Swiss service providers face EU e-Evidence framework obligations in the EU market; cross-border data requests clash with Swiss law.

Swiss service providers face EU e-Evidence framework obligations in the EU market; cross-border data requests clash with Swiss law.

Basel | Bern | Geneva | Lausanne | Lugano | Zurich walderwyss.com Walder Wyss Newsletter | 228 The New EU e-Evidence Fra- mework: Cross-Border Super- powers for EU Authorities in Criminal Proceedings The EU‘s new e-Evidence framework allows authorities in EU Member States to request electronic evidence for criminal proceedings directly from certain service providers, including if established outside the EU. As the regime becomes applicable on 18 August 2026, Swiss compa- nies active in the EU market may face new compliance obligations and potentially difficult questions at the intersection of EU and Swiss law.

2 Walder Wyss Newsletter 228 | July 2026 The EU e-Evidence framework may also affect Swiss providers of- fering certain digital services in the EU market. Although important questions remain unresolved, Swiss service providers that receive a European Production Order may face a difficult situation: compliance may be required under EU law, while the direct disclosure of informa- tion to foreign authorities may raise issues under Swiss law. SIMONE SCHÜRCH MLaw, LL.M., CIPP/E, Attorney at Law Senior Associate Phone +41 58 658 44 43 simone.schuerch@walderwyss.com ANDREA MENON MLaw, Attorney at Law Associate Phone +41 58 658 44 47 andrea.menon@walderwyss.com Swiss Service Providers May Fall Within the Scope of The New e-Evidence Framework

1. The EU e-Evidence Framework Has Arrived The EU e-Evidence framework consists of Regulation (EU) 2023/1543 on Euro- pean Production Orders and European Preservation Orders for electronic evi- dence in criminal proceedings and for the execution of custodial sentences following criminal proceedings (the “Re- gulation“), and Directive (EU) 2023/1544 on the designation of designated estab- lishments and the appointment of legal representatives for the purpose of gat- hering electronic evidence in criminal proceedings (the “Directive“). Adopted in 2023, the e-Evidence frame- work is now becoming operational. EU Member States were required to trans- pose the Directive by 18 February 2026, while the Regulation becomes applica- ble on 18 August 2026. At the heart of the new regime are two tools available to EU authorities for cri- minal proceedings. The first, the Euro- pean Production Order, enables aut- horities to obtain electronic evidence directly from certain service providers (Art. 5 Regulation). The second, the Eu- ropean Preservation Order, enables authorities to require providers to pre- serve data so that it remains available for future disclosure (Art. 6 Regulation). In some respects, these new tools can be seen as the EU‘s response to de- velopments such as the US CLOUD Act, reflecting a broader international trend towards facilitating direct cross-border access to electronic evidence held by service providers. Depending on the services offered and their degree of connection to the EU market, Swiss-based providers may find themselves subject to these obligations despite having no legal presence within the EU.
2. Service Providers Potentially Affec- ted Whether a specific service provider is affected depends on the nature of the services it offers. The Regulation distin- guishes three main categories of cove- red services (Art. 2(1) Directive; Art. 3(3) Regulation): − Electronic communication ser- vices: These include internet access services, interpersonal communi- cations services, and transmission services for machine-to-machine communication and broadcasting; − Internet domain name and IP num- bering services; − Other information society services: This category captures services which enable their users to com- municate with each other, or which enable the storage or other proces- sing of data. Examples include on- line marketplaces, hosting services, and cloud computing services.

Much like the GDPR, the e-Evidence framework may extend to service pro- viders even where their headquarters, personnel and technical infrastructure are located outside the EU.

3 Walder Wyss Newsletter 228 | July 2026 Specifically, Art. 3(4) of the Regulation clarifies that a service is considered to be provided in the EU if the service pro- vider enables a natural or legal person in an EU Member State to use such ser- vices and there is a “substantial con- nection“ with an EU Member State. Such a connection is deemed to exist in the following circumstances: − The provider has an establishment in the EU; or − The provider has a significant num- ber of users in one or more EU Member States; or − The provider directs its activities towards one or more EU Member States (e.g., by using the language or currency of that State or allowing customers to order goods or ser- vices from that State). 3. Key Obligations Service providers falling within the scope of the Regulation are required to comply with the following main obliga- tions. First, service providers must designa- te an establishment or appoint a legal representative within the EU to recei- ve, respond to and comply with Euro- pean Production Orders and European Preservation Orders (Art. 3 Directive). The designated representative must be granted sufficient authority and re- sources to fulfil these functions effec- tively (Art. 3(4) Directive). The appoint- ment is therefore not merely a formal administrative requirement but requires service providers to establish a certain operational framework. Secondly, service providers must com- ply with demanding response deadlines (Art. 10 and 11 Regulation). Upon receipt of a European Production Order, the re- quested data generally must be trans- mitted within 10 days, or within 8 hours in emergency cases. In the case of a Eu- ropean Preservation Order, the service provider must preserve the requested data without delay for an initial period of 60 days, which may be extended upon request of the issuing authority. Failure to comply with the Regulation may result in significant sanctions, in- cluding fines of up to 2% of the service provider‘s total worldwide annual turn- over (Art. 15 Regulation). The practical relevance of these sanctions will also depend on EU Member States’ imple- mentation and enforcement practice. 4. A Swiss Law Perspective: Service Providers Caught in the Middle Swiss law contains safeguards intended to protect Swiss sovereignty, most no- tably Article 271 of the Swiss Criminal Code (SCC). Depending on the circums- tances, the direct transfer of information to a foreign authority outside the esta- blished judicial assistance framework may conflict with Article 271 SCC. This may place Swiss service providers in a difficult position. On the one hand, they may face regulatory obligations and po- tentially significant sanctions under EU law. On the other hand, direct complian- ce may give rise to sanction exposure under Swiss law. At present, Switzerland is not party to any specific agreement addressing the conflict-of-laws issues that may arise for Swiss service providers under the EU e-Evidence framework. The Swiss Federal Council has recognised the is- sue and initiated exploratory discussi- ons with the EU, but a dedicated solution is not yet in place (see in particular Be- richt zur e-Evidence-Vorlage der EU, 24 October 2023). The Regulation itself contains mecha- nisms intended to address conflict-of- laws situations. In particular, service providers may object to a European Pro- duction Order where compliance would conflict with obligations arising under the law of a third country (Art. 17(1), (2) Regulation). While these mechanisms may offer an important safeguard, it re- mains uncertain how they will operate in practice where Article 271 SCC is con- cerned. Swiss law also provides for the possi- bility of obtaining prior authorisation from the competent authorities under Article 271 SCC. However, it remains un- certain whether the Swiss authorities would grant such authorisation and, if so, whether it could be obtained within the short deadlines imposed by the Regula- tion. 5. What Can Companies Do Now? Although much remains uncertain, com- panies with operations, customers or users in the EU should consider proac- tive steps to understand their exposure. At a minimum, they should assess whet- her their services fall within the scope of the e-Evidence framework and whether an EU legal representative or designa- ted establishment may be required. Organisations falling within the scope of the new framework may need to es- tablish internal procedures and identify responsible personnel to ensure that incoming orders can be reviewed and handled within the short timelines im- posed by the Regulation. 6. Looking Ahead In April 2025, the Swiss Federal Coun- cil mandated the Federal Department of Justice and Police to explore closer co- operation with the EU in relation to elec- tronic evidence and to assess whether additional Swiss legislation may be re- quired. One of the objectives of this work is to strengthen legal certainty for digital service providers and to avoid conflicts of laws. Until greater clarity emerges, organisa- tions active in the EU market should clo- sely monitor developments and assess whether the framework may affect their operations. Walder Wyss Newsletters provide comments on new developments and significant issues of Swiss law. These comments are not intended to provide legal advice. Before taking action or relying on the comments and the information given, addressees of this Newsletter should seek specific advice on the matters which concern them. © Walder Wyss Ltd., Zurich, 2026