In an investigation opened by the EPPO in 2021 against Mr. Mincu Pătrașcu Brâncuși, the EPPO ordered that he be brought to trial before the competent Romanian court in proceedings relating to alleged participation in a criminal organisation and fraud affecting the financial interests of the EU. The applicant sought to have this decision annulled before the General Court of the European Union, arguing that it infringed his fundamental rights and should be subject to direct review at EU level. However, the General Court dismissed the action as inadmissible for lack of jurisdiction (Case T-385/23). The matter was subsequently appealed before the CJEU.

In its judgment of 16 April 2026, the CJEU upheld the General Court’s conclusion and dismissed the appeal in its entirety. The Court held that, under EU law, jurisdiction to review procedural acts of the EPPO with legal effects vis-à-vis third parties lies, as a rule, with the national courts rather than the courts of the EU. The CJEU emphasised that EPPO investigations are closely integrated into national criminal proceedings and that the final determination of criminal liability rests with the competent national courts. Accordingly, challenges to EPPO procedural measures must ordinarily be brought before national courts, which retain the ability to refer questions of EU law to the CJEU under the preliminary ruling procedure where necessary. At the same time, the CJEU confirmed that the EU legislature was entitled to establish such a system of judicial review in light of the institutional design and mandate of the EPPO, and that this framework does not infringe the right to an effective judicial remedy or to a fair trial.

Under the title “The evolving threat landscape: how encryption, proxies and artificial intelligence are expanding cybercrime”, the 2026 Internet Organised Crime Threat Assessment provides a detailed analysis of significant developments, changes, and emerging threats in cybercrime in 2025. The report contains four chapters looking at cybercrime enablers, the criminal infrastructure behind online fraud schemes, cyber-attacks, and online child sexual exploitation.

Regarding cybercrime enablers, the report highlights how cybercriminals are adopting more resilient, anonymous, and sophisticated methods to evade detection and maintain their operations despite law enforcement efforts. Key developments include:

• Dark web marketplaces are increasingly fragmented, with many platforms specializing in specific criminal activities rather than offering a broad range of illicit services.
• Criminal marketplaces remain highly resilient, as new platforms quickly emerge and online forums enable the migration of users and vendors after disruptions.
• Cryptocurrencies remain the preferred payment method for ransomware attacks.
• The growing use of privacy-focused digital currencies and transaction-mixing services makes financial investigations more difficult.
• The distinction between the surface web and the dark web is becoming less clear as encrypted communication platforms and anonymous services increasingly connect both environments.
• Criminals exploit weaknesses in the domain name registration process by using newly registered domains before law enforcement agencies can detect and disrupt them.
• Cybercriminals are deploying increasingly complex technical infrastructures, including multilayered hosting arrangements, anonymous routing techniques, and residential proxy networks.

In the area of criminal infrastructure behind online fraud schemes, the report warns that online fraud is becoming more sophisticated, scalable, and difficult to detect, driven by evolving criminal infrastructures and the growing use of advanced technologies.

• Online fraud schemes continue to expand.
• Phishing remains one of the most common fraud methods
• The misuse of subscriber identity module box devices enables criminals to conduct large-scale attacks through mass communication and identity spoofing.
• Some criminal groups are moving away from commercial hosting providers and building their own infrastructure to avoid identity verification requirements.
• The theft of digital assets has evolved into a crime-as-a-service model,
• Generative artificial intelligence is helping fraudsters create more convincing and personalized scams.
• Autonomous artificial intelligence systems are expected to automate parts of the criminal process and significantly increase the scale and effectiveness of online fraud.

Regarding cyber-attacks, the report highlights a ransomware ecosystem that is becoming more fragmented, competitive, and adaptable, with criminal groups continuously evolving their methods and services.

• The ransomware landscape remains highly volatile, with new ransomware brands emerging due to competition among criminal groups, law enforcement disruptions, and access to new technologies.
• Ransomware attacks continue to increase, with more than 120 active ransomware brands observed during 2025.
• Ransomware-as-a-service groups are expanding their offerings to attract affiliates, including the integration of artificial intelligence tools and more customizable services.
• Significant overlaps exist between different ransomware operations, as affiliates and administrators often work across multiple brands and campaigns.
• Affiliates and administrators play a central role in sustaining and expanding the ransomware ecosystem, contributing to its resilience despite enforcement actions.
• Hybrid threat actors increasingly use cybercriminal networks as proxies to conduct distributed denial-of-service attacks, ransomware operations, data theft campaigns, and attacks against strategically important targets.

Finally, the report highlights an increasingly complex and harmful landscape of online child sexual exploitation, driven by financial incentives, new technologies, and secure communication platforms.

• Extortion remains a major component of child sexual exploitation, with victims coerced into sending money, producing additional sexual material, or engaging in harmful and abusive acts under threat.
• The trade in child sexual abuse material for financial gain is increasing, alongside a persistent threat from live-distant child abuse and a growing number of scam platforms involved in selling or distributing such material.
• The emergence of artificially generated child sexual abuse material is creating additional challenges for detection, victim identification, and law enforcement investigations.
• End-to-end encrypted messaging applications are widely used by offenders for grooming, sharing illegal material, and coordinating activities due to the difficulty authorities face in accessing communications.
• Criminal networks are exploiting both financial incentives and technological tools to expand the scale, reach, and concealment of child sexual exploitation activities.

Looking ahead, the report warns of a future in which cybercrime becomes increasingly automated through advanced artificial intelligence systems capable of carrying out criminal activities with minimal human involvement. Cybercriminal groups are expected to become more resilient and harder to identify, while collaborations between state-linked actors and criminal networks may intensify cyber threats against governments, businesses, and critical infrastructure. Online fraud is likely to grow in scale and sophistication as artificial intelligence enables highly convincing scams and automates criminal operations. The spread of synthetic child sexual abuse material, combined with the wider use of end-to-end encryption and decentralized platforms, is expected to create significant challenges for law enforcement. Criminals are also likely to continue exploiting cryptocurrencies, offshore financial services, and fintech platforms to move and conceal illicit funds.

Key figures and operational activities

• In 2025, Eurojust handled almost 14000 cases, representing an increase of nearly 60 % compared to 2020, when 8 799 cases were registered.
• For the first time, Eurojust registered a record number of 28 own-initiative cases.
• The most common crime types addressed by the Agency were swindling and fraud, drug trafficking and money laundering, which together accounted for approximately two thirds of all cases handled in 2025.
• Detailed statistics are provided in the report for a broad range of crime areas, including cybercrime, migrant smuggling, trafficking in human beings, corruption, terrorism, environmental crime and intellectual property crime.

Judicial cooperation and coordination

Eurojust continued to support national prosecutors and investigative authorities through a broad range of judicial cooperation instruments, including:

• European Investigation Orders (48.1 % of open cases in 2025); mutual legal assistance requests (29.7 %); European Arrest Warrants and extradition proceedings (7.4 %); freezing and confiscation orders (5.2 %); conflicts of jurisdiction and transfers of proceedings (at least 4.3 %); and an increasing number of transfers of sentenced persons.
• The number of coordination meetings organised by Eurojust has steadily increased over the past five years, reaching 653 meetings in 2025. Economic crimes accounted for the highest number of coordination meetings (258), followed by drug trafficking (119) and cybercrime (102).

Joint Investigation Teams, EIOs and EAWs

• Eurojust supported 11 % more Joint Investigation Teams (JITs) than in 2024.
• In total, the Agency facilitated 412 JITs in 2025, approximately one third of which were newly established during the year. The majority of newly established JITs concerned drug trafficking and money laundering cases.
• Eurojust also continued to support national authorities throughout all stages of the European Investigation Order process, from drafting to execution. A total of 6711 Eurojust cases, including 2751 new cases, involved an EIO, representing an increase of almost 7% compared to the previous year.
• The number of cases involving European Arrest Warrants handled by the Agency increased by approximately 6 % compared to 2024.

International role and external cooperation

In 2025, Eurojust further reinforced its role in international cooperation and the global fight against crime. The Agency’s international network currently includes 80+ contact points worldwide; 13 cooperation agreements and 12 working arrangements with third countries and international organisations; and 12 liaison prosecutors.

• In 2025, Eurojust welcomed the conclusion of the cooperation agreement between the EU and Lebanon.
• The Agency also concluded new strategic Working Arrangements with Egypt, South Korea, the Dominican Republic, Paraguay and Uruguay.
• Furthermore, previously concluded Working Arrangements continued to prove effective, as the number of judicial assistance requests channelled through Eurojust more than tripled in 2025 compared to 2024.

Victims’ rights

Protecting victims’ rights remained a key priority in Eurojust’s operational and strategic activities. In 2025, the Agency placed particular emphasis on the identification and definition of victims in a cross-border context. In cases handled by Eurojust during the year, at least 3.1 million crime victims were affected. Accordingly, victims’ rights featured prominently in a number of conferences, meetings and publications organised or supported by the Agency in 2025.

Evaluation of the Eurojust Regulation

The year 2025 was also marked by the publication, in July 2025, of the European Commission’s first evaluation of the Eurojust Regulation, covering its implementation between the end of 2019 and 2024 (→eucrim 2/2025, pp 130-131). The evaluation assessed the effectiveness of the Regulation and the extent to which its objectives had been achieved in practice. Following the evaluation, the European Commission launched preparations for an impact assessment aimed at strengthening Eurojust’s mandate and enhancing the Agency’s capacity to respond to the evolving international dimensions of organised crime and hybrid threats.

The proposed arrangement provides for cooperation in areas including training, exchange of expertise, and risk analysis. Initialling confirms agreement on the text by both sides but does not yet create legal obligations and the arrangement has not entered into force.

Before it can be signed, the text must still complete several approval procedures, including review by the European Commission, the European Data Protection Supervisor, and Frontex’s Fundamental Rights Officer and Management Board.

The process to appoint a new Executive Director is now underway. Applications closed on 31 March 2026, and a selection committee set up by the Management Board will conduct interviews and an assessment centre before the Board submits a shortlist of at least three candidates. Under the Europol Regulation, the European Parliament will be consulted, while the final appointment decision will be made by the Council. The selection procedure is expected to continue for several months, with the appointment of a new Executive Director anticipated by the end of 2026. The successful candidate will be appointed for a four-year term, renewable once.

In the meantime, interim arrangements introduced on 2 May will remain in place until the new Executive Director takes office. Following a decision of the Europol Management Board, Jürgen Ebner has assumed the role of Acting Executive Director during the transition period.

In its reasoning, the ECJ calls to mind the fundamental role of the preliminary ruling procedure in general and the obligation to refer in particular for the judicial system of the European Union. An exemption from the obligation to refer exists only in the three exceptional cases set forth in the CILFIT ruling: the lack of relevance to the decision of the question of EU law raised; the existence of a decision by the Court of Justice in which the relevant provision of EU law has already been interpreted; or the existence of an “acte clair.” If courts decide against a referral, they must, taking into account the relevant factual and legal circumstances, set out concretely and specifically the reasons why one of these three exceptions would apply. A mere brief standard justification is not sufficient.

While the court of last instance may adopt the reasoning of a lower court, the lower court must, for its part, have explained why a question of EU law is not relevant to the decision, has already been clarified, or is unambiguous.

The background to the case was a legal dispute in the Netherlands in which a Moroccan family applied for a residence permit valid throughout the territory of the EU. Their appeal against the refusal of the permit was unsuccessful all the way up to the Dutch Council of State.

Overall, the ECJ’s decision in Remling strengthens the preliminary ruling procedure under EU law (Art. 267 TFEU). In practice, this means that the pressure on supreme courts to provide reasoning is increased, which can result in a noticeable additional burden, particularly when dealing with a high caseload.

According to a Commission press release of 30 March 2026, more than 45 million border crossings have already been recorded since the system’s launch. Over 24,000 people had been refused entry for different reasons.

The goal of the EES is to strengthen control of the EU’s external borders, systematically detect overstays, and combat document and identity fraud. In Romania, for instance, authorities recently discovered that an individual was attempting to travel using two different identities and had been denied entry on multiple previous occasions. Without the EES, this case would likely have gone undetected. The system is operated by the EU agency eu-LISA and also forms the technical basis for the European Travel Information and Authorization System (ETIAS), which is scheduled to go live at the end of 2026.

The JIT deals with several incidents that were recorded along transit routes of parcels that were sent from Lithuania to addresses in the UK and Poland in 2024. One parcel, which passed through a sorting centre in Germany, caught fire at Leipzig airport shortly before being loaded onto an aircraft. Another ignited in a warehouse in the United Kingdom, while a third caught fire in a truck in Poland.

Authorities were able to intercept one parcel before ignition, allowing for analysis of the device and its potential damage. The investigation also identified two “test packages” sent to the United States and Canada, as well as two parcels in Amsterdam intended for the same destinations.

Eurojust reported on 6 March 2025 that, according to investigators, suspected perpetrators were recruited and instructed via an online messaging service. Tasks were divided among several individuals, and payments were often made in cryptocurrencies. Investigators suspect the acts were carried out on behalf of the military intelligence service of the Russian Federation.

Eurojust continues to identify links to other investigations involving similar incidents, and to coordinate cooperation between the countries involved.

By recognising that these decisions are not merely internal steps but reviewable EU acts, the ECJ set aside the General Court, which declared WhatsApp’s action inadmissible (Case T-709/21), and referred the case back for a decision on the merits.

Facts of the case

The case arose from an investigation by the Irish Data Protection Commission into WhatsApp’s compliance with transparency obligations under the GDPR, following complaints from users and non-users. Acting as lead supervisory authority for cross-border processing, the Irish authority initiated an inquiry into WhatsApp’s data-sharing practices, including its exchanges with other entities within the Meta group.

After a draft decision was circulated to other supervisory authorities under the GDPR cooperation mechanism, several authorities raised objections. As no consensus could be reached, the dispute was referred to the EDPB under Art. 65 GDPR.

In July 2021, the EDPB adopted a binding decision requiring the Irish authority to revise its draft. The instructions included that additional GDPR infringements be found, that certain data (including data resulting from “lossy hashing”) be classified as personal data, and that the level of administrative fines be increased.

In August 2021, the Irish authority adopted its final decision, incorporating the EDPB’s findings. It imposed a reprimand, corrective measures, and fines totalling €225 million. While WhatsApp challenged that final decision before the Irish courts, it also brought an action for annulment before the General Court against the EDPB decision itself.

The General Court dismissed that action as inadmissible, considering the EDPB decision to be a preparatory act without independent legal effects and not directly concerning WhatsApp. WhatsApp appealed.

Judgment and reasoning

In its opposing judgment favouring the admissibility of the action under Art. 263 TFEU, the ECJ first clarified that the EDPB's decision cannot be regarded as intermediate step as it definitively determines its position on the issues referred to it and is legally binding on the national supervisory authorities concerned.

Second, the ECJ found that the decision was of direct concern to WhatsApp. The EDPB’s findings – such as the identification of additional infringements and the requirement to increase fines – directly affected WhatsApp’s legal situation. The Irish supervisory authority was bound by those findings and had no discretion to depart from them in its final decision. The absence of direct enforceability against WhatsApp did not preclude a finding of direct concern.

As a result, the ECJ rejected the General Court’s approach, which had focused on the intermediate nature of the EDPB decision and the availability of judicial remedies at national level. Therefore, the existence of parallel remedies (before national courts against the final decision and before EU courts against the EDPB decision) does not exclude direct concern.

Significance

The judgment strengthens judicial review within the GDPR enforcement system. It confirms that binding decisions adopted by the EDPB under Art. 65 GDPR are not merely internal coordination tools but legally relevant acts that can be challenged directly before the EU Courts.

More broadly, the ruling clarifies the structure of the GDPR’s “composite” enforcement mechanism. While national supervisory authorities formally adopt the final decision, the EDPB’s binding determinations on key legal issues can independently affect the rights and obligations of controllers. Those determinations must therefore be open to direct judicial scrutiny at EU level.

The EDPB and EDPS support the general objective of addressing implementation challenges and reducing administrative burdens. However, they stress that simplification must not weaken the protection of fundamental rights, especially the rights to privacy and data protection.

A central concern is the proposed extension of the legal basis that allows providers and deployers to process special categories of personal data for bias detection and correction. While the EDPB and EDPS accept that such processing may be necessary in some cases, they warn that it must remain narrowly circumscribed. They recommend keeping the current standard of strict necessity, particularly to prevent broad or abusive reliance on this exception for non-high-risk AI systems.

They also oppose removing the obligation to register certain AI systems in the EU database when providers claim that systems listed in Annex III of the AI Act are not high-risk. In their view, this would weaken transparency and accountability and could incentivise providers to rely too easily on exemptions.

Regarding EU-level AI regulatory sandboxes, the EDPB and EDPS welcome their creation but call for clearer involvement of competent data protection authorities. They also recommend giving the EDPB an advisory role and observer status in the European Artificial Intelligence Board where data protection issues arise.

The Opinion further raises concerns about supervision by the AI Office, stressing the need to clearly delimit its exclusive competence and to preserve the EDPS’s role regarding AI systems used by EU institutions. It also warns against weakening the current AI literacy obligation for providers and deployers, arguing that AI literacy is essential for awareness of risks and compliance.

Lastly, the EDPB and EDPS express concern about delaying the application of high-risk AI rules. While acknowledging implementation challenges, they warn that postponement could affect fundamental rights protection in a rapidly evolving AI landscape and invite the co-legislators to consider maintaining the current timeline for certain obligations, such as transparency.

The course examines how AI technologies are increasingly being integrated into judicial practice, including legal research, evidence analysis, real-time translation, case management, and risk or sentencing assessments. Against this background, the programme focuses on how courts and legal professionals could make use of AI while safeguarding human rights, judicial independence, procedural fairness, and public trust.

Particular attention is paid to questions of algorithmic bias, transparency, and accountability. The course addresses how judges should evaluate AI-generated outputs presented in court proceedings, what safeguards are needed to avoid overreliance on automated systems, and how judicial systems could introduce technological innovation without undermining the rule of law. Other modules focus on access to justice, fair trial rights, explainability of AI systems, and the impact of AI on women and marginalised groups.

The programme consists of approximately 18 hours of self-paced learning and includes expert-led video sessions, comparative case studies, practical exercises, and scenario-based discussions. It is aimed at legal professionals and judicial actors worldwide.

The academic direction of the course is provided by Professor Ignacio Cofone and Professor Philippa Webb of the University of Oxford. According to UNESCO, the programme draws on international human rights law, UNESCO’s Global Toolkit on AI and the Rule of Law for the Judiciary, and comparative research on AI governance and judicial systems.

The course is initially offered in English, with French and Spanish versions expected to be available from June 2026 onwards. Participants who complete the programme receive a digital certificate issued by the Saïd Business School in cooperation with UNESCO and the University of Oxford partners.

On 17 February 2026, the Council added two countries – the Turks and Caicos Islands and Vietnam – to the EU list of non-cooperative jurisdictions for tax purposes. At the same time, it removed three countries – Fiji, Samoa and Trinidad and Tobago – from the list, as they now meet all agreed international standards. This list now comprises 10 jurisdictions: American Samoa, Anguilla, Guam, Palau, Panama, the Russian Federation, the Turks and Caicos Islands, the US Virgin Islands, Vanuatu and Vietnam.

In addition, the Council approved the progress report (Annex II), which documents cooperation with partner countries and their commitments to reforming their tax regulations. Antigua and Barbuda and the Seychelles will be removed from the document following a positive assessment of their exchange of information. Brunei has been granted a six-month extension to bring its tax regulations into line and will also be removed from the list.

The criteria for blacklisting non-cooperative jurisdictions relate to tax transparency, fair taxation, and measures against base erosion and profit shifting. If a country is blacklisted, EU Member States are required to take efficient defensive measures in non-tax and tax areas (→eucrim 3/2023, 255-256).

At the end of July 2026, the mandates of five other European Prosecutors (from Bulgaria, France, Malta, Slovenia, and Slovakia) will end. The nomination process is part of the rotation system of European Prosecutors at the EPPO's central office in Luxembourg: one third of European Prosecutors are renewed every three years. To ensure continuity, the mandates of seven prosecutors (from Germany, Estonia, Croatia, Latvia, Luxembourg, Romania, and Finland) were extended until 30 June 2029, following a draw in April 2024.

Regarding the partial renewal of now seven European Prosecutors, each participating Member State concerned nominates three candidates for the respective replacement of the country's European Prosecutor. A selection panel composed of 12 members, including former EU judges, auditors, senior prosecutors, and lawyers (one of whom is proposed by the European Parliament), assesses the candidates, issues reasoned opinions, and ranks those who meet the selection criteria. The Council then appoints one candidate per Member State.

European prosecutors supervise investigations and prosecutions. Together with the European Chief Prosecutor, they form the EPPO College.

The tool was designed for individuals professionally connected to providers of general-purpose AI models or certain AI systems, including employees, contractors, shareholders, and members of management bodies. Reports can be submitted in any official EU language and supported by relevant documentation. A secure inbox system enables two-way communication with the AI Office while preserving anonymity.

According to the Commission, the tool aims to facilitate the early detection of potential violations that could endanger fundamental rights, health, safety, or public trust. The AI Office has committed to strict confidentiality standards, including certified encryption mechanisms and restricted internal access to reports. Whistleblowers receive confirmation of receipt within seven working days and are to be informed within fourteen working days whether the AI Office is competent to handle the case. Feedback on follow-up measures is to be provided within three months or, in exceptional circumstances, six months.

The Commission clarified that, until 2 August 2026, legal protection against retaliation under the EU Whistleblower Directive will not automatically apply to reports concerning infringements of the AI Act. During this interim period, confidentiality serves as the primary safeguard. From the above-mentioned date onwards, reports relating to AI Act breaches will fall within the Directive’s scope. In certain cases involving product safety, consumer protection, privacy, or information security, whistleblowers can already benefit from existing protection under EU law.

The launch of the tool was presented as part of the broader implementation of the AI Act, which seeks to promote trustworthy AI while addressing systemic risks associated with high-risk and general-purpose AI models. The measure strengthens the enforcement architecture by providing an additional channel for detecting non-compliance within the emerging EU AI governance framework.

The arrangement establishes a structured legal framework for collaboration and the exchange of non-personal information between Europol and Argentine law enforcement authorities. It is expected to facilitate joint efforts in areas such as organized crime, drug trafficking, human trafficking, cybercrime, and environmental crime. The arrangement also allows for the sharing of specialist knowledge, general situation reports, and strategic analysis as well as participation in training activities and the providing of support for individual criminal investigations.

Under the terms of the arrangement, Argentina will designate a national contact point to support cooperation with Europol. Provisions are included for the potential deployment of liaison officers to Europol.

Over the last five years, investigators discovered that one individual had operated over 373,000 onion domains on the dark web. Over 90,000 of these domains advertised child sexual abuse material (CSAM), offering paid "packages" via email registration and Bitcoin payments, but the advertised content was never delivered. The sites also promoted other fraudulent "cybercrime-as-a-service" offerings with the same goal of obtaining payment without delivery.

The operation identified one main suspect, a 35-year-old man based in China, shut down over 373,000 websites, seized 105 servers, and identified 440 customers worldwide.

Europol only processes information in SIENA related to criminal activities that fall within its remit. The agency emphasised that national authorities independently decide how to use criminal intelligence shared by partner countries and that EU Member States and non-EU partners, including Ukraine, can exchange operational information via SIENA without Europol’s involvement.