What changed between the adopted text of 26 Mar 2026 and the adopted text of 9 Jul 2026

Added:(7) the measures applied to limit the error rate and the error rate achieved;

Added:(8) the retention policy and the data protection safeguards applied pursuant to Regulation (EU) 2016/679;

Added:(9) the names of the organisations acting in the public interest against child sexual abuse with which data has been shared pursuant to this Regulation;

Added:(h) where suspected online child sexual abuse has been identified, the content data and related traffic data processed for the purposes set out in point (a)(i), and personal data generated through such processing are stored in a secure manner, solely for the purposes of:

Added:(i) reporting, without delay, the suspected online child sexual abuse to the competent law enforcement and judicial authorities or organisations acting in the public interest against child sexual abuse;

Added:(ii) blocking the account of, or suspending or terminating the provision of the service to, the user concerned;

Added:(iii) creating a unique, non-reconvertible digital signature (‘hash’) of data reliably identified as online child sexual abuse material;

Added:(iv) enabling the user concerned to seek redress from the provider or pursue administrative review or judicial remedies on matters related to the suspected online child sexual abuse; or

Added:(v) responding to requests issued by competent law enforcement and judicial authorities in accordance with the applicable law to provide them with the necessary data for the prevention, detection, investigation or prosecution of criminal offences as set out in Directive 2011/93/EU;

Added:(i) the data are stored no longer than strictly necessary for the relevant purposes set out in point (h) and, in any event, no longer than 12 months from the date of the identification of the suspected online child sexual abuse;

Added:(j) every case of a reasoned and verified suspicion of online child sexual abuse is reported without delay to the competent national law enforcement authorities or to organisations acting in the public interest against child sexual abuse.

Added:2. Until … [eight months after the date of entry into force of this Regulation], the condition set out in paragraph 1, point (c), shall not apply to providers that:

Added:(a) were using a specific technology before … [the date of entry into force of this Regulation] for the purposes set out in paragraph 1, point (a)(i), without having completed a prior consultation procedure in respect of that technology;

Added:(b) start a prior consultation procedure before … [one month after the date of entry into force of this Regulation]; and

Added:(c) duly cooperate with the competent supervisory authority in connection with the prior consultation procedure referred to in point (b).

Added:3. Until … [eight months after the date of entry into force of this Regulation], the condition set out in paragraph 1, point (d), shall not apply to providers that:

Added:(a) were using a technology as referred to in paragraph 1, point (d), before … [the date of entry into force of this Regulation] without having completed a prior consultation procedure in respect of that technology;

Added:(b) start a procedure as referred to in paragraph 1, point (d), before … [one month after the date of entry into force of this Regulation]; and

Added:(c) duly cooperate with the competent supervisory authority in connection with the procedure referred to in paragraph 1, point (d).

Added:The data included in the report referred to in paragraph 1, point (g)(vii), shall be provided in writing by means of a standard form. By … [three months after the date of entry into force of this Regulation], the Commission shall determine the content and presentation of that form by means of implementing acts. In doing so, the Commission may divide the data categories listed in paragraph 1, point (g)(vii), into subcategories.

Added:Those implementing acts shall be adopted in accordance with the advisory procedure referred to in Article 10(2).

Added:Article 4 European Data Protection Board guidelines

Added:By … [one month after the date of entry into force of this Regulation], and pursuant to Article 70 of Regulation (EU) 2016/679, the Commission shall request the European Data Protection Board to issue guidelines for the purpose of assisting the supervisory authorities in assessing whether processing falling within the scope of this Regulation, for existing and new technologies used for the purposes set out in Article 3(1), point (a)(i), of this Regulation, complies with Regulation (EU) 2016/679.

Added:Article 5 Effective judicial remedies

Added:In accordance with Article 79 of Regulation (EU) 2016/679 and Article 15(2) of Directive 2002/58/EC, users shall have the right to an effective judicial remedy where they consider that their rights have been infringed as a result of the processing of personal and other data for the purposes set out in Article 3(1), point (a)(i), of this Regulation.

Added:Article 6 Supervisory authorities

Added:The supervisory authorities designated pursuant to Chapter VI, Section 1, of Regulation (EU) 2016/679 shall monitor processing falling within the scope of this Regulation in accordance with their competences and powers under that Chapter.

Added:Article 7 Public list of organisations acting in the public interest against child sexual abuse

Added:1. By … [one month after the date of entry into force of this Regulation], providers shall communicate to the Commission a list of the names of organisations acting in the public interest against child sexual abuse to which they report online child sexual abuse under this Regulation. Providers shall communicate any changes to that list to the Commission on a regular basis.

Added:2. By … [two months after the date of entry into force of this Regulation], the Commission shall make public a list of the names of organisations acting in the public interest against child sexual abuse communicated to it under the paragraph 1. The Commission shall keep that public list up to date.

Added:Article 8 Statistics

Added:1. By … [one year after the date of entry into force of this Regulation], and on an annual basis thereafter, the Member States shall make publicly available and submit to the Commission reports with statistics on the following:

Added:(a) the total number of reports of detected online child sexual abuse that have been submitted by providers and organisations acting in the public interest against child sexual abuse to the competent national law enforcement authorities, differentiating, where such information is available, between the absolute number of cases and those cases reported several times and the type of provider on whose service the online child sexual abuse was detected;

Added:(b) the number of children identified through actions pursuant to Article 3, differentiated by gender;

Added:(c) the number of perpetrators convicted.

Added:2. The Commission shall aggregate the statistics referred to in paragraph 1 of this Article and shall take them into account when preparing the implementation report pursuant to Article 9.

Added:Article 9 Implementation report

Added:1. On the basis of the reports submitted pursuant to Article 3(1), point (g)(vii), and the statistics provided pursuant to Article 8, the Commission shall, by … [18 months after the date of entry into force of this Regulation], prepare a report on the implementation of this Regulation and submit and present it to the European Parliament and to the Council.

Added:2. In the implementation report, the Commission shall consider, in particular:

Added:(a) the conditions for the processing of personal data and other data set out in Article 3(1), point (a)(ii), and points (b), (c) and (d);

Added:(b) the proportionality of the derogation provided for by this Regulation, including an assessment of the statistics submitted by the Member States pursuant to Article 8;

Added:(c) developments in technological progress regarding the activities covered by this Regulation, and the extent to which such developments improve accuracy and reduce the numbers and ratios of errors (false positives).

Added:Article 10 Committee procedure

Added:1. The Commission shall be assisted by a committee. That committee shall be a Committee within the meaning of Regulation (EU) No 182/2011.

Added:2. Where reference is made to this paragraph, Article 4 of Regulation (EU) No 182/2011 shall apply.

Added:Article 11 Entry into force and application

Added:This Regulation shall enter into force on the third day following that of its publication in the Official Journal of the European Union.

Added:It shall apply until 3 April 2028.

Added:This Regulation shall be binding in its entirety and directly applicable in all Member States.

Added:Done at …,

Added:For the European Parliament For the Council

Added:The President The President