heavy penalty. For the authority issuing it, it is a considerable saving of time. For the addressee company, it is a new obligation whose first hours determine the outcome. For the person whose data is sought, it is an act that may have been carried out without any authority of the enforcing State having been informed, and without that person having been alerted.