Until now, a prosecutor in France who needed data from a provider in Germany had to use judicial cooperation: since 2017 mainly the European Investigation Order (up to 120 days), and outside the EU, mutual legal assistance (MLA/MLAT), which takes about 10 months on average according to the European Commission. These channels worked — eventually — but they were built for paper-era investigations, not for cloud-era cybercrime, ransomware, online fraud or cross-border terrorism. By the time a provider finally received a request, suspects had often disappeared and ephemeral data had been lost.
"(《世界人权宣言》) 欧盟电子证据条例（EU）2023/1543, which has applied directly since 2026 年 8 月 18 日, fundamentally changes that picture. It adds a fast, harmonised, judicial-to-provider channel alongside the slower EIO and MLA routes, which operates in days — and in emergencies, in hours. For every electronic communications, hosting, cloud, marketplace and online platform provider operating in the EU, this is the most significant shift in cross-border evidence law in a generation.
This article explains, in practical terms, what changed between the MLAT world and the e-Evidence world, what it means operationally, and how service providers should reshape their compliance programmes now that the Regulation applies.
旧世界：多边协议如何运作（以及为何举步维艰）
多边条约是国际公法下的双边或多边条约，使一国能够请求另一国提供司法合作，包括提供证据。在实践中，获取电子证据的多边条约请求需要经过漫长的多阶段过程：
- 一名检察官在 请求国 起草正式调查委托书，并将其提交给本国中央机构（通常是司法部）。.
- The Central Authority reviewed and translated the request, then forwarded it to its counterpart Central Authority (or, under some treaties, through diplomatic channels) in the 请求国.
- 接收申请的中央机构将申请转交当地主管法院或检察官。.
- 地方当局对服务提供商发出了国内法律令。.
- 提供商生成数据，然后通过相同的链条反向传回。.
每个步骤都会增加几周或几个月的时间。翻译和手续要求进一步拖延了时间。当被请求的提供方最终收到可执行的国内命令时，相关调查往往已经转移，数据可能已经过了保存期限，或者嫌疑人已经越过了另一个边界。研究一再发现，MLAT 的平均周期时间约为 10 个月, 在许多情况下，时间远远超过一年。.
新世界：欧盟电子证据法规下的直接命令
电子证据条例》引入了两项新文书--"电子证据 "和 "电子证据"。 European Production Order 和 European Preservation Order, transmitted as standardised certificates (EPOC and EPOC-PR) — that judicial authorities can issue 直接与服务提供商联系 in another Member State, without going through diplomatic or governmental intermediaries. Orders travel through the EU’s decentralised IT system, whose Member State access points use e-CODEX. Providers connect to their Member State’s national system, either manually through the web-based interface or automatically through an API based on ETSI TS 104 144.
以同一情景为例：一名法国检察官正在调查针对欧盟医院的勒索软件案件，他需要订阅者和 流量数据 held by a German hosting provider. Under e-Evidence, the prosecutor has the order validated by a judge, issues a European Production Order and sends it directly to the provider’s designated establishment or legal representative; because traffic data are requested, the German enforcing authority is notified at the same time. The provider validates the order, extracts the data, and delivers it back through the decentralised IT system. Evidence larger than 25 MB, and any traffic with Member States whose national components are not yet live, goes by secure alternative means with a hash-protected manifest. 标准周转期为 10 天。紧急周转为 8 小时。.
e-Evidence 与 MLAT：并排比较
| 尺寸 | MLAT | 欧盟电子证据条例 |
|---|---|---|
| 法律依据 | 双边/多边条约 | 欧盟条例，直接适用 |
| 请求接收人 | 外国当局 | Provider’s designated establishment / legal representative (directly) |
| 传输通道 | 外交/中央机构 | EU decentralised IT system (e-CODEX-based) |
| 典型时间框架 | MLA: ~10 months on average; EIO: up to 120 days | 10 天标准时间/8 小时紧急时间 |
| 格式 | 自由格式调查委托书 | 标准化 EPOC / EPOC-PR 证书 |
| 提供方的作用 | 家庭命令的接受者 | 外国订单的直接收件人 |
| 对供应商的制裁 | 被请求国的国内法 | Pecuniary penalties of up to 2% of total worldwide annual turnover of the preceding financial year |
| 数据保存 | 临时性，取决于管辖范围 | 统一 EPOC-PR（60 + 30 天） |
| 地理范围 | 仅限国与国之间 | Providers offering services in the EU (substantial connection); all Member States except Denmark |
哪些方面保持不变--《多边投资协定》在哪些方面仍然重要
电子证据条例》并没有废除《多边条约》。它们仍然是涉及非欧盟国家的证据请求的主要机制，并继续适用于条例范围之外的许多刑事司法场景。在欧盟内部，检察官仍可依据第 2014/41/EU 号指令下的欧洲调查令（EIO）采取更广泛的调查措施。电子证据条例最好理解为 更快的专用仪器 在现有工具包的基础上，针对一种特定需求--制作和保存电子证据--进行分层。.
对非欧盟服务提供商而言，实际效果是欧盟当局的请求将越来越多地通过电子证据而非 MLAT 提出--前提是提供商在欧盟提供服务，并在某成员国设有或任命了法律代表。.
这对服务提供商的实际意义
Switching from a months-long cooperation process (about 10 months for MLA, up to 120 days for an EIO) to a 10-day (or 8-hour) direct process is not just faster — it is a different operating model. Compliance can no longer be a quarterly side-task handled by a single privacy lawyer. It has to be embedded into engineering, security operations and customer support. The implications fall into four broad areas.
1.自动接收和验证订单
Manual mailbox-based intake will not scale. You need an authenticated connection to your Member State’s national system (via the web-based interface or an API based on ETSI TS 104 144) and an intake process that can receive, time-stamp, validate signatures, check issuing-authority credentials and route orders to the right responders. Solutions such as the ICS 电子证据合规平台 但如果供应商具备工程设计能力，也可以在内部构建。.
2.跨系统的标准化数据提取
The Regulation distinguishes between subscriber, identification, traffic and content data, each with different thresholds. Your data inventory must map each system to the categories of data it holds, and your extraction tooling must deliver results through the decentralised IT system (web interface or the API based on ETSI TS 104 144) or, where that is not possible, by secure alternative means, always with integrity protection and in formats the issuing authority can process.
3.全天候运行准备
8 小时紧急窗口适用于全年任何一天的任何时间。这就需要指定待命的法律和工程响应人员、运行手册、升级路径和演练过的桌面演习。对于无法在内部维持这种规模的组织而言，可以通过 Legal Representative service (for providers outside the EU), combined with managed operations, is increasingly the pragmatic answer.
4.防篡改审计跟踪
每项操作--接收、验证、内部路由、提取、审查和交付--都必须记录在审计跟踪中，以便作为证据，并在事后证明您遵守了期限、最小化和订单的具体范围。.
处罚：为什么《多边投资协定》时代的松懈已不复存在？
Under MLAT, friction in the system was tolerated because everyone — investigators, providers, courts — knew it was slow. The e-Evidence Regulation has no such slack. Member States are required to impose effective, proportionate and dissuasive penalties, with pecuniary penalties of up to 2% of the provider’s total worldwide annual turnover of the preceding financial year, imposed by the enforcing authority. Repeated or systemic failures can also trigger court orders, regulatory action by national competent authorities and serious reputational damage with enterprise customers and regulators.
与 GDPR、NIS2 和数字服务法的互动
e-Evidence does not override the GDPR. Disclosures must remain lawful, minimised and properly logged in records of processing. Where the provider is in scope of the NIS2 Directive, security controls and incident handling must also align with it, and intermediary service providers (other than micro and small enterprises) must report orders received from Member State authorities in their DSA transparency reports. A modern compliance programme treats these regimes as overlapping rather than competing — the same intake, audit and minimisation infrastructure can serve all of them.
常见问题
如需更详细的参考资料，请参阅我们的 电子证据常见问题.
欧盟电子证据条例》是否取代了 MLAT？
不，它是对它们的补充。特别是在与非欧盟国家的合作方面，《多边条约》仍然有效。在欧盟内部，电子证据为电子证据的制作和保存提供了更快捷的专业渠道。.
一个会员国的检察官真的可以直接向另一个会员国的提供商订购数据吗？
Yes. That is the central innovation of the Regulation. Subject to the safeguards and grounds for refusal in the Regulation, a competent judicial authority issues a European Production Order that the provider must execute directly, without first going through the authorities of the receiving State. For traffic and content data, that State’s enforcing authority is notified in parallel and has 10 days (96 hours in emergencies) to raise a ground for refusal.
电子证据是否适用于非欧盟供应商？
Yes — any provider offering services in the EU (with a substantial connection, such as a significant number of EU users or targeting EU markets) is in scope and must appoint a legal representative in a Member State where it offers services to receive and act on orders.
如果我的组织无法在 8 小时期限内完成任务，该怎么办？
Missed deadlines can lead to enforcement by the competent authority of the enforcing State, including fines of up to 2% of global annual turnover. If you cannot meet a deadline, report the reasons on the Annex III form before the deadline expires. Documented, proportionate efforts are your main mitigation.
从 MLAT 时代的合规到电子证据就绪的运营
从《多边条约》到电子证据的转变，其核心是从 偶尔、缓慢、纸张驱动 合作 连续、快速、软件驱动 cooperation. Service providers that thrived under the MLAT model — relying on legacy email queues and ad-hoc legal review — are already struggling now that the Regulation applies. Those that invest now in 电子证据就绪的合规操作 这不仅能避免处罚，还能将执法准备转化为企业客户和监管机构的信任信号。.
如果您希望对您的准备情况进行独立评估，ICS 可提供完整的 电子证据合规性评估 covering legal scope, technical infrastructure and operational processes — together with a clear roadmap to close any gaps now that the Regulation applies. 立即联系 ICS 安排您的日程。.
