Brussels: The EU’s chat control regulation reaches what negotiators are calling its most consequential session yet on 29 September, when the Council, European Parliament and Commission sit down for a sixth political trilogue on the permanent Child Sexual Abuse Regulation. The meeting will not settle the file outright, but it will show whether Europe is any closer to replacing today’s temporary, voluntary message-scanning regime with a permanent law, or whether the fight over encryption and mass surveillance drags into a third negotiating cycle.

What the interim chat control regime does today

Since 2021, providers such as Meta and Microsoft have been allowed, on a voluntary and temporary legal basis, to scan private messages and images for known child sexual abuse material and report matches to authorities. That interim regime, extended repeatedly by Parliament and Council, is currently set to expire on 3 April 2028, giving negotiators a real but not unlimited runway to agree the permanent successor law. Child protection groups cite figures suggesting more than 270,000 suspected abuse images are uploaded daily across EU platforms, the statistic proponents of the chat control regulation use most often to argue that scanning cannot remain optional.

Where Council and Parliament still disagree

The two co-legislators enter the trilogue with mandates that overlap on process but diverge on substance. The Council’s position, agreed under member state instructions from November 2025, drops mandatory detection orders altogether in favour of continued voluntary provider scanning, while adding a new requirement for mandatory age verification on messaging services. Parliament’s mandate, unchanged since November 2023, allows detection only as a last resort against named suspects under judicial authorisation, explicitly protects end-to-end encryption, and rejects mandatory age verification outright. The Commission, which originally proposed compulsory detection orders in 2022, now functions mainly as broker between the two positions rather than a voting party.

Why Germany holds the real veto

The chat control regulation’s fate arguably rests less on Brussels than on Berlin. Germany carries 18.47 percent of the EU’s population, and nine governments opposing mandatory private message scanning currently represent 32.9 percent, just over two percentage points short of the blocking minority threshold under qualified majority voting. German justice minister Stefanie Hubig has said unwarranted chat monitoring must be taboo in a constitutional state, but Berlin’s coalition instructions reportedly still leave room for mandatory detection layered on top of voluntary scanning, an ambiguity other capitals are watching closely. Poland and Slovenia oppose the current mass-scanning approach outright, the Czech Republic moved from abstention to opposition this September, and France, Denmark, Sweden and Belgium remain internally undecided.

The encryption question courts have already weighed in on

Technically, the hardest unresolved question is client-side scanning: inspecting a message on a user’s device before it is encrypted, proposed as a workaround that would let providers scan content without breaking encryption in transit. The European Court of Human Rights has already complicated that route, ruling in Podchasov v. Russia that requiring providers to weaken encryption cannot be regarded as necessary in a democratic society, a precedent privacy advocates are citing directly in the Brussels negotiations.

What happens next

Negotiators expect the 29 September trilogue to produce provisional agreement on the less contentious elements, including risk assessments, the new EU Centre to coordinate reporting, and transparency standards, with the first provider error-rate reports due by 1 February 2027. What is unlikely to be resolved in one sitting is the core question of mandatory scanning itself. If no deal emerges before the end of the year, the file passes to Lithuania’s presidency in January 2027, the interim regime stays in force, and the chat control regulation that has now occupied three European Parliament mandates continues into a fourth year of negotiation.