The CSAM Regulation, the European Union’s proposed law on preventing and combating child sexual abuse online, is heading into a decisive round of talks on 29 September 2026 with one question still unresolved. Negotiators agree on most of the text, yet they remain divided on whether and how private messages may be scanned. A presidency note dated 18 September shows the Irish Council Presidency trying to break that deadlock by separating public and private content more sharply.
The file has been in negotiation since the Commission tabled it in 2022, and it has become one of the most contested digital proposals of the legislative term. Critics nicknamed it chat control because early drafts would have allowed authorities to order encrypted messaging services to scan all conversations. Child-protection organisations counter that platforms already detect millions of abuse images each year and that a firm legal basis is overdue.
The Irish text now arranges the regulation around four distinct mechanisms. For publicly accessible content, the presidency proposes detection orders limited to already known abuse material, a choice explicitly designed to avoid a general monitoring obligation on platforms. The future EU Centre on child sexual abuse would also be able to search public content on its own initiative.
Negotiators have reached technical agreement on that public-content strand. It includes a safeguard allowing national authorities to delay notifications from the EU Centre to service providers when those notices could compromise an ongoing investigation or prosecution. The deal still needs formal confirmation at the trilogue, but it shows the architecture is settling.
Private communications remain the dividing line. The Council wants to preserve voluntary searches by providers, carrying over the temporary derogation from the ePrivacy Directive that ministers have already extended to 3 April 2028. Its version would cover known material, newly created material and the grooming of children, so that report volumes stay at today’s level.
The European Parliament takes a narrower view of the CSAM Regulation. MEPs want automated detection confined to known material, and they want every search tied to a plan that sets out the technology used and the safeguards applied. That plan would be supervised by national judicial or independent administrative authorities, and providers would have to rely on the indicator database maintained by the EU Centre.
A third strand concerns detection orders for non-public content. The presidency suggests that any such orders should target specific parts of a service or, where possible, individual users rather than scanning an entire platform. Yet it also questions whether orders limited to already identified suspects would add much, since criminal law already provides tools to investigate named individuals.
The fourth element is a fallback that would once have seemed unthinkable. If no compromise delivers effectiveness comparable to the current voluntary regime, the presidency is asking member states whether they would accept removing searches and detection orders on private content from the regulation entirely. That would leave the permanent law focused on public content and on the EU Centre, with private messaging handled through voluntary detection.
This option reveals how far the debate has travelled. The original ambition of mandatory scanning across encrypted services has faded under pressure from privacy regulators, security researchers and several governments. The Council is now worried less about expanding detection and more about ensuring that any review or suspension mechanism does not discourage providers from searching voluntarily.
For fundamental rights, the stakes run in two directions. The Charter protects both the confidentiality of communications and the right of children to protection, and the Court of Justice has repeatedly warned against general and indiscriminate surveillance. A regulation that narrows scanning to known material and places it under independent oversight would sit more comfortably with that case law than earlier drafts did.
The 29 September trilogue will show whether co-legislators can close the gap or whether the CSAM Regulation slips into another season of stalemate. With the interim derogation expiring in April 2028, the pressure to agree a permanent framework is real. Getting it right, however, matters more for Europe’s children and its citizens than getting it done quickly.
