The Clock Is Ticking: Are You Ready for the EU e-Evidence Package?

New cross-border evidence rules take effect in Sweden as of August 2026 — and non-compliance carries strict-liability fines of up to 2% of global turnover. Is your business prepared?

If your company operates a social network, online marketplace, gaming platform, messaging service, cloud storage solution, electronic communications service, or domain/IP infrastructure — and you provide services to users in Sweden — these new rules apply to you.

The EU e-Evidence package is being phased into Swedish law, with the first provisions applying from 1 July 2026, fundamentally changing how law enforcement authorities across Europe can compel service providers to produce or preserve electronic evidence. Two new Swedish acts give effect to the package: one implements EU Directive 2023/1544 on designated establishments and legal representatives (SFS 2026:966), and the other supplements EU Regulation 2023/1543 on European Production Orders and European Preservation Orders for electronic evidence (SFS 2026:1094). Together they establish a powerful new mechanism of judicial cooperation: from 18 August 2026, an authority in an EU Member State may issue production or preservation orders directly to your company — regardless of where you are headquartered.

The deadlines are imminent, the obligations are concrete, and the sanctions are severe. Here is what you need to know.

Why This Matters: The Problem the EU Is TRYINg to Solve

Criminals increasingly exploit digital platforms to communicate about and commit offences. Service providers of such digital services are often the only entities holding the identifying or evidentiary data that law enforcement needs — subscriber records, traffic metadata, and content data. But traditional mutual legal assistance channels between EU Member States are slow and cumbersome, and electronic evidence is frequently available only for a limited time. Critical evidence risks being lost before cooperation channels produce results.

The EU’s answer is the e-Evidence package: a streamlined framework allowing judicial authorities to go directly to service providers across borders, bypassing legacy processes. For businesses, this means new compliance infrastructure must be in place.

Are You in Scope?

Covered services

The regulation applies to any company providing one or more of the following services:

• Electronic communications services: for example, internet access and broadband services, and interpersonal communications services such as messaging, video, and voice services;
• Internet domain name and IP numbering services: for example, services for the assignment of IP addresses, domain name registry services, domain name registrar services, domain name resolution services, domain name related privacy and proxy services, and providers of technical infrastructure for the internet; and
• Communication, storage, and data processing services: for example, social networks, online marketplaces, services via online portals, cloud and hosting services, and online gaming sites, provided that the services include a communication function or a function allowing users to store data.

Territorial reach

The rules apply to service providers who are:

• Established in Sweden offering services in more than one (1) EU Member State; or
• Not established in any EU Member State but offering services in Sweden; or
• Established in Denmark offering services in Sweden.

Key Obligations: What You Must Do

Setting up

1. Determine whether you are an in-scope service provider under the e-Evidence framework.
2. Register and designate at least one point of contact for receiving and responding to orders from EU authorities.
3. Depending on where you are established, either a designated establishment or a legal representative must be appointed:
   a) Designated establishment: For service providers established in Sweden.
   b) Legal representative: For service providers established outside the EU or in Denmark that offer their services in Sweden.
4. Connect to the EU-wide IT system for e-Evidence. A service provider may connect to the EU common IT system either via the e‑Evidence web portal[1] or the e‑Evidence API.
5. Give your point of contact the powers and resources needed to comply. A lack of internal procedures is not a valid excuse for non-compliance.

Responding to an order

Service providers must be ready, in advance and at any time, to do the following:

• Preserve the data as soon as an order is received. On receipt of a production order, you must act expeditiously to preserve the data requested.
• Preserve for as long as the order requires.
• Produce within a deadline. Data must generally be transmitted within 10 days of receiving an order. In an emergency, data must be transmitted without undue delay and within eight (8) hours.
• Respond formally and without undue delay where you cannot comply.
• Keep orders and data confidential. You must secure the confidentiality and integrity of the order and the data and must refrain from informing the person whose data is requested.

The Consequences of Inaction

The PTS may issue an injunction ordering a service provider to take the measures needed to comply with the legislation, and this injunction may be combined with a conditional fine (Sw. vite). The PTS may also impose an administrative fee on a service provider that breaches any obligation. The fee ranges from a minimum of SEK 10,000 to a maximum of two percent of the service provider’s total global annual turnover for the preceding financial year. Liability is based on “strict liability”, meaning that no intent or negligence need be demonstrated for the fee to be imposed. Consequently, it is sufficient that the infringement occurred.

In addition, the Swedish Prosecution Authority may also impose administrative fees on designated establishments or legal representatives that fail to produce or preserve data. A designated establishment or legal representative and the service provider may be held jointly and severally liable for non-compliance.

Critical Deadlines: The Compliance Clock Is Running

1 July 2026 — EU Directive 2023/1544 entered into force. Service providers may register and designate a point of contact.

18 August 2026 — EU Regulation 2023/1543 enters into force. A designated establishment or legal representative must be in place and operationally capable of producing and preserving electronic evidence.

19 August 2026 — The PTS may begin monitoring service provider compliance and sanctions provisions enter into force.

Please feel free to reach out to us at Setterwalls if you have any questions or would like assistance.