Judicial authorities across the European Union woke up on 18 August with a power they have wanted for the better part of a decade. From that date, a prosecutor in Lisbon can send a European Production Order straight to the designated establishment or legal representative of a messaging service headquartered in Dublin, and that provider must hand over the requested subscriber, traffic or content data. No mutual legal assistance request. No intermediary ministry. No waiting.
The speed gain is the entire point of Regulation (EU) 2023/1543. Investigators who previously relied on a European Investigation Order faced a process that could consume up to 120 days. Classic mutual legal assistance averaged closer to ten months. Digital traces rarely survive that long in any useful form, and prosecutors have spent years complaining that the rules of cooperation moved at the pace of paper while crime moved at the pace of fibre.
What arrived this week fixes that arithmetic. It does not fix the delivery mechanism.
The regulation assumes that authorities and providers will exchange orders through a secure decentralised IT system that connects national judicial bodies to company contact points. That system is still under construction. Providers who spent the summer preparing compliance workflows found themselves building for a channel that may not carry traffic on day one, which means the opening months of this regime will run on interim arrangements, national workarounds and whatever secure email each member state considers adequate. A framework designed to standardise cross-border requests therefore begins its life in exactly the fragmented condition it was meant to end.
Compliance officers have noticed the mismatch between that improvisation and the sanctions attached to it. Article 15 obliges member states to impose penalties that are effective, proportionate and dissuasive, with a ceiling of two percent of a provider’s total worldwide annual turnover for the preceding financial year. Late responses count. Incomplete responses count. The provider and its appointed legal representative share liability, which turns what looks like an administrative box on an organisational chart into a position carrying real financial exposure.
That combination deserves scrutiny. A company can face a turnover-based penalty for missing a deadline on a request that reached it through an ad hoc channel, in a language it must translate, from an authority whose competence it can barely verify. The regulation grants narrow objection grounds, mostly manifest breaches of fundamental rights or conflicts with third-country law. The drafters kept them narrow so the issuing state carries responsibility for legality and the provider carries responsibility for execution.
Civil liberties groups spent the negotiation arguing that this allocation shifts too much weight onto the issuing state’s own judiciary. The executing country, under the finished text, plays a far smaller role than it did under mutual legal assistance, and in several categories of request it is barely notified at all. Defenders of the design answer that the European Investigation Order already operates on mutual recognition and that carving out data would create a two-speed cooperation regime. Both positions survived the trilogue intact, which is why the regulation contains notification duties for content and traffic data but not for subscriber information.
The practical test now falls on the smaller providers. Large platforms have staffed law enforcement response teams for years and treat a new order type as an addition to an existing queue. A mid-sized cloud host in Estonia or a regional telecoms operator in Portugal must designate an addressee, document escalation paths, and be ready to act on a request arriving from any of twenty-six other jurisdictions, some of which will send their first order in the coming weeks.
Non-EU firms selling into the single market carry the same duty through a legal representative, which pulled American companies with European operations into compliance work they had not budgeted for. The Commission calls designation straightforward. Firms that left it until August disagree.
Whether this regime earns its reputation will depend less on the legal text than on how many orders actually move, how quickly, and how often a provider pushes back. Those numbers will not appear for months. Until the decentralised system runs, nobody in the chain can say with confidence how the new architecture performs under load.
