The publication of the four summary reports is based on GRECO's rules of procedure. Summary reports are published within six months of the report's adoption if the state concerned does not authorise the publication of the full report.
GRECO also announced that, following the reports, it had concluded the fourth-round compliance procedures for Denmark and Ukraine. Hungary and Türkiye remain subject to GRECO's compliance procedures and have been invited to report on their progress in 2027.
Meanwhile, on 9 October 2026, GRECO could publish the full compliance report on Denmark. In this context, GRECO regretted that twelve years after the adoption of the fourth-round evaluation report on Denmark, none of its recommendations addressed to members of parliament have been fully implemented. According to the compliance report, GRECO hold essential that a Code of Conduct for members of the Danish parliament is issued, supported by counselling, awareness-raising, and effective supervisory measures.
]]>Graves has worked as a prosecutor for the Crown Prosecution Service since 2007 and specialised in serious economic, organised and international crime. Since 2020, she has worked in the field of international judicial cooperation. In 2025, she joined Eurojust as Assistant to the UK Liaison Prosecutor. Graves succeeds Christopher Williams as the UK’s liaison prosecutor at Eurjust; he had previously taken up the post in March 2022 (→eucrim 1/2022, 19-20).
]]>The proceedings date back to April 2022, when the Commission sent Germany a letter of formal notice after detecting a gap in the transposition of the LED in relation to the activities of the Federal Police (Bundespolizei). According to the Commission, Germany had still not adopted relevant transposition measures by July 2026. A bill to modernise the Federal Police Act, which includes provisions intended to implement the LED, was already pending before the Bundestag. Two days after the Commission’s decision, however, an initial attempt to secure its final adoption was unsuccessful. Germany was given two months to remedy the shortcomings; otherwise, the Commission could refer the case to the CJEU and request financial sanctions.
Germany had already been subject to an earlier infringement procedure concerning incomplete transposition of the LED at Länder level. In July2019, the Commission sent a letter of formal notice after finding that only ten of the sixteen Länder had adopted implementing measures by the end of the transposition period (→eucrim 2/2019, 104). This was followed up with a reasoned opinion in May 2020, when measures from five Länder were still outstanding. The Commission’s first evaluation report on the LED, published on 25 July 2022 (COM(2022) 364 final; →eucrim 3/2022, 187) noted the separate transposition gap concerning the Federal Police.
]]>The Action Plan builds on the existing EU legal framework for AI and cybersecurity, which includes the AI Act, the Cyber Resilience Act, the NIS2 Directive, the Digital Operational Resilience Act for the financial sector, and the Cyber Solidarity Act. The Commission stresses that these instruments already provide important legal and operational foundations, but that additional measures are needed to address the specific risks and opportunities created by advanced AI-enabled cyber capabilities.
Seeking to make the AI frontier safe, accessible, and deployable for cybersecurity purposes, the Commission will support the creation of an EU evaluation capacity for AI models, including cybersecurity aspects – expected for 2027. This capacity is intended to strengthen third-party assessment of advanced AI capabilities and support the regulatory work of the AI Office. In addition, the Commission, together with the European Union Agency for Cybersecurity (ENISA), will develop a European blueprint for structured access to advanced AI capabilities for cybersecurity purposes. The blueprint is intended to help public and private European actors, including critical infrastructure operators and cybersecurity providers, access such capabilities safely and without undue delay.
The Action Plan is structured around three main pillars:
Finally, the Action Plan contains an international dimension. The Commission emphasises that AI-enabled cyber risks are global and that cooperation with like-minded partners is necessary to avoid fragmentation, strengthen trusted access to advanced AI capabilities, and adapt vulnerability management practices. The EU intends to pursue these objectives in bilateral and multilateral settings, including the G7, cooperation with partner countries, international AI evaluation networks, and exchanges with NATO.
]]>The report concerns the DSA risk-management framework for Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs). Under Arts. 34 and 35 DSA, these providers must assess systemic risks arising from the design, functioning, and use of their services, including their algorithmic systems, and put in place reasonable, proportionate, and effective mitigation measures. The report is based on a broad range of sources.
The systemic risks identified in the report are grouped into several categories, including:
A particular focus is placed on the protection of minors who are concerned with the most prominent and recurrent systemic risks identified: grooming, exposure to harmful or age-inappropriate content, unsafe account settings, addictive or compulsive design features, cyberbullying, and the dissemination of AI-generated or manipulated sexual content.
The report further discusses how artificial intelligence affects several risk categories: sexual abuse material, illegal hate speech, disinformation, gender-based violence, public security, and health misinformation. At the same time, it also refers to mitigation measures involving automated tools, hash-matching, detection systems, content provenance standards, AI-generated content labels, watermarks, and AI red-teaming.
As regards mitigation, the report does not identify any measures as “best practices” or “good practices”. Instead, it maps mitigation approaches currently reported or observed across different types of services: terms and conditions and their enforcement, content moderation and risk detection, safety-by-design measures, user empowerment tools, awareness measures, and out-of-court dispute settlement. Additional measures cover social media platforms, online marketplaces, pornographic platforms, and online search engines.
The report highlights the importance of stakeholder engagement and data access. It reiterates that effective risk assessment and mitigation should involve users, affected groups, civil society organisations, independent experts, and researchers. It further notes that reliable data access and third-party scrutiny are important for identifying systemic risks and assessing whether mitigation measures are effective or not.
In its outlook, the report underlines that the DSA risk-management framework is still in the early stages of implementation. Future reports are expected to benefit from enforcement practice, stakeholder expertise, monitoring under DSA codes of conduct, and research outputs resulting from the Art. 40 DSA data-access mechanism.
]]>The resolution points to the increasing use of children as part of the operational strategies of criminal and terrorist groups: they may be used to shield adult perpetrators from detection and prosecution, to expand illicit activities, or to perform low-risk tasks with limited knowledge of the wider criminal network. According to Europol data, minors are involved in more than 70% of illegal market activities, including drug trafficking, extortion, online fraud, money laundering, illicit firearms trafficking, and violence-as-a-service schemes.
MEPs called for the future EU action plan on the protection of children against crime to include the following:
As regards criminal law, Parliament asked the Commission to address child recruitment in the upcoming proposal to modernise EU rules on organised crime. MEPs suggested that the recruitment of children could be treated as an aggravating circumstance and reinforced their call for a new common definition of “criminal organisation” – taking into account the use of violence, corruption, or intimidation. They also called for a revision of the EU Pyrotechnics Directive in order to address the use of pyrotechnics as weapons, including the exploitation of vulnerable young people.
The resolution further highlights the role of drug-related intimidation as a recruitment pathway and calls on Member States to incorporate interagency responses into national strategies. MEPs also urged stronger cooperation between Member States, Europol, and Eurojust, particularly in ports, logistics hubs, and urban areas with vulnerable communities.
A central part of the resolution concerns the online dimension of child recruitment. Parliament warned that digital services are used to identify, target, groom, manipulate, and coerce children. It called for robust and consistent enforcement of the Digital Services Act, in line with the Commission’s guidelines on the protection of minors, and for stronger protection of minors through the upcoming Digital Fairness Act. MEPs also welcomed Europol’s Operational Taskforce GRIMM and called for joint investigations to target recruiters, instigators, and high-level actors, rather than focus only on minors who carry out offences.
Parliament finally called for stronger international cooperation, better data collection, and adequate EU funding for civil society organisations, community-based initiatives, sports associations, and educational programmes in areas particularly exposed to organised crime recruitment.
]]>The operation was part of Project Medusa, which was launched in April 2026 to strengthen the cross-border investigation of DFSA and disrupt online networks facilitating such offences. The investigations revealed that perpetrators use encrypted messaging services, forums, and closed chat groups to exchange information and material, normalise abusive behaviour, facilitate the illegal trade in prescription medicines and narcotics, and coordinate offences. Europol stressed that the detected crimes are not isolated incidents but a pattern of organised, mutually reinforcing behaviour.
The offences predominantly target women and may be committed over extended periods. In some cases, perpetrators exploit positions of trust or professional authority. The investigations concerned not only rape and sexual assault, but also dangerous bodily harm and attempted murder, given the risks associated with the deliberate sedation of victims.
Since the launch of Project Medusa, 113 investigations have been initiated, resulting in 57 arrests and the safeguarding of 158 victims. The June operation identified 156 victims and perpetrators, and it generated 274 new investigative leads. In addition, four new misogynist online communities were identified.
]]>The visual publications present the main findings, figures, and developments in focused, easy-to-read overviews. They complement the full Annual Report by allowing readers to access specific aspects of Eurojust’s work without having to consult the report as a whole. This facilitates a quicker overview of the Agency’s activities from its 2025 casework: key developments, achievements, and trends in 2025.
Four areas are covered:
On 11 August 2026, Flavia Roy took up her duties as Liaison Prosecutor for Switzerland at Eurojust. She had already been working at Eurojust since November 2024 as Deputy Liaison Prosecutor and is also a member of Eurojust’s Economic Crime Team. Before joining Eurojust, she worked as a public prosecutor and investigative judge in Switzerland. She succeeds Philip Schotland, who held the post from September 2024 until mid-2026.
On 3 August 2026, Lukáš Starý was appointed National Member for the Czech Republic. He previously served as Deputy National Member and has worked at the Czech National Desk at Eurojust since 2011. During his time there, he has been involved in several thematic teams, including as Chair of the Trafficking Team and the Board on Relations with Partners. Before joining Eurojust, he worked as a prosecutor in the Czech Republic, including in the International Department of the General Prosecutor’s Office. Lukáš Starý succeeds Pavel Zeman as the Czech National Member at Eurojust.
Lastly, Alexandru Cladco took up his duties as Liaison Prosecutor for the Republic of Moldova in July 2026. He has been seconded from the Moldovan General Prosecutor’s Office for a five-year term. Mr Cladco has more than 20 years of prosecutorial experience and has held several positions in the field of international cooperation, including as Head of the International Cooperation and European Integration Department of the General Prosecutor’s Office.
]]>The four episodes look at different aspects of the changing cybercrime landscape. The first explores cybercrime enablers, including dark web marketplaces, cryptocurrencies, and increasingly sophisticated infrastructures used by criminals to avoid detection. The second examines how offenders involved in child sexual exploitation are adapting to new technologies, including the use of AI and end-to-end encrypted platforms. The third focuses on the evolution of ransomware, addressing ransomware-as-a-service, attacks on digital supply chains, social engineering, and the increasingly blurred lines between cybercriminals and hybrid threat actors. The final episode examines the growing threat of online fraud, including the use of AI to personalise fraudulent approaches to individuals and organisations. A bonus episode on child sexual abuse material (CSAM) answers questions raised during Europol’s preceding live expert session and discusses, inter alia, the use of new technologies to detect and generate CSAM, changing offender behaviour and the role of law enforcement cooperation.
The episodes are available via Europol, YouTube, and major podcast platforms.
]]>The stopgap regime, introduced in 2021 as a bridge to a long-term solution, allows providers of number-independent interpersonal communications services to derogate from certain confidentiality requirements under the ePrivacy Directive. It thereby enables them to continue using specific technologies for the processing of personal and other data, to the extent strictly necessary to detect and report online child sexual abuse and to remove CSAM from their services. This is also called "chat control 1.0".
The reinstatement follows the temporary legal gap. The previous interim regime expired on 3 April 2026 after the institutions had initially failed to agree on an extension with the European Parliament rejecting the extension on 26 March 2026.
After the expiry of the previous regime, the legislative process resumed. On 23 July 2026, the Council accepted the European Parliament’s amendments and gave green light to Regulation 2026/1881.
A key change concerns encrypted communications. The Regulation expressly provides that it does not apply to interpersonal communications to which end-to-end encryption is, has been, or will be applied. It also states that nothing in the Regulation should be interpreted as prohibiting or weakening end-to-end encryption. The derogation therefore does not authorise measures that would circumvent end-to-end encryption or enable client-side scanning of encrypted communications.
The Regulation nevertheless remains framed as an interference with fundamental rights. Its recitals acknowledge that voluntary detection measures affect the rights to respect for private and family life and to the protection of personal data. It also stresses that the confidentiality of communications is relevant not only for users in general, but also for communications between victims of child sexual abuse and trusted adults, organisations active in the fight against child sexual abuse, and lawyers.
The reinstated interim regime applies against the background of a prolonged and contested legislative process for a long-term solution. In 2022, the Commission proposed establishing a permanent framework, including risk assessments, detection obligations (also called "chat control 2.0"), and the creation of an EU Centre on child sexual abuse to coordinate efforts (→ eucrim 2/2022, 91-92 and →eucrim 3/2023, 246 with further references). The proposal has since faced sustained criticism, particularly regarding its implications for privacy and encrypted communications (→ eucrim 1/2023, 13-14).
Institutional positions have also diverged. The European Parliament called for a more limited and proportionate approach, while the Council, in its 2025 position, moved away from broad detection orders towards a more risk-based system that preserves voluntary detection practices (→eucrim 4/2025, 260-261). Trilogue negotiations between the EP, Council, and Commission on the permanent framework are ongoing.
The reinstated interim Regulation closes the immediate legal gap, but the central tension remains unresolved: how to ensure effective detection of child sexual abuse online without undermining the confidentiality of private communications, data protection, and other fundamental rights.
]]>At a conference in Chișinău, organised by the Council of Europe together with the Agency for Medicines and Medical Devices of the Republic of Moldova's Ministry of Health, participants acknowledged the growing global threat posed by the falsification of medical products and related crimes. They pointed out that criminal networks are increasingly exploiting online sales, social media, encrypted apps, and e-commerce platforms to distribute falsified products. Of particular concern are lifestyle products, such as weight-loss and performance-enhancing drugs, which promise high profits for organised crime. At the same time, emerging technologies, including artificial intelligence, are being used to generate fake endorsements and testimonials. Other concerns include the falsification of veterinary medical products and the increasing circulation of illicit medical products in sports.
Against this backdrop, the conclusions include a number of recommendations for future actions, among other things:
Other priority areas include raising public awareness, particularly about the risks associated with online purchases, and strengthening victim protection and access to justice.
At the conference in Chișinău, the committee of parties to the MEDICRIME convention also adopted a new report on “The Medicrime Convention in the age of AI: challenges and opportunities”. This report was prepared by Prof. Fernando Miró Llinares from the University Miguel Hernández of Elche (Spain). It evaluates the impact of AI on the applicability and relevance of the MEDICRIME Convention, and reflects on the need to update, reinterpret, or strengthen the provisions of the Convention considering the emerging challenges associated with AI.
]]>The project addresses persistent challenges in CAP fraud prevention, including uneven detection capacities, fragmented information exchange and different levels of digital readiness across Member States. Particular attention is given to fraud risk analysis and the application of AI, machine learning and big data analytics to CAP fund management and control. More information is available at the project website.
GINGER is structured around 10 international events bringing together public authorities, Anti-Fraud Coordination Services (AFCOS), paying agencies, EU institutions, academia and private-sector stakeholders to exchange practices and develop data-driven approaches to fraud prevention. Participation is open to all interested participants, and all events are accessible online, including those hosted in person. A certificate of attendance is provided for each event.
Through training, peer learning, risk-mapping and collaborative activities, the project will progressively develop the GINGER Learning Package, consolidating the knowledge and methodologies generated throughout the project into practical resources for future training and capacity-building initiatives.
The first two events have already taken place, and the third event entitled “From Red Flags to Risk Maps: AI and Big Data for Early Warning”, will be held online on 21 September 2026. Registration is already open: <https://forms.gle/hXyeuGw9VDH2Ed6g7>
Further information on the project, including the complete overview and schedule of upcoming events, presentations, recordings and other materials from completed activities, is available in the dedicated GINGER dissemination folder: <https://drive.google.com/drive/folders/1fhgqj8jO-sUtZjCfk46A3BGEiASYlmcC?usp=drive_link>.
For information on upcoming events, inclusion in the GINGER mailing list, or to express interest in contributing as an expert or speaker and/or involving your organisation in the project network, please contact ginger.project@unitelmasapienza.it.
Project updates are also available on LinkedIn: @GINGER - EU Funds Governance & Innovation.
]]>The case concerned a vehicle registered in Bulgaria that was stopped during a police check. The Bulgarian authorities found that the vehicle’s chassis number matched an alert entered in the SIS by Germany and the temporary Head of the 3rd District Police Department at the Sofia Directorate for Internal Affairs, Bulgaria. The alert concerned a vehicle sought for use as evidence in criminal proceedings.
Following the hit, the Bulgarian authorities seized the vehicle and contacted the German SIRENE Bureau. The German authorities stated that the vehicle had been reported in connection with an offence of unlawful appropriation and that the company identified as the rightful owner wished to have it returned. The Bulgarian authorities then ordered the vehicle to be surrendered to a representative of that company.
The person registered as the owner of the vehicle in Bulgaria challenged the surrender order before the Bulgarian courts. He argued, in substance, that he had been excluded from the administrative and judicial procedure concerning the return of the vehicle, even though the measure affected his rights and interests.
The referring Varhoven administrativen sad (Supreme Administrative Court, Bulgaria) is uncertain as to whether the Bulgarian legislation complies with the SIS Regulation when right holders have no participatory rights in the return proceedings.
The ECJ held that Art. 39 of Regulation 2018/1862 lays down the steps to be taken following a hit on an object alert: the executing Member State must seize the object in accordance with national law and contact the issuing Member State in order to agree on the measures to be taken. However, the Regulation does not determine the procedural rules governing a subsequent national decision to surrender or repatriate the object in response to the issuing Member State’s request.
Therefore, national rules on the adoption of such a surrender decision do not fall within the scope of Regulation 2018/1862. The definition of procedural rules is entirely up to the national law. Since that national procedure was not considered to constitute the implementation of EU law within the meaning of Art. 51(1) of the Charter, the Charter was not applicable either. Consequently, the ECJ did not answer the separate question concerning effective judicial protection under Art. 47 of the Charter.
]]>The case concerned criminal proceedings in Slovakia against AC for defamation. The accused had allegedly posted several videos online containing false allegations about another person. The court of first instance twice discontinued the proceedings, finding that the conduct described in the indictment did not constitute a criminal offence.
The prosecutor appealed. The appellate court set aside the discontinuance orders and referred the case back to the lower court. In its reasoning, however, the appellate court used strong factual language, stating, among other things, that the evidence showed “beyond doubt” that the accused had used lies and that certain events described by him had never taken place.
The criminal court now competent to decide on the criminal proceedings against AC at first instance was concerned that the statements by the appellate court might breach the presumption of innocence. Under Slovak procedural law, the lower court would normally be bound by the legal views expressed by the appellate court. It therefore asked the ECJ whether such appellate findings were compatible with Directive 2016/343on the presumption of innocence and what the lower court should do if they were not.
The ECJ held that Directive 2016/343 does not prevent an appellate criminal court from examining incriminating evidence in detail at a preliminary stage of the proceedings. Nor does the Directive, as such, prevent the appellate court from assessing whether the constituent elements of the alleged offence may be present, even where the accused has not yet had the opportunity to comment on all evidence.
However, the ECJ stressed that the reasoning must not imply guilt before it is legally established. The key question is whether the decision’s wording, context, and overall reasoning convey only suspicion or instead a premature finding of guilt. It noted that expressions suggesting that all elements of the offence are already established may indicate a breach of the presumption of innocence, but left the final assessment to the national court.
Looking at the binding effect of appellate court decisions under national law, the ECJ held that, if the lower court finds that the appellate court’s rulings are incompatible with the presumption of innocence, it must disregard those rulings, even if national law would normally require it to follow them. This follows from the direct effect of Art. 3 of Directive 2016/343 and the primacy of EU law. However, the lower court need not disregard the appellate decision in its entirety: it may still have to comply with procedural measures ordered by the appellate court, such as continuing the proceedings following remittal.
]]>During his first term as Administrative Director (→eucrim news of 12 October 2023), Jamin oversaw several key developments for the Agency:
The case arose from criminal proceedings in Italy concerning serious fraud, money laundering, and participation in a criminal organisation. An Italian court ordered the confiscation of immovable properties of the company involved in the fraud scheme that were located in Slovenia and considered to constitute the proceeds of the offences. The confiscation order was transmitted to the Slovenian authorities for recognition and execution in March 2019.
Before the recognition and execution proceedings in Slovenia, in October 2018 and February 2019, a Slovenian company had registered judgment mortgages over one of the properties in order to secure its claims against the convicted company. It argued that it was a bona fide third party and that execution of the Italian confiscation order would prejudice its rights as a mortgage creditor. The Slovenian court, which has to decide on the execution of the Italian confiscation order, therefore asked the ECJ whether such a creditor could fall within the protection of Art. 8(2)(d) of Framework Decision 2006/783.
According to this provision, "[t]he competent judicial authority of the executing State (...) may also refuse to recognise and execute the confiscation order if it is established that: the rights of any interested party, including bona fide third parties, under the law of the executing State make it impossible to execute the confiscation order, including where this is a consequence of the application of legal remedies in accordance with Article 9".
The ECJ held that a mortgage creditor may qualify as an interested party and, potentially, as a bona fide third party within the meaning of Art. 8(2)(d) of Framework Decision 2006/783. As a result, the competent authority of the executing Member State may refuse to recognise or execute a confiscation order if the creditor’s rights make execution impossible under national law.
The ECJ clarified that, for the bona fide status, it must be established that that third party was not aware of the fact that the purpose of that transfer or acquisition was, for the suspected or accused person, to avoid confiscation. The creditor’s bona fide status must be assessed by the national court in light of all the circumstances. The fact that the judgment mortgage was registered before the recognition and execution proceedings – and even before the confiscation order itself – may indicate the absence of fraudulent behaviour. At the same time, the national court must consider circumstances that may point in the opposite direction, such as whether insolvency or criminal proceedings were already pending when the mortgage was registered.
The ECJ therefore concluded that Art. 8(2)(d), read in light of Art. 17(1) of the Charter, allows the executing Member State to refuse recognition or execution of a confiscation order concerning immovable property that constitutes proceeds of crime where the rights of a bona fide mortgage creditor would make execution impossible. It remains for the national court to determine whether the creditor was in fact acting in good faith.
]]>Third countries that have posted a Liaison Prosecutor to Eurojust are among the most frequently involved non-EU partners, benefiting from the possibility of systematic exchanges of personal data. Liaison Prosecutors posted at Eurojust can facilitate the opening of cases involving EU Member States and may be invited to participate in cases initiated by the Member States. Their role has become a key component of Eurojust’s operational cooperation with international partners.
Twelve Liaison Prosecutors are currently seconded to Eurojust. Against this background, and with a view to further expanding Eurojust’s network of international partners, Eurojust and the Dutch Government signed an amendment to the Agency’s Seat Agreement on 3 July 2026. The amendment supports Eurojust’s increasing cooperation with countries outside the EU, including through the continued deployment of Liaison Prosecutors seconded to the Agency.
]]>