Council document
9659/26: the presidency’s compromise on detection
The text the negotiators work from on the one chapter of the regulation still open: who may search which messages, for what, and on whose order.
- Number
- 9659/26
- Date
- 26 May 2026
- From
- The Council presidency (Cyprus)
- Subject
- Own-initiative searches, public and non-public detection orders, EU Centre searches
- Classification
- Public: Council register, PDF
- Length
- Nine pages of explanation and fifteen of draft articles
- Discussed
- Justice and Home Affairs counsellors, 10 June 2026
What it says
The proposal splits the online world in two. “Content that is publicly accessible” is defined as “information that has been made available, at the request of a content provider, to a potentially unlimited number of persons without requiring a human decision or selection of who is granted access”. Everything else that is not encrypted is non-public content. Encrypted content is outside both regimes: the co-legislators have provisionally agreed that the regulation “shall not create any obligation that would require a provider of hosting services or a provider of interpersonal communications services to decrypt data or create access to end-to-end encrypted data, or that would prevent providers from offering end-to-end encrypted services”.
On that map the presidency places four components:
- Own-initiative searches of non-public content by providers: a permanent version of the voluntary regime, extended to hosting services, with a duty to “inform the EU Centre in advance” and a power for national authorities to suspend the searches.
- Detection orders on publicly accessible content, where a hosting service “is being misused for online child sexual abuse to an appreciable extent”, with a procedure that “is less detailed” than the one for private content.
- Detection orders on private content, meant “to move away from generalised scanning towards scanning of specific users, without a need for these users to be suspects in the criminal law sense”. An order “shall only be issued if” it “concerns specific users”, there are “clear indications, based on information lawfully acquired, that those specific users are related to child sexual abuse”, the users “have used the service in the 12 months prior to the request”, and the order is “necessary and proportionate”. Orders would run for at most 24 months for abuse material and 12 months for grooming, issued by “independent administrative authorities and/or judicial authorities”.
- Searches by the EU Centre of public content.
What each component may look for, “known child sexual abuse material (CSAM), new CSAM and/or grooming”, “remains bracketed”.
What happened next
- 10 June 2026: the Justice and Home Affairs counsellors discuss it. The German delegation’s minutes, published by netzpolitik.org on 12 June, record twelve scrutiny reservations, six of them called positive.
- 22 June 2026: the presidency tells the ambassadors that the Parliament “has remained very critical concerning own-initiative searches by providers on non-publicly accessible content, even for known CSAM” (10499/26).
- 7 July 2026: the presidency records the Parliament as “ready to discuss the building blocks on detection” on two conditions, end-to-end encryption protected and no general monitoring obligation (11501/26).
- These four components are what the technical meetings of 10 and 18 September and the trilogue of 29 September are about.
What it changed in this record
- No government’s position changed. The document joined the sources of the tracker and of Who decides, by name.
- Record note: The presidency’s compromise on detection, document 9659/26: what it says (11 September 2026).
Related documents
- 13158/26, “Preparation for the trilogue”, 18 September 2026.
- 11956/26, “State of play and way forward”, 10 September 2026.
