EU CSAM Scanning: Voluntary Detection Rules Restored Until 2028
Regulation (EU) 2026/1881 restored a temporary legal basis for communications providers to use qualifying technologies voluntarily to detect and report online child sexual abuse. Article 1(3) excludes interpersonal communications with end-to-end encryption. The act was dated 24 July, published on 28 July, entered into force three days later, and applies until 3 April 2028. Official Journal text, retrieved 10 August 2026.
- Detection regime
- VOLUNTARY
- https://eur-lex.europa.eu/eli/reg/2026/1881/oj/eng | Retrieved 10 August 2026
- Encrypted chat
- OUT OF SCOPE
- https://eur-lex.europa.eu/eli/reg/2026/1881/oj/eng | Retrieved 10 August 2026
- End date
- 3 APR 2028
- https://eur-lex.europa.eu/eli/reg/2026/1881/oj/eng | Retrieved 10 August 2026
- Mandatory file
- ONGOING
- https://eur-lex.europa.eu/legal-content/EN/HIS/?uri=CELEX:52022PC0209 | Retrieved 10 August 2026
CORRECTION TO THE APPROVED LEAD
The approved lead described Parliament as rejecting message scanning. The enacted text says something narrower: it excludes end-to-end encrypted communications and permits other qualifying processing voluntarily. It neither bans scanning generally nor creates a scanning duty. Regulation (EU) 2026/1881, retrieved 10 August 2026.
What the temporary rule permits
The regulation derogates from specific confidentiality rules in the ePrivacy Directive. A provider that chooses to use detection technology must satisfy conditions including necessity, proportionality, data-protection safeguards, reliability, human review, and reporting of verified suspicions. Articles 1 and 2, retrieved 10 August 2026.
- Providers must use current, sufficiently reliable technology and the least privacy-intrusive option available. Article 2(1)(b), retrieved 10 August 2026.
- Providers must complete a data-protection impact assessment and, subject to transition rules, prior consultation. Article 2(1)(c) and Article 2(2), retrieved 10 August 2026.
- Suspected solicitation detection must use relevant indicators and objectively identified risk factors, with a right to human review. Article 2(1)(f), retrieved 10 August 2026.
How the final act moved
- 9 JUL 2026RecordedParliament positionThe Parliament procedure file records the 9 July position. European Parliament procedure file, retrieved 10 August 2026.
- 24-28 JUL 2026RecordedFinal act and publicationThe act is dated 24 July and the Official Journal issue is dated 28 July. Official Journal text, retrieved 10 August 2026.
- 31 JUL 2026RecordedRule took effectArticle 11 set entry into force three days after publication and an end date of 3 April 2028. Official Journal text, retrieved 10 August 2026.
The mandatory proposal is separate
The 2022 proposal for mandatory prevention and detection duties remains a different legislative file. EUR-Lex still labels procedure 2022/0155(COD) as ongoing, while recital 11 of the temporary regulation says interinstitutional negotiations on that proposal were still ongoing when the temporary act was adopted. EUR-Lex procedure file, retrieved 10 August 2026; Regulation recital 11, retrieved 10 August 2026.
What this means for encrypted services
The temporary act does not apply to interpersonal communications with end-to-end encryption. Outside that exclusion, it sets legal conditions but does not prescribe one technical implementation and does not require every provider to participate. Compare service designs in the encrypted messaging comparison. Articles 1 and 2, retrieved 10 August 2026.
DO NOT MERGE THE TWO FILES
A voluntary derogation through April 2028 is now in force. A separate mandatory regime is still an ongoing proposal. Reporting either one as the other changes the legal position. Current act and mandatory procedure, both retrieved 10 August 2026.
Sources
- Regulation (EU) 2026/1881, retrieved 10 August 2026.
- EUR-Lex procedure 2022/0155(COD), retrieved 10 August 2026.
- European Parliament procedure file 2022/0155(COD), retrieved 10 August 2026.
Frequently Asked Questions
Did the EU require encrypted services to scan messages in July 2026?
No. Article 1(3) excludes communications with end-to-end encryption, and the remaining derogation is voluntary rather than mandatory. Source: https://eur-lex.europa.eu/eli/reg/2026/1881/oj/eng. Retrieved 10 August 2026.
How long does the temporary EU rule apply?
Article 11 says the regulation applies until 3 April 2028. Source: https://eur-lex.europa.eu/eli/reg/2026/1881/oj/eng. Retrieved 10 August 2026.
Is the separate mandatory CSAM proposal finished?
No final act is recorded. EUR-Lex marks procedure 2022/0155(COD) as ongoing. Source: https://eur-lex.europa.eu/legal-content/EN/HIS/?uri=CELEX:52022PC0209. Retrieved 10 August 2026.