Notes from the compliance desk.

Article 10(3) of Regulation (EU) 2023/1543 reads simply enough: the addressee transmits the requested data within ten days following receipt of the European Production Order Certificate. The word carrying the weight is receipt. The clock starts when the order reaches the addressee named on it — the legal representative appointed under Article 3(1)(b) of Directive (EU) 2023/1544 — and not when someone at your head office in another time zone first reads about it.

The practical consequence is unglamorous and expensive. An order that lands with your representative on a Friday evening and reaches your compliance team on Monday morning has already spent three of its ten days. Nothing about that is recoverable, and no part of it is visible unless the timestamp of receipt was captured by the system that received the order rather than reconstructed afterwards from a mailbox.

Preservation starts before any decision does

Article 10(1) requires the addressee to act expeditiously to preserve the requested data as soon as the order arrives. That duty is not conditional on the review concluding, on the data ultimately being produced, or on anyone forming a view about the order's validity. Freezing is not disclosing, and postponing it until the internal assessment is finished gets the sequence backwards.

Notification does not extend the ten days

Where the order concerns traffic or content data and notification to an enforcing authority is required, Article 10(2) has the data transmitted at the end of that same ten-day period, unless a ground for refusal is raised. The period does not stretch to accommodate the notification. What changes is that the release is held until it is lawful — so the work still has to be finished on the original schedule, with the disclosure gated at the end of it.

Eight hours, including nights and weekends

In an emergency case the deadline is eight hours from receipt, under Article 10(4). Article 2(18) defines those cases narrowly: an imminent threat to the life, physical integrity or safety of a person, or to critical infrastructure where disruption or destruction would create such a threat. Eight hours does not pause overnight, and it does not wait for a working day in your jurisdiction. Article 7(2) supplies the consequence of missing it — where the addressee fails to react to an emergency order within the deadline, the order may be served on any other establishment or legal representative you have in the Union.

There is exactly one route to a new deadline

Where the certificate is incomplete, contains manifest errors, does not carry enough information to be executed, or the data simply do not exist, the addressee informs the issuing authority without undue delay using Annex III (Form 3) and asks for clarification. The authority reviews the order in light of that information and, if necessary, sets a new deadline. That is the mechanism. Silence is not a slower version of it — it is a failure to comply with Article 10, which is one of the provisions carrying penalties of up to 2% of total worldwide annual turnover under Article 15(1).

Three things are worth instrumenting before the first order arrives: the timestamp of receipt at the addressee, an automatic preservation step that runs on arrival, and an escalation path that reaches a named approver in their own time zone rather than yours.

Article 3(2) of Directive (EU) 2023/1544 puts two constraints on where your legal representative sits, and they are usually read as one. The representative must be established or resident in a Member State where you offer your services, and must be capable of being subject to enforcement procedures there. A convenient jurisdiction in which you have no users fails the first constraint however well it satisfies the second.

One fact narrows the map before anything else is considered: Denmark does not take part in the Regulation. Where your users are distributed across the Union, the choice is between the remaining participating Member States in which you genuinely offer services.

The language decision is made once

The Article 4(2) notification names the official EU languages in which your representative can be addressed, and those must include at least one official language of the Member State where the representative resides. This is not an administrative detail. It determines what actually lands in your queue: whether an incoming order and the correspondence around it arrive in a language your reviewers read, or whether every deadline now includes a translation step performed under time pressure.

More representatives means more of everything

Nothing stops you appointing several representatives, but Article 4(3) requires the notification to state the precise territorial scope of each, and the obligation to keep those details current applies to all of them. The technical side scales the same way. Each Member State operates its own gateway for service providers, so a second Member State means a second peer, a second set of certificates and a second connection to keep alive.

The workable rule is to choose against where your users actually are, then let the language, the territorial scope and the technical footprint follow from that — rather than picking a jurisdiction first and discovering afterwards which of the three it made harder.

Article 3(5) of Directive (EU) 2023/1544 does two things in one paragraph. It requires Member States to ensure that a service provider and its legal representative can be held jointly and severally liable, so either may be penalised for a failure by the other. And it then closes the obvious escape route: a lack of appropriate internal procedures between the provider and the representative cannot be relied on as a justification for non-compliance.

That second sentence is unusual, and it is worth sitting with. The legislator anticipated the exact failure mode — an appointment that exists on paper while nothing connects the appointed addressee to the people who can actually authorise a disclosure — and pre-emptively removed it as an excuse.

Powers and resources, not just a name on a form

Article 3(4) requires you to give your representative the necessary powers and resources to comply with orders addressed to it. An appointment that leaves the representative unable to reach an approver out of hours, or without the authority to respond at all, does not satisfy that requirement even though the notification is properly filed. The paperwork and the capability are separate obligations.

What an enforcing authority will ask to see

If the procedure is the thing that cannot be missing, it has to exist in a form somebody else can inspect: when the order was received, who was notified and when, who approved the disclosure, on what legal basis, exactly what was released, and what was filed if it could not be executed. Threads across several inboxes are not that record, and reconstructing one after an enforcement question has been asked is a different and much worse exercise than producing one that was written as events happened.

The penalties sit on both instruments

Article 5 of the Directive requires Member States to lay down effective, proportionate and dissuasive penalties for infringements of Articles 3 and 4, and to inform the Commission annually about non-compliant providers and the enforcement action taken against them. Separately, Article 15(1) of Regulation (EU) 2023/1543 provides for pecuniary penalties of up to 2% of total worldwide annual turnover for infringements of Articles 10, 11 and 13(4) — the duties nobody can discharge if there is no working procedure between provider and addressee.

A European Preservation Order Certificate — Annex II of the Regulation, commonly called Form 2 — orders data to be frozen rather than handed over, so that it survives while a production order is prepared. Nothing leaves your systems on a preservation order. Treating one as though it were a production order is over-disclosure, and it is disclosure without the legal basis that would have made it lawful.

The obligation is also finite. Under Article 11(1) it ceases after 60 days, unless the issuing authority extends it by a further 30 days using Annex VI (Form 6), or confirms that a subsequent request for production has been issued using Annex V (Form 5).

Two failure modes, opposite in direction

The first is releasing data on an order that never asked for it. The second is quieter and, in practice, more common: preservation lapses at day 60 while a production order is being prepared, ordinary retention policies do what they were designed to do, and the evidence is gone. One is a disclosure incident. The other destroys the material the order existed to protect, and Article 11 is among the provisions carrying penalties under Article 15(1).

The clocks are per order and per identifier

Each preservation order attaches to specific identifiers and specific categories of data, and each carries its own expiry. A provider holding even a handful of them is tracking a rolling set of 60-day and 90-day dates, each of which has to survive staff changes, holidays and retention jobs running on their own schedule. This is the kind of obligation that is trivial to state and unreliable to hold in anyone's head — which is the argument for the clock living in the same system that received the order.