The New Europol Regulation (COM(2026) 580): Europol as Investigative Infrastructure and What It Means for Defence Rights
Guest contribution by Oliver Wallasch, Rechtsanwalt, Fachanwalt für Strafrecht (specialist lawyer for criminal law) and certified adviser on tax criminal law
In Brief
The European Commission’s proposal for a new Europol Regulation, COM(2026) 580 final of 24 June 2026 (interinstitutional file 2026/0165 (COD)), would repeal Regulation (EU) 2016/794 and oblige Member States to connect to, feed and systematically query a new Europol cross-checking service.
Oliver Wallasch’s commentary Europol as Investigative Infrastructure (October 2026, 35 pages) concludes that the proposal makes Europol’s work product usable against the accused without making it verifiable by the accused.
The provisions under criticism include Article 22(6)(d) (Europol outputs as evidence), Article 32(7) (data on persons outside any data-subject category), Article 101 (no maximum storage period) and recital 106 (presumed necessity of biometric identification).
The commentary ends with fifteen legislative recommendations; the opinion of the European Data Protection Supervisor (EDPS) is still a placeholder in the Commission’s text.
We are delighted to publish an analysis report from our dear friend and colleague Oliver Wallasch – Frankfurt, Germany on the Commission’s Proposal for a New Europol Regulation.
For years, Europol appeared in criminal files as little more than a cover sheet: an analytical report, a few link charts, a note that a SIENA message had been exchanged. EncroChat and SkyECC changed that. Since 2020, courts across the Union have convicted defendants on data decrypted and attributed in operations whose methods the defence could not examine. The Commission’s proposal for a new Europol Regulation of 24 June 2026 would make that experience the norm. Oliver Wallasch’s 35-page commentary is the first comprehensive analysis of the proposal from the standpoint of criminal defence practice.
From Support Agency to Investigative Infrastructure
The commentary shows how the proposal turns a support agency into investigative infrastructure. Member States would have to connect to a new cross-checking service, upload data systematically and query it in every cross-border case, backed by around EUR 1.05 billion and 910 additional posts. The coercive act stays national, but the decisions leading up to it move to The Hague.
Data Retention, Prospective Offenders and Biometrics: The Key Findings
The analytical findings are sharp. Article 32(7) reverses the data-subject-category principle, so persons with no established link to crime may be held indefinitely. Article 101 sets no maximum storage period, although the financial statement tells the legislature that one exists. National “prospective offender” assessments travel across borders as automatic alerts. Recital 106 replaces the individual necessity test for biometrics with a general presumption, contrary to CJEU case law, and criminal intelligence feeds into travel and visa decisions that cannot be challenged.
Article 22(6)(d): Europol Evidence in the Courtroom
The critique is most pointed where Europol’s output enters the courtroom. Article 22(6)(d) makes Europol results admissible as evidence, yet nothing obliges anyone to preserve raw data, tool versions or logs for the defence. Measured against Yalçınkaya, the CJEU’s EncroChat ruling and El Haski, the central defect is structural: the proposal makes Europol’s work product usable against the accused without making it verifiable by the accused.
Fifteen Recommendations and a Procedural Bridge from Intelligence to Evidence
The paper is constructive as well as critical. It proposes a procedural bridge from intelligence to evidence and a verifiability duty to match the admissibility rule, and it closes with fifteen legislative recommendations, a consolidated safeguards matrix and a full table of authorities.
Who Should Read the Commentary
For defence lawyers, it is a practical toolkit that anticipates the trials this Regulation will produce and supplies the arguments needed to challenge Europol material. For judges, prosecutors, data protection authorities and legislators, it comes at the right moment: the legislative process is ongoing, and the EDPS opinion is still a placeholder in the Commission’s text.
Download the full commentary (PDF, 35 pages): Europol as Investigative Infrastructure – Defence Rights, Transparency and Effective Remedies under the Commission’s Proposal for a New Europol Regulation (COM(2026) 580 final), Oliver Wallasch, October 2026.
Downloads: The Commentary and the Commission Proposal
The commentary and the two Commission documents it analyses are available as PDF files:
Key Provisions of the Europol Proposal at a Glance
The following overview condenses the commentary’s safeguards matrix. Article numbers refer to COM(2026) 580 final.
Provision | What the proposal provides | Concern raised in the commentary | Safeguard proposed |
Articles 36, 38, 39 | Mandatory connection to the Europol cross-checking service, systematic upload and systematic queries | National investigations run on Europol infrastructure; nobody owns the result of cross-matching | Responsibility attached to each processing event; a complete, reviewable chain of records |
Article 32(6) to (10), recital 44 | Processing of data on persons outside the Annex 2 categories where “relevant and necessary” | The six-month period in Article 32(10) is no outer limit; retention on a precautionary basis | Six months as the maximum unless independently authorised; mandatory separation; automatic deletion; notification of the EDPS |
Article 101 | Storage reviews every three years, renewable without limit | No absolute maximum, although the financial statement refers to a five-year maximum | Absolute maximum storage period; preservation duty that the defence can trigger |
Annex 2, point (1)(b); Articles 37 and 38 | Records on “prospective offenders” in the cross-checking service, automatic alerts on a match | A national prognosis travels across borders without date, basis or expiry (Article 48 Charter, Article 6(2) ECHR) | Mandatory metadata, labelling as an assessment, deletion when proceedings are discontinued |
Recital 106; Articles 28(2), 39, 41, 100 | Biometric identification presumed strictly necessary; retrieval of data from the internet | Conflicts with CJEU C-205/21; facial recognition against online images despite Article 5(1)(e) AI Act | Case-specific necessity and human review; deletion of recital 106; express exclusion of untargeted scraping |
Article 22(6)(d); Articles 33, 129; Protocol No 7 | Member States must ensure that outputs of Europol deployments can be used as evidence | No duty to preserve raw data, methodology, tool versions or logs; analysts enjoy immunity | Verifiability duty, preservation package, court-supervised disclosure, procedure for waiving immunity |
Articles 15(e), 59, 61, 64(1)(b), 102(6) | Europol develops decryption capabilities and AI-enabled tools | “Interested parties” does not expressly include the defence; this part of the proposal was not impact-assessed | Defence and court-appointed experts treated as interested parties; tool version, inputs and limitations recorded |
Articles 79(7), 91(8), 94 | Bar on third-country information “clearly obtained in obvious violation of human rights” | The threshold will rarely be met; El Haski requires only a real risk | Real-risk standard; documented provenance; end-use safeguards |
Articles 79(6), 81(4) and (5) | Data shared with the EPPO regardless of provider restrictions | The reasons for the restriction disappear from view | Provider’s reasons accompany the information |
Articles 31, 36(1)(e), 85(a) | Europol opinions and risk indicators for ETIAS, VIS and Frontex | Criminal intelligence decides travel and visa matters without any means of challenge | No adverse decision based solely on unverified or automated information; human assessment; disclosure of decisive reasons |
What the Proposal Means for EncroChat, ANOM and SkyECC Defence
Defence teams in encrypted-communications cases know the pattern the commentary describes. The court receives Europol reports on cross-matches, link analyses and decryption results. The defence asks for the raw data, the methodology and the analyst. The prosecution answers that the data belong to another Member State or a third country, that the methods are operationally sensitive and that the analyst is an official of the Union. Wallasch expects trials built on Europol material to follow this course far more often once the new Regulation applies.
The case law the commentary relies on is already in force and can be invoked whenever Europol material appears in a file:
in M.N. (EncroChat) (C-670/22, 30 April 2024), the CJEU held that a national criminal court must disregard information and evidence on which the accused cannot comment effectively where it is likely to have a preponderant influence on the findings of fact,
in Yalçınkaya v. Türkiye (no. 15669/20, 26 September 2023), the ECtHR Grand Chamber found a violation of Article 6 ECHR because the conviction rested decisively on ByLock data whose raw form and processing the applicant could not examine,
in El Haski v. Belgium (no. 649/08, 25 September 2012), the ECtHR accepted a “real risk” of treatment contrary to Article 3 ECHR as sufficient where the state of origin offers no meaningful examination of torture allegations,
in Rowe and Davis v. the United Kingdom (no. 28901/95, 16 February 2000), the ECtHR Grand Chamber required the prosecution to disclose all material evidence for or against the accused, with any restriction decided by the trial judge and counterbalanced.
The commentary also identifies a gap in access rights. Article 7 of Directive 2012/13/EU and the European Investigation Order framework give the defence access to the national case file. Material that Europol produced but never transmitted stays outside that file, and the national right of access does not reach it.
For practice, the verifiability package Wallasch proposes doubles as a checklist of what to request when a Europol product is relied on: provenance, methodology, the relevant source material, the analytical steps, integrity and alteration records, the tool and model version, known limitations, and a statement of what has been withheld and why. His distinction between three states of Europol material (intelligence lead, operational product, evidential output) gives courts a way to ask which of the three they are being shown.
Where the Legislative Procedure Stands
The Commission adopted the proposal on 24 June 2026 as part of a wider package that also contains a regulation strengthening Eurojust’s mandate, a revision of the European Investigation Order and amendments to Regulation (EU) 2018/1725 (EUDPR). The proposal follows the ordinary legislative procedure under file number 2026/0165 (COD), under which the European Parliament and the Council examine the text before any adoption. The financial statement covers the period 2028 to 2034, including EUR 415.4 million for the EU Digital Police Cloud alone.
Recital 132 still reads that the EDPS delivered an opinion “on [date]”. The commentary analyses the Commission text only; positions adopted since by the co-legislators are outside its scope.
Frequently Asked Questions
What is COM(2026) 580?
It is the European Commission’s proposal of 24 June 2026 for a new Europol Regulation that would repeal Regulation (EU) 2016/794 (interinstitutional file 2026/0165 (COD)).
Would Europol gain coercive powers under the new Regulation?
No. Article 6(3) of the proposal states that Europol shall not apply coercive measures; the commentary argues that the decisions leading up to the national coercive act nonetheless move to Europol.
Can Europol analysis be used as evidence in national criminal proceedings?
Article 22(6)(d) requires Member States to ensure that outputs of Europol deployments may be used as evidence, while the proposal contains no matching duty to preserve or disclose the underlying material to the defence.
How long could Europol store personal data under the proposal?
Article 101 provides for storage reviews every three years that can be renewed without an absolute maximum, although the Legislative Financial and Digital Statement describes a five-year maximum.
What does the CJEU EncroChat judgment require of criminal courts?
In M.N. (EncroChat), C-670/22, of 30 April 2024, the Court of Justice held that a national criminal court must disregard evidence on which the accused cannot comment effectively if it is likely to have a preponderant influence on the findings of fact.
What does Oliver Wallasch recommend?
His commentary proposes fifteen amendments, among them a verifiability duty for Europol outputs, an absolute storage limit, deletion of recital 106 and a real-risk standard for third-country information obtained in breach of Article 3 ECHR.
About the Author
Oliver Wallasch is a Rechtsanwalt in Frankfurt am Main, Fachanwalt für Strafrecht (specialist lawyer for criminal law) and certified adviser on tax criminal law (Zertifizierter Berater für Steuerstrafrecht). He has defended in criminal cases for three decades.
Related Reading on the JDT Blog
Primary Sources
CJEU, judgment of 30 April 2024, M.N. (EncroChat), C-670/22, EU:C:2024:372
ECtHR [GC], Yalçınkaya v. Türkiye, no. 15669/20, 26 September 2023
ECtHR, El Haski v. Belgium, no. 649/08, 25 September 2012
Download the full commentary (PDF, 35 pages): Europol as Investigative Infrastructure – Defence Rights, Transparency and Effective Remedies under the Commission’s Proposal for a New Europol Regulation (COM(2026) 580 final), Oliver Wallasch, October 2026.
