During the eEvidence seminar organised by NBIP on 22 April in Utrecht, it became clear that there are still a number of hurdles to overcome before 18 August 2026 – the date on which eEvidence comes into force. Collaboration between the Ministry of Justice and Security, the sector and other stakeholders will play a key role in this.
In short: what is eEvidence?
Under the eEvidence framework, competent authorities in EU Member States will soon be able to request direct access to electronic evidence (e-evidence) from digital service providers in other EU Member States. Providers must respond within 10 days of receiving a order, or within 8 hours in urgent cases. Currently, this period stands at 120 days. It is therefore expected that this legislation will lead to a significant increase in the number of orders. Digital service providers must be able to comply with these orders from 18 August 2026.
That is why NBIP, in collaboration with the Dutch Cloud Community and the Association of Registrars (in Dutch: VvR), organised an seminar to update the sector on the latest developments regarding eEvidence. The session featured a guest from the Ministry of Justice and Security (J&V), which is responsible for the implementation of eEvidence in national legislation. The session began with a presentation by Erik Planken, senior policy adviser at J&V, on the latest state of affairs regarding eEvidence and what providers can expect. This was followed by a panel discussion in which moderator Marc van der Ham (Tilburg University) spoke with Erik Planken, Wilfred van Duyn (J&V), Jacqueline van de Werken (Dutch Cloud Community), Margreth Verhulst (VvR) and Octavia de Weerdt (NBIP). The discussion addressed the most pressing questions from the sector regarding compliance with eEvidence and the steps required to achieve this.
The European portal: E-CODEX
During the presentation, it became clear that the Netherlands will definitely be using the European portal known as E-CODEX. This is in contrast to the Netherlands’ previous position of building its own portal for eEvidence requests. Through the portal, companies covered by eEvidence will have access to the web interface for processing disclosure and preservation orders (requests). The European Commission is working on the development of the Reference Implementation (RI) software for competent authorities and service providers, which will be implemented by the Netherlands.
Status of the eEvidence legislation in the Netherlands
The eEvidence package consists of two components: a European regulation and a directive. The regulation will apply directly from 18 August 2026 and does not need to be transposed into national law. The provisions of the directive, however, must be transposed into national legislation. The Electronic Evidence Implementation Act, the Dutch transposition of the directive, is currently before the House of Representatives. At present, it seems unlikely that the Implementation Act will be adopted by both Houses of the Dutch Parliament before 18 August. However, this does not mean that the regulation will not come into force on 18 August.
What does this mean for businesses? Organisations must in any case register via the registration portal, with applications being validated by the Netherlands Authority for Consumers and Markets (ACM), which will oversee compliance with the implementing legislation in the Netherlands. The panel discussion during the seminar revealed that if registrations have not been possible, the directive has not yet been implemented or the API is not yet operational, the Netherlands cannot yet comply with eEvidence orders. According to J&V, a Plan B must then come into effect, but the details of this are as yet unknown. Please note: the eEvidence package will exist alongside the current European Production Order (EPO).
Does the size of your organisation affect eEvidence?
The panel also discussed what impact this will have on the many organisations that will fall under the scope of eEvidence. Consider, for instance, the administrative burden on small businesses. Whereas other legislation, such as the Digital Services Act (DSA), still provides exemptions for (smaller) SMEs, this is not the case with eEvidence. Every digital service provider, as defined in the regulation and regardless of the number of employees or turnover, must comply with eEvidence. The reason for this is to prevent criminal activity from shifting or being attracted to service providers not covered by the regulation. It also became clear that not only must your parent entity be registered, but you must register every company falling under your parent entity for eEvidence.
Financial compensation for complying with eEvidence orders?
In some countries, such as the Netherlands, there is a national compensation scheme for the costs incurred by companies in complying with orders from competent authorities. This is not the case within the eEvidence package. When asked during the panel discussion, the Ministry of Justice and Security stated that, during discussions with the European Commission, there was no consensus among the 26 Member States regarding a reimbursement scheme.
For Dutch companies, this means that they will not receive any reimbursement if they receive an order from another country that does not have a reimbursement scheme.
The next steps for eEvidence
Drawing on its 25 years of experience with lawful interception and lawful disclosure, NBIP stands ready to support the sector, the Ministry and other relevant bodies wherever possible in implementing this legislation. One of the key issues, for example, is to clarify exactly which groups of service providers will be affected by eEvidence. In addition, the panel also discussed whether the registration requirement should be brought into force first, followed by the specific obligation. This question will be taken into account in the discussions with the technical committee responsible for eEvidence.
In the autumn, NBIP will organise a further information session on this topic, involving as many stakeholders as possible.
