Deadline: 18 August 2026

EU E-Evidence
Compliance for
every provider.

From the smallest online shop to EU-wide platforms: our SaaS platform Evigate enables you to respond to authority requests under EU 2023/1543 on time, with legal certainty, and without specialist knowledge.

Sign up now Am I affected?
What's at stake
8 h
Response window for emergency EPOC
around the clock, including weekends
2 %
of global annual turnover as a fine
with no size threshold
9,000+
obligated companies in Germany alone (per BMJ)
18 Aug
Deadline 2026
mandatory BfJ registration and disclosure
Do you know whether your company is affected? No legal background required — 4 questions, 60 seconds.
Start the self-check →
E-Evidence Regulation (EU 2023/1543)

What is E-Evidence?

The European E-Evidence Regulation requires hundreds of thousands of network operators, internet providers, online shops and platforms to provide subscriber and traffic data about their customers to authorised authorities across the EU upon formal request. After a three-year transition period, the regulation becomes binding across Europe on 18 August 2026.

Applicability check

Am I obligated?

In four short steps, check whether the E-Evidence Regulation applies to your company. The evaluation runs entirely in your browser — no data is sent.

Question 1 of 4
What kind of service do you offer?
Question 2 of 4
Can users in your service store data or communicate with each other?
Question 3 of 4
Where are your customers / users located?
Question 4 of 4
Do you already have processes for authority requests (e.g. TKG / TKÜV)?

This self-check is not a substitute for legal advice. A case-by-case review under Regulation (EU) 2023/1543 is decisive.

Why act now

The risks are real — and underestimated

The most common misconceptions — and why they can get expensive.

"This doesn't apply to small companies."
Wrong. The regulation has no size threshold — no minimum revenue, no minimum user count. Even an association with a forum or a startup is fully obligated.
"10 days is enough time."
For emergency EPOC: 8 hours — including weekends and public holidays. Without working 24/7 on-call, the deadline is regularly missed.
"The fines are manageable."
Up to €500,000 or 2 % of global annual turnover — whichever is higher. Plus joint and several liability with the nominated addressee.

Evigate vs. in-house build vs. manual handling

CriterionEvigateIn-house buildManual handling
Guided BfJ registration Step-by-step Research yourselfPartial
e-CODEX connectivity Fully integratedMonths of development Not legally compliant
8-hour emergency window covered 24/7 monitoringOwn on-call duty Not feasible
eIDAS signature / seal AutomaticOwn PKI required
Audit trail / tamper-evident ExportableBuild it yourself
Cost until go-live From a few €/month€5–50k + ongoingLegal fees per request
Legal expertise required NoneExtensiveHigh
How it works

From registration
to a legally compliant response.

Seven guided steps replace legal department, IT team and on-call duty.

00
BfJ registration
Guided process for the mandatory registration with the Federal Office of Justice — from nominating the addressee to completing the filing.
Mandatory by 18 Aug 2026
01
Receive & assign EPOC
Orders arrive automatically via e-CODEX. Instant notification by email, SMS or messenger — assignment to the responsible person in seconds.
e-CODEX integration
02a
Formal review
Structured review process: completeness, data category, offence catalogue, potential GDPR conflicts — all documented and traceable.
Guided checklist
02b
Optional legal review
On request, a specialist lawyer reviews the order individually — for maximum legal certainty in complex cases.
Optional add-on
03
Deadline management
10-day standard deadline and 8-hour emergency path are monitored automatically. Proactive escalation before the deadline becomes a fine risk — 24/7.
24/7 monitoring
04
Data extraction & signature
Data is compiled and automatically signed with a qualified electronic signature under eIDAS — no in-house PKI infrastructure required.
eIDAS-compliant
05
Secure transmission
End-to-end encrypted transmission via the legally mandated EU justice channel (e-CODEX) — no direct data transfer outside it.
EU justice channel
06
Audit trail
Every step is logged completely and in a tamper-evident way. Exportable at any time for internal audits, data protection reviews or court proceedings.
Tamper-evident
Who it's for

Who is Evigate for?

80–90 % of those obligated under E-Evidence have no Lawful Interception (LI) infrastructure. Evigate is built precisely for these companies — regardless of size or industry.

Newly affected
Online shops & marketplaces
Anyone running buyer-seller chats, reviews or user accounts with data storage falls fully within scope.
e.g. WooCommerce shops, classifieds portals, B2B marketplaces
Newly affected
B2B SaaS & cloud
The GDPR processor role doesn't shield you. If data storage is a defining part of the service, the regulation applies.
e.g. HR SaaS, project management software, data-room providers
Newly affected
Gaming, dating & community
As soon as chat, user profiles or saved game states are possible — almost always — scope applies.
e.g. gaming platforms, dating apps, club portals, forums
Newly affected
Hosting, VPN & DNS
Web hosts, managed servers, VPN providers and DNS services are explicitly covered — even without a classic telecoms profile.
e.g. web hosts, managed servers, VPN providers, DNS resolvers
LI-experienced
Regional ISPs & VoIP
Existing TKG processes don't fully cover E-Evidence. JUDEX connectivity, multilingual triage and combined TKÜV+EPOC workflows complement your setup.
e.g. city carriers, SIP trunking providers, regional network operators
Legal Representative
Legal Representatives
Manage mandates for multiple foreign service providers in one interface — with full tenant separation and a dedicated audit trail.
e.g. law firms, compliance providers, IT service providers
Features

What Evigate does.

Everything you need for legally compliant E-Evidence handling — as a turnkey SaaS platform.

e-CODEX connectivity
Legally compliant connection to the European judicial communication system — no own code, no own infrastructure.
EPOC / EPOC-PR form management
All legally required forms are automatically populated, validated and made ready to send.
Deadline management & 24/7 escalation
Automatic monitoring of all deadlines including the 8-hour emergency path. Proactive escalation before fine risk arises.
Qualified eIDAS signature
Every response is automatically provided with a legally valid qualified electronic signature — no own PKI required.
Guided BfJ registration
Step-by-step guidance through the registration with the Federal Office of Justice, mandatory since 18 February 2026.
Tamper-evident audit trail
Complete, tamper-evident logging of all activity — exportable for audits, data protection officers and court proceedings.
Multi-tenant
Legal Representatives manage all of their clients' mandates in one interface with clean separation and a full overview.
Multilingual & translation
Incoming orders in any EU language are translated and prepared — no missed deadlines due to language barriers.
GDPR conflict check
Automatic sanity checks for form errors, the offence catalogue and conflicts with GDPR or third-country law before every disclosure.
About Evigate

Experience that counts.

Evigate is founded by a team with decades of experience advising companies and operators of critical infrastructure in the telecoms sector and other digital fields. Our founders are deeply networked in industry associations, as EU Commission experts and in standardisation bodies – and are now channelling that expertise into a dedicated compliance product.

Mathias Handsche
Mathias Handsche
Managing Director
Information security & compliance
handsche@evigate.eu
Thomas Rickert
Thomas Rickert
Managing Director
Attorney for IT law, data protection law, compliance
rickert@evigate.eu
Klaus Landefeld
Klaus Landefeld
Consultant
Well-known voice of the internet community (eco, DENIC)
landefeld@evigate.eu
Ulrich Plate
Ulrich Plate
Senior Information Security Consultant
plate@evigate.eu
20+
Years of telecoms experience
EU
Commission expertise
GDPR
EU data storage
Timeline

Act now
Not in August.

The transition period is running. Anyone not registered and without processes by the deadline risks immediate fines.

August 2023
Regulation entered into force
EU 2023/1543 entered into force, a 3-year transition period began.
18 February 2026
Registration obligation active
Since that day, service providers must register with the Federal Office of Justice. For providers based in Germany: transition period until 18 August 2026.
since March 2026
Evigate test phase running
The official test phase has been running since March 2026. Test sign-ups are still prioritised.
18 August 2026
Deadline
From this day, authorities can issue EPOC and EPOC-PR. Anyone not ready risks fines of up to 2 % of annual turnover.

Your checklist

Evigate takes care of this for you →

FAQ

Has the test phase already started?

Yes, the test phase has been running since March 2026. You can still sign up to take part.

What can I expect?

Updates on functionalities, practical examples, and possible participation in test phases.

Why should I register?

To hear early about developments, test announcements and practical examples. A personal preliminary meeting is requested separately, through the meeting request form.

Contact

We are happy to help
Free initial consultation

Sign up now
Free updates & test phase.

Receive exclusive information, test announcements and practical examples on E-Evidence.

No spam. Unsubscribe anytime. Data stored in the EU.