{"id":2301,"date":"2026-04-10T08:00:00","date_gmt":"2026-04-10T07:00:00","guid":{"rendered":"https:\/\/ic-services.io\/resources\/blog\/e-evidence-vs-mlat\/"},"modified":"2026-10-21T14:21:57","modified_gmt":"2026-10-21T13:21:57","slug":"e-evidence-vs-mlat","status":"publish","type":"post","link":"https:\/\/ic-services.io\/pt\/resources\/blog\/e-evidence-vs-mlat\/","title":{"rendered":"Provas electr\u00f3nicas vs. MLAT: O que mudou para os prestadores de servi\u00e7os na UE"},"content":{"rendered":"

Until now, a prosecutor in France who needed data from a provider in Germany had to use judicial cooperation: since 2017 mainly the European Investigation Order (up to 120 days), and outside the EU, mutual legal assistance (MLA\/MLAT)<\/strong>, which takes about 10 months on average according to the European Commission. These channels worked \u2014 eventually \u2014 but they were built for paper-era investigations, not for cloud-era cybercrime, ransomware, online fraud or cross-border terrorism. By the time a provider finally received a request, suspects had often disappeared and ephemeral data had been lost.<\/p>\n\n\n\n

O Regulamento (UE) 2023\/1543 relativo \u00e0s provas electr\u00f3nicas<\/a><\/strong>, which has applied directly since 18 de agosto de 2026<\/strong>, fundamentally changes that picture. It adds a fast, harmonised, judicial-to-provider channel alongside the slower EIO and MLA routes, which operates in days \u2014 and in emergencies, in hours. For every electronic communications, hosting, cloud, marketplace and online platform provider operating in the EU, this is the most significant shift in cross-border evidence law in a generation.<\/p>\n\n\n\n

This article explains, in practical terms, what changed between the MLAT world and the e-Evidence world, what it means operationally, and how service providers should reshape their compliance programmes now that the Regulation applies.<\/p>\n\n\n\n

O Velho Mundo: Como funcionavam os MLATs (e porque \u00e9 que tiveram dificuldades)<\/h2>\n\n\n\n

Um MLAT \u00e9 um tratado bilateral ou multilateral de direito internacional p\u00fablico que permite a um Estado solicitar coopera\u00e7\u00e3o judici\u00e1ria - incluindo a produ\u00e7\u00e3o de provas - a outro Estado. Na pr\u00e1tica, um pedido de MLAT para obter provas electr\u00f3nicas seguia um caminho longo e em v\u00e1rias fases:<\/p>\n\n\n\n

    \n
  1. Um procurador do Minist\u00e9rio P\u00fablico Estado requerente<\/strong> redigiram uma carta rogat\u00f3ria formal e apresentaram-na \u00e0 sua autoridade central nacional (normalmente o Minist\u00e9rio da Justi\u00e7a).<\/li>\n
  2. The Central Authority reviewed and translated the request, then forwarded it to its counterpart Central Authority (or, under some treaties, through diplomatic channels) in the Estado requerido<\/strong>.<\/li>\n
  3. A autoridade central recetora transmitiu o pedido a um tribunal local competente ou a um procurador.<\/li>\n
  4. A autoridade local emitiu uma ordem judicial interna contra o prestador de servi\u00e7os.<\/li>\n
  5. O fornecedor produziu os dados, que foram depois reencaminhados atrav\u00e9s da mesma cadeia em sentido inverso.<\/li>\n<\/ol>\n\n\n\n

    Cada passo acrescentava semanas ou meses. As exig\u00eancias de tradu\u00e7\u00e3o e de formalidade aumentavam ainda mais o atraso. Na altura em que o fornecedor solicitado recebia finalmente uma ordem interna execut\u00f3ria, a investiga\u00e7\u00e3o subjacente tinha muitas vezes mudado, os dados podiam ter ultrapassado as janelas de reten\u00e7\u00e3o ou o suspeito tinha atravessado outra fronteira. Os estudos revelaram repetidamente que os tempos m\u00e9dios dos ciclos MLAT s\u00e3o de cerca de 10 meses<\/strong>, Em muitos casos, o per\u00edodo de vig\u00eancia \u00e9 muito superior a um ano.<\/p>\n\n\n\n

    O novo mundo: Ordens diretas ao abrigo do regulamento da UE relativo \u00e0s provas electr\u00f3nicas<\/h2>\n\n\n\n

    O regulamento relativo \u00e0s provas electr\u00f3nicas introduz dois novos instrumentos - o European Production Order<\/strong> e o European Preservation Order<\/strong>, transmitted as standardised certificates (EPOC and EPOC-PR) \u2014 that judicial authorities can issue diretamente a um prestador de servi\u00e7os<\/strong> in another Member State, without going through diplomatic or governmental intermediaries. Orders travel through the EU’s decentralised IT system, whose Member State access points use e-CODEX<\/strong>. Providers connect to their Member State’s national system, either manually through the web-based interface or automatically through an API based on ETSI TS 104 144.<\/p>\n\n\n\n

    Take the same scenario: a French prosecutor investigating ransomware targeting EU hospitals needs subscriber and dados de tr\u00e1fego<\/a> held by a German hosting provider. Under e-Evidence, the prosecutor has the order validated by a judge, issues a European Production Order and sends it directly to the provider’s designated establishment or legal representative; because traffic data are requested, the German enforcing authority is notified at the same time. The provider validates the order, extracts the data, and delivers it back through the decentralised IT system. Evidence larger than 25 MB, and any traffic with Member States whose national components are not yet live, goes by secure alternative means with a hash-protected manifest. O prazo de entrega normal \u00e9 de 10 dias. O prazo de entrega de emerg\u00eancia \u00e9 de 8 horas.<\/strong><\/p>\n\n\n\n

    e-Evidence vs MLAT: Uma compara\u00e7\u00e3o lado a lado<\/h2>\n\n\n\n
    Dimens\u00e3o<\/th>MLAT<\/th>Regulamento da UE relativo \u00e0s provas electr\u00f3nicas<\/th><\/tr><\/thead>
    Base jur\u00eddica<\/strong><\/td>Tratado bilateral \/ multilateral<\/td>Regulamento da UE, diretamente aplic\u00e1vel<\/td><\/tr>
    Destinat\u00e1rio do pedido<\/strong><\/td>Autoridade de um Estado estrangeiro<\/td>Provider’s designated establishment \/ legal representative (directly)<\/td><\/tr>
    Canal de transmiss\u00e3o<\/strong><\/td>Autoridades diplom\u00e1ticas \/ centrais<\/td>EU decentralised IT system (e-CODEX-based)<\/td><\/tr>
    Prazo t\u00edpico<\/strong><\/td>MLA: ~10 months on average; EIO: up to 120 days<\/td>10 dias normal \/ 8 horas de emerg\u00eancia<\/td><\/tr>
    Formato<\/strong><\/td>Carta rogat\u00f3ria em formato livre<\/td>Certificados normalizados EPOC \/ EPOC-PR<\/td><\/tr>
    Papel do prestador<\/strong><\/td>Benefici\u00e1rio de uma ordem dom\u00e9stica<\/td>Destinat\u00e1rio direto da encomenda estrangeira<\/td><\/tr>
    San\u00e7\u00f5es aos prestadores<\/strong><\/td>Direito interno do Estado requerido<\/td>Pecuniary penalties of up to 2% of total worldwide annual turnover of the preceding financial year<\/td><\/tr>
    Preserva\u00e7\u00e3o dos dados<\/strong><\/td>Ad hoc, dependente da jurisdi\u00e7\u00e3o<\/td>COEEIE-PR harmonizado (60 + 30 dias)<\/td><\/tr>
    \u00c2mbito geogr\u00e1fico<\/strong><\/td>Apenas de Estado para Estado<\/td>Providers offering services in the EU (substantial connection); all Member States except Denmark<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    O que permanece inalterado - e onde os MLATs ainda s\u00e3o importantes<\/h2>\n\n\n\n

    O regulamento relativo \u00e0s provas electr\u00f3nicas n\u00e3o suprime os MLAT. Estes continuam a ser o principal mecanismo para os pedidos de provas que envolvem pa\u00edses n\u00e3o pertencentes \u00e0 UE e continuam a aplicar-se em muitos cen\u00e1rios de justi\u00e7a penal fora do \u00e2mbito de aplica\u00e7\u00e3o do regulamento. Dentro da UE, os procuradores podem tamb\u00e9m continuar a recorrer \u00e0 Ordem de Investiga\u00e7\u00e3o Europeia (OEI) ao abrigo da Diretiva 2014\/41\/UE para medidas de investiga\u00e7\u00e3o mais amplas. O Regulamento sobre provas electr\u00f3nicas \u00e9 melhor entendido como um instrumento especializado e mais r\u00e1pido<\/strong> para uma necessidade espec\u00edfica - produ\u00e7\u00e3o e preserva\u00e7\u00e3o de provas electr\u00f3nicas - sobrepostas ao conjunto de ferramentas existente.<\/p>\n\n\n\n

    Para os prestadores de servi\u00e7os n\u00e3o pertencentes \u00e0 UE, o efeito pr\u00e1tico \u00e9 que os pedidos das autoridades da UE ser\u00e3o cada vez mais apresentados atrav\u00e9s de provas electr\u00f3nicas em vez de MLAT - desde que o prestador ofere\u00e7a servi\u00e7os na UE e tenha, ou nomeie, um representante legal num Estado-Membro.<\/p>\n\n\n\n

    O que isto significa para os prestadores de servi\u00e7os na pr\u00e1tica<\/h2>\n\n\n\n

    Switching from a months-long cooperation process (about 10 months for MLA, up to 120 days for an EIO) to a 10-day (or 8-hour) direct process is not just faster \u2014 it is a different operating model. Compliance can no longer be a quarterly side-task handled by a single privacy lawyer. It has to be embedded into engineering, security operations and customer support. The implications fall into four broad areas.<\/p>\n\n\n\n

    1. Registo e valida\u00e7\u00e3o automatizados de encomendas<\/h3>\n\n\n\n

    Manual mailbox-based intake will not scale. You need an authenticated connection to your Member State’s national system (via the web-based interface or an API based on ETSI TS 104 144) and an intake process that can receive, time-stamp, validate signatures, check issuing-authority credentials and route orders to the right responders. Solutions such as the ICS Plataforma de conformidade de provas electr\u00f3nicas<\/a> s\u00e3o constru\u00eddos precisamente para este fluxo de trabalho, mas os fornecedores podem tamb\u00e9m constru\u00ed-los internamente se tiverem capacidade de engenharia.<\/p>\n\n\n\n

    2. Extra\u00e7\u00e3o de dados normalizada em todos os sistemas<\/h3>\n\n\n\n

    The Regulation distinguishes between subscriber, identification, traffic and content data, each with different thresholds. Your data inventory must map each system to the categories of data it holds, and your extraction tooling must deliver results through the decentralised IT system (web interface or the API based on ETSI TS 104 144) or, where that is not possible, by secure alternative means, always with integrity protection and in formats the issuing authority can process.<\/p>\n\n\n\n

    3. Prontid\u00e3o operacional 24\/7<\/h3>\n\n\n\n

    O per\u00edodo de emerg\u00eancia de 8 horas aplica-se a qualquer hora do dia, em qualquer dia do ano. Para isso, s\u00e3o necess\u00e1rios respons\u00e1veis legais e de engenharia de plant\u00e3o, manuais, caminhos de escalonamento e exerc\u00edcios de mesa ensaiados. Para as organiza\u00e7\u00f5es que n\u00e3o podem sustentar essa pegada internamente, uma Legal Representative service<\/a><\/strong> (for providers outside the EU), combined with managed operations, is increasingly the pragmatic answer.<\/p>\n\n\n\n

    4. Pistas de auditoria inviol\u00e1veis<\/h3>\n\n\n\n

    Cada a\u00e7\u00e3o - rece\u00e7\u00e3o, valida\u00e7\u00e3o, encaminhamento interno, extra\u00e7\u00e3o, revis\u00e3o e entrega - deve ser capturada numa pista de auditoria suficientemente forte para ser admitida como prova e para demonstrar, a posteriori, que cumpriu os prazos, a minimiza\u00e7\u00e3o e o \u00e2mbito espec\u00edfico da encomenda.<\/p>\n\n\n\n

    Penalidades: Porque \u00e9 que a folga da era MLAT desapareceu<\/h2>\n\n\n\n

    Under MLAT, friction in the system was tolerated because everyone \u2014 investigators, providers, courts \u2014 knew it was slow. The e-Evidence Regulation has no such slack. Member States are required to impose effective, proportionate and dissuasive penalties, with pecuniary penalties of up to 2% of the provider’s total worldwide annual turnover of the preceding financial year<\/strong>, imposed by the enforcing authority. Repeated or systemic failures can also trigger court orders, regulatory action by national competent authorities and serious reputational damage with enterprise customers and regulators.<\/p>\n\n\n\n

    Intera\u00e7\u00e3o com o RGPD, o NIS2 e a Lei dos Servi\u00e7os Digitais<\/h2>\n\n\n\n

    e-Evidence does not override the GDPR. Disclosures must remain lawful, minimised and properly logged in records of processing. Where the provider is in scope of the NIS2 Directive, security controls and incident handling must also align with it, and intermediary service providers<\/a> (other than micro and small enterprises) must report orders received from Member State authorities in their DSA transparency reports. A modern compliance programme treats these regimes as overlapping rather than competing \u2014 the same intake, audit and minimisation infrastructure can serve all of them.<\/p>\n\n\n\n

    Perguntas mais frequentes<\/h2>\n\n\n\n

    Para uma refer\u00eancia mais longa, consulte a nossa sec\u00e7\u00e3o dedicada FAQ da e-Evidence<\/a>.<\/p>\n\n\n\n

    O regulamento da UE relativo \u00e0 prova eletr\u00f3nica substitui os MLAT?<\/h3>\n\n\n\n

    N\u00e3o. Complementa-os. Os MLAT continuam em vigor, nomeadamente no que respeita \u00e0 coopera\u00e7\u00e3o com pa\u00edses terceiros. Dentro da UE, as provas electr\u00f3nicas oferecem um canal mais r\u00e1pido e especializado para a produ\u00e7\u00e3o e preserva\u00e7\u00e3o de provas electr\u00f3nicas.<\/p>\n\n\n\n

    Pode realmente um procurador de um Estado-Membro encomendar dados diretamente a um fornecedor de outro Estado-Membro?<\/h3>\n\n\n\n

    Yes. That is the central innovation of the Regulation. Subject to the safeguards and grounds for refusal in the Regulation, a competent judicial authority issues a European Production Order that the provider must execute directly, without first going through the authorities of the receiving State. For traffic and content data, that State’s enforcing authority is notified in parallel and has 10 days (96 hours in emergencies) to raise a ground for refusal.<\/p>\n\n\n\n

    As provas electr\u00f3nicas aplicam-se a prestadores n\u00e3o comunit\u00e1rios?<\/h3>\n\n\n\n

    Yes \u2014 any provider offering services in the EU (with a substantial connection, such as a significant number of EU users or targeting EU markets) is in scope and must appoint a legal representative in a Member State where it offers services to receive and act on orders.<\/p>\n\n\n\n

    O que acontece se a minha organiza\u00e7\u00e3o n\u00e3o conseguir cumprir o prazo de 8 horas?<\/h3>\n\n\n\n

    Missed deadlines can lead to enforcement by the competent authority of the enforcing State, including fines of up to 2% of global annual turnover. If you cannot meet a deadline, report the reasons on the Annex III form before the deadline expires. Documented, proportionate efforts are your main mitigation.<\/p>\n\n\n\n

    Da conformidade com a era MLAT \u00e0s opera\u00e7\u00f5es preparadas para a prova eletr\u00f3nica<\/h2>\n\n\n\n

    A passagem do MLAT para o e-Evidence \u00e9, no fundo, uma passagem do ocasional, lenta, baseada em papel<\/em> coopera\u00e7\u00e3o para cont\u00ednuo, r\u00e1pido, orientado para o software<\/em> cooperation. Service providers that thrived under the MLAT model \u2014 relying on legacy email queues and ad-hoc legal review \u2014 are already struggling now that the Regulation applies. Those that invest now in Opera\u00e7\u00f5es de conformidade preparadas para a prova eletr\u00f3nica<\/a> n\u00e3o se limitar\u00e3o a evitar san\u00e7\u00f5es; transformar\u00e3o a prepara\u00e7\u00e3o para a aplica\u00e7\u00e3o da lei num sinal de confian\u00e7a para os clientes e reguladores das empresas.<\/p>\n\n\n\n

    Se pretender uma avalia\u00e7\u00e3o independente do seu grau de prepara\u00e7\u00e3o, o ICS oferece um servi\u00e7o completo de Avalia\u00e7\u00e3o da conformidade da e-Evidence<\/a><\/strong> covering legal scope, technical infrastructure and operational processes \u2014 together with a clear roadmap to close any gaps now that the Regulation applies. Contactar o ICS hoje<\/strong><\/a> para marcar a sua.<\/p>","protected":false},"excerpt":{"rendered":"

    Until now, a prosecutor in France who needed data from a provider in Germany had to use judicial cooperation: since […]<\/p>\n","protected":false},"author":7,"featured_media":2556,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_uag_custom_page_level_css":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2301","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-buyers-guides-comparisons"],"uagb_featured_image_src":{"full":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/e-evidence-vs-mlat.jpg",1600,2133,false],"thumbnail":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/e-evidence-vs-mlat-150x150.jpg",150,150,true],"medium":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/e-evidence-vs-mlat-225x300.jpg",225,300,true],"medium_large":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/e-evidence-vs-mlat-768x1024.jpg",768,1024,true],"large":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/e-evidence-vs-mlat-768x1024.jpg",768,1024,true],"1536x1536":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/e-evidence-vs-mlat-1152x1536.jpg",1152,1536,true],"2048x2048":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/e-evidence-vs-mlat-1536x2048.jpg",1536,2048,true],"trp-custom-language-flag":["https:\/\/ic-services.io\/wp-content\/uploads\/2026\/09\/e-evidence-vs-mlat-9x12.jpg",9,12,true]},"uagb_author_info":{"display_name":"David Son","author_link":"https:\/\/ic-services.io\/pt\/author\/david\/"},"uagb_comment_info":0,"uagb_excerpt":"Until now, a prosecutor in France who needed data from a provider in Germany had to use judicial cooperation: since […]","_links":{"self":[{"href":"https:\/\/ic-services.io\/pt\/wp-json\/wp\/v2\/posts\/2301","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ic-services.io\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ic-services.io\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ic-services.io\/pt\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/ic-services.io\/pt\/wp-json\/wp\/v2\/comments?post=2301"}],"version-history":[{"count":6,"href":"https:\/\/ic-services.io\/pt\/wp-json\/wp\/v2\/posts\/2301\/revisions"}],"predecessor-version":[{"id":2740,"href":"https:\/\/ic-services.io\/pt\/wp-json\/wp\/v2\/posts\/2301\/revisions\/2740"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ic-services.io\/pt\/wp-json\/wp\/v2\/media\/2556"}],"wp:attachment":[{"href":"https:\/\/ic-services.io\/pt\/wp-json\/wp\/v2\/media?parent=2301"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ic-services.io\/pt\/wp-json\/wp\/v2\/categories?post=2301"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ic-services.io\/pt\/wp-json\/wp\/v2\/tags?post=2301"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}