EU ProtectEU strategy mandates roadmap for law enforcement access to encrypted data by 2027

The ProtectEU document lists six priority areas including “more effective tools for law enforcement.” It calls for “technological solutions for accessing encrypted data” and a multi-year roadmap. This language revives prior Commission attempts from 2020-2022 that stalled after technical reviews found no method to weaken encryption selectively. The text promises cybersecurity and rights protections but provides no engineering criteria or audit mechanisms.

No quantitative benchmarks appear in the strategy. Historical data from the 2016 Apple-FBI dispute and 2023 UK Online Safety Act consultations show that mandated access points increase attack surface for all users. ENISA’s 2024 cryptography assessment documented that any persistent key escrow or protocol modification raises successful breach probability by at least 40 percent against state-level adversaries. The strategy omits these measurements.

Operational effect falls on providers required to retain or expose session keys. Signal and WhatsApp would face redesigns or market exit decisions similar to those documented in the 2022 EU e-evidence package filings. Europol gains expanded operational powers for cross-border decryption requests once the roadmap is adopted. National data-protection authorities receive no new veto authority under the current text.

Next steps require the Commission to publish the encryption roadmap within 18 months. Member states must then transpose resulting obligations into national law. Technical working groups under the Single Intelligence Analysis Capacity will define protocol changes; draft standards are scheduled for circulation by Q4 2026.