{"id":2301,"date":"2026-04-10T08:00:00","date_gmt":"2026-04-10T07:00:00","guid":{"rendered":"https:\/\/ic-services.io\/resources\/blog\/e-evidence-vs-mlat\/"},"modified":"2026-10-21T14:21:57","modified_gmt":"2026-10-21T13:21:57","slug":"e-beweis-vs-mlat","status":"publish","type":"post","link":"https:\/\/ic-services.io\/de\/resources\/blog\/e-evidence-vs-mlat\/","title":{"rendered":"e-Evidence vs. MLAT: Was sich f\u00fcr Dienstleistungsanbieter in der EU ge\u00e4ndert hat"},"content":{"rendered":"

Until now, a prosecutor in France who needed data from a provider in Germany had to use judicial cooperation: since 2017 mainly the European Investigation Order (up to 120 days), and outside the EU, mutual legal assistance (MLA\/MLAT)<\/strong>, which takes about 10 months on average according to the European Commission. These channels worked \u2014 eventually \u2014 but they were built for paper-era investigations, not for cloud-era cybercrime, ransomware, online fraud or cross-border terrorism. By the time a provider finally received a request, suspects had often disappeared and ephemeral data had been lost.<\/p>\n\n\n\n

Die EU-Verordnung \u00fcber elektronische Beweismittel (EU) 2023\/1543<\/a><\/strong>, which has applied directly since 18. August 2026<\/strong>, fundamentally changes that picture. It adds a fast, harmonised, judicial-to-provider channel alongside the slower EIO and MLA routes, which operates in days \u2014 and in emergencies, in hours. For every electronic communications, hosting, cloud, marketplace and online platform provider operating in the EU, this is the most significant shift in cross-border evidence law in a generation.<\/p>\n\n\n\n

This article explains, in practical terms, what changed between the MLAT world and the e-Evidence world, what it means operationally, and how service providers should reshape their compliance programmes now that the Regulation applies.<\/p>\n\n\n\n

Die alte Welt: Wie MLATs funktionierten (und warum sie sich schwer taten)<\/h2>\n\n\n\n

Ein MLAT ist ein bilateraler oder multilateraler v\u00f6lkerrechtlicher Vertrag, der es einem Staat erm\u00f6glicht, einen anderen Staat um justizielle Zusammenarbeit - einschlie\u00dflich der Vorlage von Beweismitteln - zu ersuchen. In der Praxis verlief ein MLAT-Ersuchen zur Erlangung elektronischer Beweismittel \u00fcber einen langen, mehrstufigen Weg:<\/p>\n\n\n\n

    \n
  1. Ein Staatsanwalt in der Staat beantragen<\/strong> ein f\u00f6rmliches Rechtshilfeersuchen verfasst und an ihre nationale Zentralbeh\u00f6rde (in der Regel das Justizministerium) \u00fcbermittelt.<\/li>\n
  2. The Central Authority reviewed and translated the request, then forwarded it to its counterpart Central Authority (or, under some treaties, through diplomatic channels) in the Angeforderter Zustand<\/strong>.<\/li>\n
  3. Die empfangende Zentralbeh\u00f6rde \u00fcbermittelte das Ersuchen an ein \u00f6rtlich zust\u00e4ndiges Gericht oder einen Staatsanwalt.<\/li>\n
  4. Die \u00f6rtliche Beh\u00f6rde erlie\u00df eine innerstaatliche gerichtliche Anordnung gegen den Dienstleistungserbringer.<\/li>\n
  5. Der Anbieter produzierte die Daten, die dann in umgekehrter Reihenfolge durch dieselbe Kette zur\u00fcckgeschickt wurden.<\/li>\n<\/ol>\n\n\n\n

    Jeder Schritt verl\u00e4ngerte Wochen oder Monate. \u00dcbersetzungs- und Formalit\u00e4tsanforderungen f\u00fchrten zu weiteren Verz\u00f6gerungen. Bis der ersuchte Anbieter schlie\u00dflich eine vollstreckbare innerstaatliche Anordnung erhielt, waren die zugrunde liegenden Ermittlungen oft schon weiter vorangeschritten, die Daten konnten nicht mehr aufbewahrt werden, oder der Verd\u00e4chtige hatte eine andere Grenze \u00fcberschritten. Studien ergaben wiederholt durchschnittliche MLAT-Zykluszeiten von etwa 10 Monate<\/strong>, Viele F\u00e4lle erstrecken sich weit \u00fcber ein Jahr hinaus.<\/p>\n\n\n\n

    Die neue Welt: Direkte Anordnungen im Rahmen der EU-Verordnung \u00fcber elektronische Beweismittel<\/h2>\n\n\n\n

    Mit der e-Evidence-Verordnung werden zwei neue Instrumente eingef\u00fchrt - die European Production Order<\/strong> und die European Preservation Order<\/strong>, transmitted as standardised certificates (EPOC and EPOC-PR) \u2014 that judicial authorities can issue direkt an einen Dienstanbieter<\/strong> in another Member State, without going through diplomatic or governmental intermediaries. Orders travel through the EU’s decentralised IT system, whose Member State access points use e-CODEX<\/strong>. Providers connect to their Member State’s national system, either manually through the web-based interface or automatically through an API based on ETSI TS 104 144.<\/p>\n\n\n\n

    Nehmen wir dasselbe Szenario: Ein franz\u00f6sischer Staatsanwalt, der Ermittlungen zu Ransomware gegen Krankenh\u00e4user in der EU durchf\u00fchrt, ben\u00f6tigt Teilnehmerdaten und Verkehrsdaten<\/a> held by a German hosting provider. Under e-Evidence, the prosecutor has the order validated by a judge, issues a European Production Order and sends it directly to the provider’s designated establishment or legal representative; because traffic data are requested, the German enforcing authority is notified at the same time. The provider validates the order, extracts the data, and delivers it back through the decentralised IT system. Evidence larger than 25 MB, and any traffic with Member States whose national components are not yet live, goes by secure alternative means with a hash-protected manifest. Die normale Bearbeitungszeit betr\u00e4gt 10 Tage. Im Notfall betr\u00e4gt die Bearbeitungszeit 8 Stunden.<\/strong><\/p>\n\n\n\n

    e-Evidence vs. MLAT: Ein Seite-an-Seite-Vergleich<\/h2>\n\n\n\n
    Dimension<\/th>MLAT<\/th>EU-Verordnung \u00fcber elektronische Beweismittel (e-Evidence)<\/th><\/tr><\/thead>
    Rechtsgrundlage<\/strong><\/td>Bilateraler \/ multilateraler Vertrag<\/td>EU-Verordnung, direkt anwendbar<\/td><\/tr>
    Empf\u00e4nger der Anfrage<\/strong><\/td>Ausl\u00e4ndische staatliche Beh\u00f6rde<\/td>Provider’s designated establishment \/ legal representative (directly)<\/td><\/tr>
    \u00dcbertragungskanal<\/strong><\/td>Diplomatische \/ Zentrale Beh\u00f6rden<\/td>EU decentralised IT system (e-CODEX-based)<\/td><\/tr>
    Typischer Zeitrahmen<\/strong><\/td>MLA: ~10 months on average; EIO: up to 120 days<\/td>10 Tage Standard \/ 8 Stunden Notfall<\/td><\/tr>
    Format<\/strong><\/td>Rechtshilfeersuchen in freier Form<\/td>Standardisierte EPOC \/ EPOC-PR Zertifikate<\/td><\/tr>
    Die Rolle des Anbieters<\/strong><\/td>Empf\u00e4nger einer h\u00e4uslichen Anordnung<\/td>Direkter Adressat der ausl\u00e4ndischen Bestellung<\/td><\/tr>
    Sanktionen gegen Anbieter<\/strong><\/td>Innerstaatliches Recht des ersuchten Staates<\/td>Pecuniary penalties of up to 2% of total worldwide annual turnover of the preceding financial year<\/td><\/tr>
    Bewahrung der Daten<\/strong><\/td>Ad hoc, abh\u00e4ngig von der Rechtsprechung<\/td>Harmonisierte EPOC-PR (60 + 30 Tage)<\/td><\/tr>
    Geografischer Geltungsbereich<\/strong><\/td>Nur Staat-zu-Staat<\/td>Providers offering services in the EU (substantial connection); all Member States except Denmark<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    Was gleich bleibt - und wo MLATs noch wichtig sind<\/h2>\n\n\n\n

    Mit der e-Evidence-Verordnung werden die MLATs nicht abgeschafft. Sie sind nach wie vor der wichtigste Mechanismus f\u00fcr Beweismittelanfragen, die Nicht-EU-L\u00e4nder betreffen, und werden auch weiterhin in vielen strafrechtlichen Szenarien au\u00dferhalb des Anwendungsbereichs der Verordnung eingesetzt. Innerhalb der EU k\u00f6nnen sich Staatsanw\u00e4lte bei umfassenderen Ermittlungsma\u00dfnahmen auch weiterhin auf die Europ\u00e4ische Ermittlungsanordnung (EEA) gem\u00e4\u00df der Richtlinie 2014\/41\/EU st\u00fctzen. Die e-Evidence-Verordnung ist am besten zu verstehen als eine spezialisiertes, schnelleres Instrument<\/strong> f\u00fcr einen bestimmten Bedarf - die Erstellung und Aufbewahrung elektronischer Beweismittel - auf das bestehende Instrumentarium aufgesetzt.<\/p>\n\n\n\n

    F\u00fcr Dienstleistungserbringer aus Nicht-EU-L\u00e4ndern bedeutet dies in der Praxis, dass Anfragen von EU-Beh\u00f6rden zunehmend \u00fcber e-Evidence und nicht \u00fcber MLAT laufen werden - vorausgesetzt, der Dienstleistungserbringer bietet Dienstleistungen in der EU an und hat einen rechtlichen Vertreter in einem Mitgliedstaat oder benennt einen solchen.<\/p>\n\n\n\n

    Was dies f\u00fcr Dienstleister in der Praxis bedeutet<\/h2>\n\n\n\n

    Switching from a months-long cooperation process (about 10 months for MLA, up to 120 days for an EIO) to a 10-day (or 8-hour) direct process is not just faster \u2014 it is a different operating model. Compliance can no longer be a quarterly side-task handled by a single privacy lawyer. It has to be embedded into engineering, security operations and customer support. The implications fall into four broad areas.<\/p>\n\n\n\n

    1. Automatisierte Auftragsannahme und -validierung<\/h3>\n\n\n\n

    Manual mailbox-based intake will not scale. You need an authenticated connection to your Member State’s national system (via the web-based interface or an API based on ETSI TS 104 144) and an intake process that can receive, time-stamp, validate signatures, check issuing-authority credentials and route orders to the right responders. Solutions such as the ICS e-Evidence Compliance Plattform<\/a> sind genau f\u00fcr diesen Arbeitsablauf konzipiert, aber die Anbieter k\u00f6nnen sie auch selbst herstellen, wenn sie \u00fcber die technischen Kapazit\u00e4ten verf\u00fcgen.<\/p>\n\n\n\n

    2. Standardisierte Datenextraktion \u00fcber alle Systeme hinweg<\/h3>\n\n\n\n

    The Regulation distinguishes between subscriber, identification, traffic and content data, each with different thresholds. Your data inventory must map each system to the categories of data it holds, and your extraction tooling must deliver results through the decentralised IT system (web interface or the API based on ETSI TS 104 144) or, where that is not possible, by secure alternative means, always with integrity protection and in formats the issuing authority can process.<\/p>\n\n\n\n

    3. 24\/7-Einsatzbereitschaft<\/h3>\n\n\n\n

    Das 8-Stunden-Notfallfenster gilt zu jeder Tageszeit und an jedem Tag des Jahres. Dies erfordert einen benannten Bereitschaftsdienst von Juristen und Technikern, Runbooks, Eskalationspfade und einstudierte Tabletop-\u00dcbungen. F\u00fcr Organisationen, die diesen Aufwand intern nicht leisten k\u00f6nnen, ist ein Legal Representative service<\/a><\/strong> (for providers outside the EU), combined with managed operations, is increasingly the pragmatic answer.<\/p>\n\n\n\n

    4. Manipulationssichere Pr\u00fcfpfade<\/h3>\n\n\n\n

    Jeder Vorgang - Eingang, Validierung, interne Weiterleitung, Extraktion, \u00dcberpr\u00fcfung und Zustellung - muss in einem Pr\u00fcfpfad festgehalten werden, der aussagekr\u00e4ftig genug ist, um als Beweis zugelassen zu werden und im Nachhinein zu belegen, dass Sie die Fristen, die Minimierung und den spezifischen Umfang des Auftrags eingehalten haben.<\/p>\n\n\n\n

    Strafen: Warum die Lockerheit der MLAT-\u00c4ra verschwunden ist<\/h2>\n\n\n\n

    Under MLAT, friction in the system was tolerated because everyone \u2014 investigators, providers, courts \u2014 knew it was slow. The e-Evidence Regulation has no such slack. Member States are required to impose effective, proportionate and dissuasive penalties, with pecuniary penalties of up to 2% of the provider’s total worldwide annual turnover of the preceding financial year<\/strong>, imposed by the enforcing authority. Repeated or systemic failures can also trigger court orders, regulatory action by national competent authorities and serious reputational damage with enterprise customers and regulators.<\/p>\n\n\n\n

    Interaktion mit GDPR, NIS2 und dem Gesetz \u00fcber digitale Dienste<\/h2>\n\n\n\n

    e-Evidence does not override the GDPR. Disclosures must remain lawful, minimised and properly logged in records of processing. Where the provider is in scope of the NIS2 Directive, security controls and incident handling must also align with it, and intermediary service providers<\/a> (other than micro and small enterprises) must report orders received from Member State authorities in their DSA transparency reports. A modern compliance programme treats these regimes as overlapping rather than competing \u2014 the same intake, audit and minimisation infrastructure can serve all of them.<\/p>\n\n\n\n

    H\u00e4ufig gestellte Fragen<\/h2>\n\n\n\n

    Eine l\u00e4ngere Referenz finden Sie in unserer speziellen e-Evidence FAQ<\/a>.<\/p>\n\n\n\n

    Ersetzt die EU-Verordnung \u00fcber elektronische Beweismittel die MLATs?<\/h3>\n\n\n\n

    Nein. Er erg\u00e4nzt sie. MLATs bleiben in Kraft, insbesondere f\u00fcr die Zusammenarbeit mit Nicht-EU-L\u00e4ndern. Innerhalb der EU bietet e-Evidence einen schnelleren, spezialisierten Kanal f\u00fcr die Erstellung und Aufbewahrung elektronischer Beweismittel.<\/p>\n\n\n\n

    Kann ein Staatsanwalt in einem Mitgliedstaat wirklich Daten direkt bei einem Anbieter in einem anderen Mitgliedstaat anfordern?<\/h3>\n\n\n\n

    Yes. That is the central innovation of the Regulation. Subject to the safeguards and grounds for refusal in the Regulation, a competent judicial authority issues a European Production Order that the provider must execute directly, without first going through the authorities of the receiving State. For traffic and content data, that State’s enforcing authority is notified in parallel and has 10 days (96 hours in emergencies) to raise a ground for refusal.<\/p>\n\n\n\n

    Gilt e-Evidence auch f\u00fcr Nicht-EU-Anbieter?<\/h3>\n\n\n\n

    Yes \u2014 any provider offering services in the EU (with a substantial connection, such as a significant number of EU users or targeting EU markets) is in scope and must appoint a legal representative in a Member State where it offers services to receive and act on orders.<\/p>\n\n\n\n

    Was passiert, wenn meine Organisation die 8-Stunden-Frist nicht einhalten kann?<\/h3>\n\n\n\n

    Missed deadlines can lead to enforcement by the competent authority of the enforcing State, including fines of up to 2% of global annual turnover. If you cannot meet a deadline, report the reasons on the Annex III form before the deadline expires. Documented, proportionate efforts are your main mitigation.<\/p>\n\n\n\n

    Von der MLAT-\u00c4ra zu e-Evidence-Ready-Operationen<\/h2>\n\n\n\n

    Der \u00dcbergang von MLAT zu e-Evidence ist im Kern ein \u00dcbergang von gelegentlich, langsam, papiergest\u00fctzt<\/em> Zusammenarbeit mit kontinuierlich, schnell, softwaregesteuert<\/em> cooperation. Service providers that thrived under the MLAT model \u2014 relying on legacy email queues and ad-hoc legal review \u2014 are already struggling now that the Regulation applies. Those that invest now in e-Evidence-f\u00e4hige Compliance-Vorg\u00e4nge<\/a> werden nicht nur Strafen vermeiden, sondern auch die Bereitschaft zur Strafverfolgung in ein Vertrauenssignal f\u00fcr Unternehmenskunden und Aufsichtsbeh\u00f6rden verwandeln.<\/p>\n\n\n\n

    Wenn Sie eine unabh\u00e4ngige Bewertung Ihrer Bereitschaft w\u00fcnschen, bietet ICS eine vollst\u00e4ndige Bewertung der Einhaltung von e-Evidence<\/a><\/strong> covering legal scope, technical infrastructure and operational processes \u2014 together with a clear roadmap to close any gaps now that the Regulation applies. Kontaktieren Sie ICS heute<\/strong><\/a> um Ihren Termin zu vereinbaren.<\/p>","protected":false},"excerpt":{"rendered":"

    Until now, a prosecutor in France who needed data from a provider in Germany had to use judicial cooperation: since […]<\/p>\n","protected":false},"author":7,"featured_media":2556,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_uag_custom_page_level_css":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2301","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-buyers-guides-comparisons"],"uagb_featured_image_src":{"full":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/e-evidence-vs-mlat.jpg",1600,2133,false],"thumbnail":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/e-evidence-vs-mlat-150x150.jpg",150,150,true],"medium":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/e-evidence-vs-mlat-225x300.jpg",225,300,true],"medium_large":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/e-evidence-vs-mlat-768x1024.jpg",768,1024,true],"large":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/e-evidence-vs-mlat-768x1024.jpg",768,1024,true],"1536x1536":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/e-evidence-vs-mlat-1152x1536.jpg",1152,1536,true],"2048x2048":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/e-evidence-vs-mlat-1536x2048.jpg",1536,2048,true],"trp-custom-language-flag":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/e-evidence-vs-mlat-9x12.jpg",9,12,true]},"uagb_author_info":{"display_name":"David Son","author_link":"https:\/\/ic-services.io\/de\/author\/david\/"},"uagb_comment_info":0,"uagb_excerpt":"Until now, a prosecutor in France who needed data from a provider in Germany had to use judicial cooperation: since […]","_links":{"self":[{"href":"https:\/\/ic-services.io\/de\/wp-json\/wp\/v2\/posts\/2301","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ic-services.io\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ic-services.io\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ic-services.io\/de\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/ic-services.io\/de\/wp-json\/wp\/v2\/comments?post=2301"}],"version-history":[{"count":6,"href":"https:\/\/ic-services.io\/de\/wp-json\/wp\/v2\/posts\/2301\/revisions"}],"predecessor-version":[{"id":2740,"href":"https:\/\/ic-services.io\/de\/wp-json\/wp\/v2\/posts\/2301\/revisions\/2740"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ic-services.io\/de\/wp-json\/wp\/v2\/media\/2556"}],"wp:attachment":[{"href":"https:\/\/ic-services.io\/de\/wp-json\/wp\/v2\/media?parent=2301"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ic-services.io\/de\/wp-json\/wp\/v2\/categories?post=2301"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ic-services.io\/de\/wp-json\/wp\/v2\/tags?post=2301"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}