Christina Rafti, then Cyprus’s Permanent Representative to the EU, speaking for the Council presidency at the trilogue on the Child Sexual Abuse Regulation in Brussels, 29 June 2026. Photo: European Parliament, © European Union 2026, Source: EP, Laurie Dieffembacq.
After each round of trilogue negotiations the presidency sends delegations a table. The one that sits in the Council’s public register from this spring is document WK 6982/2026 of 19 May 2026: 446 pages in four columns, the Commission proposal, the Parliament’s mandate, the Council’s mandate and the draft agreement, with a status line against each provision. It records what the negotiators settled at the trilogue of 11 May 2026 and what they sent back to technical level. On encryption it says more than the summaries of it do.
What it says about encryption
The draft agreement column carries an article, not only a recital. At line 112a, Article 1(4a), it reads:
“This Regulation shall not prohibit, make impossible, weaken, circumvent or otherwise undermine cybersecurity measures, in particular encryption, including end-to-end encryption, implemented by the relevant information society services or by the users. This Regulation shall not create any obligation that would require a provider of hosting services or a provider of interpersonal communications services to decrypt data or create access to end-to-end encrypted data, or that would prevent providers from offering end-to-end encrypted services.”
The table gives the origin of that wording as the Cypriot presidency’s drafting, and the same text stands in the Council’s mandate column. The row carries no on hold marker, unlike many others in the document.
Parliament had its own guarantee in the same article. Its mandate column, at line 107a, Article 1(3), point (-a), reads: “Nothing in this Regulation shall be interpreted as prohibiting, weakening or undermining end-to-end encryption. Providers shall not in particular be prohibited to offer end-to-end encrypted services.” In the draft agreement column that paragraph is marked “deleted”, with the note “Covered in line 112a”.
The two sentences do different work. Parliament’s forbids reading the regulation a certain way. The agreed wording forbids the regulation from doing the thing, and then says what it may not require: no obligation to decrypt, no obligation to create access to encrypted data, no bar on offering end-to-end encrypted services. Neither settles what detection may demand of services that are not encrypted, and that is the part still open.
What is still open
Where a line is unresolved the table says so in the draft agreement column. The marker “ITM 13.02: ON HOLD” stands against the paragraphs of Article 66 and, with other dates, against Article 57(1), point (g), and Article 51(a); recitals on voluntary detection and on detection orders are marked as linked to that discussion. Elsewhere the entries read “Provisionally agreed (Trilogue 26.02)”, “Trilogue 16.04” or “Trilogue (11.05.): Further discussion at technical level”, so the table doubles as a record of which meeting decided what.
What it changes in the record
The document joins the sources of the Chat Control Tracker. It changes no count on Where the 27 governments stand: that page answers one question, whether providers may be ordered to scan everyone’s private messages, and a table of draft text records no positions. What it does answer is a question readers ask here often, whether the agreed text protects encryption in the binding part or only in the preamble. On 19 May 2026 the draft agreement had it in Article 1(4a).
Record notes are short, dated entries: one document, what it says, what it changes on this site. Sources: Council of the EU, four-column table on the proposal for a regulation laying down rules to prevent and combat child sexual abuse, document WK 6982/2026 of 19 May 2026, public register, lines 107a and 112a; presidency note to delegations, document 11501/26 of 7 July 2026, public register.
