Roadmap on Lawful and Effective Access to Data
On this page
Summary
The Roadmap for lawful and effective access to data for law enforcement sets out the conditions that should govern access to digital evidence. It says access must be necessary, proportionate, founded on clear, precise and accessible legal rules, subject to independent oversight and accompanied by effective remedies. The roadmap identifies deleted data, jurisdictional conflicts, difficult device forensics, encryption and limited analytical capacity as obstacles to obtaining criminal evidence.
Action items
In 2025, the Commission will prepare an impact assessment with a view to updating EU rules on data retention as appropriate.
With the continued support of the Commission, Europol and Eurojust are urged to build on the SIRIUS project to streamline cooperation with electronic communications service providers.
Europol and Eurojust are urged to develop, in cooperation with the private sector, a catalogue of data that electronic communications providers process for their business purposes (to start in Q4 2025).
Propose measures to improve the efficiency of cross-border requests for lawful interception through existing instruments, including assessing the need to further strengthen the European Investigation Order (by 2027);
Explore measures to create a level-playing field for all types of communication providers in the enforcement of lawful interception obligations;
determine the most efficient approach to tackle non-cooperative communication providers;
support the deployment of secured information sharing capacities between Member States, Europol and other security agencies (from 2026 to 2028).
coordinate a gap and needs analysis of research, development, deployment maintenance and uptake of common technical solutions for digital forensics before Q2-2026;
continue to support the development of technical solutions for digital forensics through appropriate funding and coordination mechanisms;
support Member States and procurement authorities in putting in place joint purchases of licences for digital forensics tools (before Q2-2027), starting with a pilot phase.
continue supporting the creation of training materials and resources.
deliver a technology roadmap on encryption (in Q2-2026);
support the research and development of new decryption capacities to equip Europol with next-generation decryption capabilities (from 2030).
The Commission, in close cooperation with Europol, will develop and streamline standardisation activities for lawful access, supported by suitable governance mechanisms (from Q2-2025 to Q2-2027).
Member States are encouraged to devote sufficient resources to ensure that security practitioners participate in relevant standardisation forums on lawful access.
Foster the creation and uptake of new AI solutions and improve existing ones for filtering and analysing digital evidence, including through the full use of AI regulatory sandboxes for their development, testing and evaluation, in line with the AI Act (from 2025 to 2028);
engage in a dialogue with law enforcement and other stakeholders to identify their needs, building on the work of Europol’s Innovation Hub and the EU Justice and Home Affairs agencies’ Lab;
support the creation of clear guidelines for the use of AI in law enforcement;
support pilot projects aimed at developing and training legally and technically sound AI solutions for digital forensics, data analysis and other investigative tools for law enforcement use.