Javier Zarzalejos, the Parliament’s rapporteur, at the negotiating table of the trilogue on the Child Sexual Abuse Regulation in Brussels, 29 June 2026. Photo: European Parliament, © European Union 2026, Source: EP, Laurie Dieffembacq.
Update, 1 October 2026, revised 2 October: the trilogue took place on 29 September, as Council document 13051/26 records. Negotiators agreed on the tasks of the EU Centre, as the Parliament’s rapporteur said in a statement on 30 September, but not on scanning private messages; Agence Europe also reports an agreement in principle on detection orders for public content. No date has been confirmed for the next round; the tracker carries every step.
On 29 September the Council, the Parliament and the Commission sit down for a sixth political trilogue on Chat Control 2.0, the permanent regulation on child sexual abuse online. Five rounds have not settled the one question that matters: may detection be ordered against everyone, or only against people a judge has named. This piece is about what the people in that room can actually do, what they cannot do without going back to the governments and the MEPs who sent them, and what happens if they leave with nothing.
What is on the table?
A trilogue is not a vote. It is an informal negotiation between three delegations, each carrying a mandate agreed elsewhere, at a different time, by a different majority. The Council’s mandate was adopted by ministers on 26 November 2025. It removed the detection orders, Articles 7 to 11 of the Commission’s draft, and left providers free to check content on their platforms voluntarily. The Parliament’s mandate was adopted in the Civil Liberties committee on 14 November 2023 and confirmed by the plenary on 22 November 2023. It allows detection only as a last resort, aimed at specific suspects, on a judicial order, with end-to-end encryption protected and no mandatory age verification for communication services.
Between the two texts sits the Commission, which proposed mandatory detection orders on 11 May 2022 and has no vote in the room. It drafts the compromise language. In June 2026 the presidency floated a mix: voluntary detection for some content and mandatory detection for other content, split by whether the material is public or non-public. That idea did not close the fifth round, held on 29 and 30 June, which ended without agreement. Ireland took over the presidency on 1 July and its justice minister, Jim O’Callaghan, is on record in support of the mandatory text.
What can the negotiators agree on 29 September?
Anything that sits inside both mandates. That space is real, but narrower than the headlines suggest. The two texts overlap on the EU Centre on child sexual abuse, on risk assessment and mitigation duties for providers, on reporting to authorities and on transparency. Detection is where they part. The Council’s text keeps it voluntary; the Parliament’s text allows it only against named suspects on a judicial order, and the Parliament has twice refused to extend the temporary regime that permits voluntary scanning, on 26 March and 9 July 2026. A deal is possible only where a text can honestly be read as consistent with both: detection that is targeted, authorised by a court and kept away from end-to-end encryption. The negotiators could shake hands on that without calling anyone.
They can also agree on the machinery: how the EU Centre is governed, how reports flow to national authorities, what a provider has to publish and when. None of that is small, and most of it will be the actual text of the law if the law passes.
What they cannot agree without a new mandate
Mandatory scanning of private messages. The Parliament’s delegation is bound by a text that allows detection only against named suspects on a judicial order. A general obligation to scan everyone’s messages is outside that mandate, and Javier Zarzalejos, who chairs the committee and is the rapporteur, cannot sign it in the room. He would have to take it back to the committee and then to the full Parliament, which on 9 July 2026 produced 314 votes to reject even the temporary, voluntary regime. That motion failed only because it needed an absolute majority of all members, 360 that day. A mandatory regime would be asking the same chamber for more.
The reverse is also true. The Council’s delegation cannot accept the Parliament’s “last resort” judicial orders without checking with the governments, because the mandate of 26 November 2025 took detection orders out altogether. Any provisional agreement goes to the Permanent Representatives Committee, where it needs a qualified majority. To block it, at least four states representing more than 35 per cent of the EU population have to say no. Ten governments, with 33.3 per cent of the population, are on record against mandatory scanning of private messages. That is 1.7 points short. Three governments can close the gap on their own: Germany at 18.47 per cent, Belgium at 2.63 and Portugal at 2.38, none of which has declared against mandatory detection. Germany is the largest of the three and the most equivocal: its public line rejects suspicionless scanning, but the instruction its negotiators have carried since June 2026 does not oppose mandatory detection where it supplements voluntary scanning. Italy, Poland and the Netherlands carry 25.5 per cent between them, so the block does not survive losing any one of the three. We set out the arithmetic in Three governments decide whether mandatory scanning can still be blocked. The list, with the document behind every entry, is in Where the 27 governments stand.
Update, 9 September 2026: Slovenia has since been reclassified from Against to Unclear, because its recorded statement predates the government confirmed on 4 June 2026, which has not stated a position. The count is now nine governments and 32.9 per cent, 2.1 points short. The three governments that can close the gap are unchanged.
Client-side scanning of encrypted services is the third thing that will not be settled in the room. The Parliament’s mandate protects end-to-end encryption, and in February 2024 the European Court of Human Rights ruled in Podchasov v. Russia that requiring providers to weaken it cannot be regarded as necessary in a democratic society. The Council’s own Legal Service told ministers on 26 April 2023, in opinion 8787/23, that ordering a service to scan all its users’ communications is general and indiscriminate screening. It repeated the objection in May and June 2026. Ministers may ignore their lawyers; negotiators may not rewrite the Charter.
What happens if there is no deal?
Nothing dramatic, and that is the point. Chat Control 1.0, Regulation (EU) 2026/1881, is in force until 3 April 2028. It lets providers scan voluntarily and, after the Parliament’s amendment, excludes end-to-end encrypted communications. Scanning continues with or without a permanent law. The Irish presidency ends on 31 December 2026; Lithuania takes over on 1 January 2027 and Greece on 1 July 2027. Every presidency so far has inherited the file and none has closed it.
Three deadlines under the temporary law arrive whatever happens in the trilogue. By 1 October 2026 the Commission must publish the list of organisations that receive reports about Europeans. By 1 February 2027 providers owe their first public reports on error rates and false positives. On 1 April 2027 the grace period ends for providers that were already scanning before 31 July 2026 without a completed data protection consultation. Those dates will tell us more about what scanning actually does than the trilogue will.
What to watch on the day
The words in the press release. “Provisional agreement” means a text exists and is going to the Permanent Representatives Committee and the committee in Parliament. “Progress” or “constructive exchange” means it does not. If there is a text, the questions are three: does it contain detection orders at all; if so, who issues them and against whom; and does it say anything about encrypted services beyond leaving them alone. The presidency’s own planning points to a push for adoption in October. Its note to delegations of 7 July 2026, Council document 11501/26, confirms the sixth trilogue for 29 September at the Council premises, prepared by technical meetings on 10 and 18 September. Two days after the trilogue, on 1 and 2 October, justice and home affairs ministers meet in Luxembourg. The file is not on the draft agenda the Council published in June, so anything the negotiators bring back would reach ministers under any other business; the formal endorsement of a provisional agreement belongs to the Permanent Representatives Committee.
Corrected 9 September 2026: an earlier version of this paragraph gave 8 and 9 October as the date of the next Justice and Home Affairs Council. The Council’s calendar has it on 1 and 2 October.
Whatever comes out of the room, it will be in the Chat Control Tracker within a day, with the document behind it, and the names of the people who decided it are in Who decides, by name.
Sources
- Council of the EU, press release of 26 November 2025 (negotiating mandate); Danish presidency compromise text of 6 November 2025, document 14092/25.
- European Parliament, Legislative Train Schedule and procedure file 2022/0155(COD): committee vote of 14 November 2023, plenary confirmation of 22 November 2023; results of the second reading vote of 9 July 2026.
- European Commission, proposal COM(2022) 209 of 11 May 2022; report on the implementation of the interim regulation.
- Council Legal Service, opinion 8787/23 of 26 April 2023; Council minutes of May and June 2026 published by netzpolitik.org on 12 June and 2 July 2026.
- European Court of Human Rights, Podchasov v. Russia, judgment of 13 February 2024.
- Regulation (EU) 2026/1881 of 24 July 2026, Official Journal of 28 July 2026; Council press releases of 2 July and 23 July 2026.
- Council of the EU, presidency note to delegations of 7 July 2026, document 11501/26, outcome of the trilogue of 29 June 2026 and next steps; draft agendas for Council meetings during the Irish presidency, document 10983/26 of 25 June 2026; Justice and Home Affairs Council, 1 and 2 October 2026.
- Irish presidency of the Council, trio programme 1 July 2026 to 31 December 2027 (Ireland, Lithuania, Greece).
