Your EU addressee for e-Evidence orders.

Regulation (EU) 2023/1543 lets a judicial authority in one participating EU Member State order a service provider offering services in the Union to produce or preserve electronic evidence directly, without going through mutual legal assistance. Orders travel over a decentralised IT system built on e-CODEX. The Regulation has applied since 18 August 2026.

It applies if you offer services in the Union, which Article 2(4) defines in two parts: you enable natural or legal persons in a Member State to use one of the services listed in Article 2(3), and you have a substantial connection to that Member State. A substantial connection exists where you have an establishment in a Member State or, in the absence of one, where there is a significant number of users in one or more Member States, or where you target activities towards one or more Member States. Having no EU entity, no EU staff and no EU servers does not put you out of scope — it is precisely what triggers the obligation to appoint a legal representative.

Under Article 3(1)(b) of Directive (EU) 2023/1544, a service provider that is not established in the Union and offers services on a Member State's territory must appoint in writing at least one legal representative in a Member State taking part in the relevant instruments. That representative is the addressee: Article 7 of the Regulation requires orders to be addressed directly to it, and Article 3(3) of the Directive requires Member States to ensure that they are. A provider already established in a participating Member State designates an establishment there instead.

Article 3(6) of the Directive: providers already offering services in the Union on 18 February 2026 had to appoint by 18 August 2026 — the same date the Regulation started to apply. Providers that begin offering services in the Union after 18 February 2026 have six months from the date they start. For an established provider both dates have now passed, so a missing appointment is not early. It is late.

If that subsidiary is an establishment with legal personality in a participating Member State, Article 3(1)(a) applies to you instead: you designate it as your designated establishment rather than appointing an external legal representative. Everything downstream is identical — notification under Article 4, powers and resources under Article 3(4), joint and several liability under Article 3(5) — and orders still have to be received, tracked and answered inside the statutory deadlines. We can operate the platform behind a designated establishment without being the addressee.

Article 3(2) of the Directive requires the addressee to be established or resident in a Member State where you offer your services, and to be capable of being subject to enforcement procedures there. Where you appoint several representatives, Article 4(3) requires the notification to state the precise territorial scope of each. Denmark does not take part in the Regulation, which is relevant to the choice. We settle the Member State during scoping, against where your users actually are.

The notification under Article 4(2) of the Directive names the official EU languages in which your representative can be addressed, and those must include at least one official language of the Member State where the representative resides. That choice is made once, at appointment, and it decides what lands in your queue — so we agree it with you rather than defaulting to it.

Article 5 of the Directive requires Member States to lay down effective, proportionate and dissuasive penalties for infringements of Articles 3 and 4, and to inform the Commission annually about non-compliant providers and the enforcement action taken against them. Separately, Article 15(1) of the Regulation requires pecuniary penalties of up to 2% of total worldwide annual turnover for infringements of Articles 10, 11 and 13(4) — the duties you cannot discharge if there is nobody to receive the order. And under Article 7(2), in an emergency case where the addressee does not react within the deadline, the order may be served on any other establishment or legal representative you have in the Union.

No. The representative is the addressee for orders, not the holder of the data. Requested records stay with you until your own authorised staff approve a specific disclosure, and that approval is recorded together with the exact scope released and the legal basis. What we operate is the receipt, the clocks, the filings and the evidential record.

Both of you. Article 3(5) of the Directive requires Member States to ensure that the service provider and its representative can be held jointly and severally liable, so either may be penalised for a failure by the other. The same paragraph closes the obvious escape: a lack of appropriate internal procedures between the provider and the representative cannot be used as a justification for non-compliance. That is exactly why the procedure between you and us runs in software with a record, and not over email.

No. Article 1(2) of the Directive covers orders under Regulation (EU) 2023/1543, European Investigation Orders under Directive 2014/41/EU, the 2000 Convention on Mutual Assistance in Criminal Matters between Member States, and orders under national law addressed to a legal representative on that Member State's territory. An appointment is not only about EPOCs.

A European Production Order Certificate — Annex I of the Regulation, commonly called Form 1 — orders the addressee to produce stored subscriber, traffic or content data. It states the data requested, the identifiers it relates to, the offence it concerns and the authority the data must be delivered to.

A European Preservation Order Certificate — Annex II, Form 2 — orders data to be frozen rather than disclosed, so it survives while a production order is prepared. Under Article 11(1) the obligation to preserve ceases after 60 days, unless the issuing authority extends it by a further 30 days using Annex VI (Form 6) or confirms that a subsequent request for production has been issued using Annex V (Form 5).

Ten days following receipt of the EPOC under Article 10(3). Where notification to the enforcing authority is required, the data are transmitted at the end of that same ten-day period unless a ground for refusal is raised, under Article 10(2). In emergency cases the deadline drops to eight hours under Article 10(4). Separately, Article 10(1) requires the addressee to act expeditiously to preserve the requested data as soon as the order arrives. The clock runs from receipt by the addressee — not from the date the order was issued, and not from the day your head office in another time zone hears about it.

Article 2(18) defines an emergency case as a situation involving an imminent threat to the life, physical integrity or safety of a person, or to critical infrastructure where disruption or destruction would create such a threat. Emergency orders must be answered within eight hours of receipt, including at nights and weekends, wherever your approvers happen to be.

Where the EPOC is incomplete, contains manifest errors, does not contain enough information to execute it, or the data do not exist, the addressee must inform the issuing authority without undue delay using Annex III (Form 3) and seek clarification. The issuing authority reviews the order in light of that information and, if necessary, sets a new deadline. Non-execution is a structured legal step, not silence.

Somebody on the addressee's side of the connection needs one. ETSI TS 104 144 calls it the service provider's bespoke IT solution: it authenticates the national gateway, validates incoming certificates, tracks statutory deadlines, records decisions and returns structured responses in the standardised format. LexGate is that system, built once against the standard, and it sits behind the appointment — so you neither build it nor run it.

Through the decentralised IT system built on e-CODEX. Each Member State operates a gateway for service providers — the WISP — and messages are exchanged over mutually authenticated TLS in the format standardised by ETSI TS 104 144, a workflow profile on ETSI TS 103 120. A second Member State means a second peer and a second set of certificates, which is part of what the territorial scope of your appointment decides.

On EU-resident infrastructure, with strict tenant isolation between customers and mutually authenticated TLS on every connection to a national gateway. Only what an order actually requires passes through it, and only after your approval. Self-hosted deployment inside your own environment is available for organisations that require it.