Digital Sovereignty

Your Confidential Messages Can Be Scanned Again

The EU Council revived the lapsed rule that lets providers scan private messages with AI. For owners, confidential communication is now a governance choice.

By Leon Soliman · 2026-07-03 · 2 min read

A lapsed rule, revived by procedure

Since 2021 a temporary EU regulation, known as Chat Control 1.0, let messaging providers voluntarily scan private chats for known abuse material and grooming patterns using AI and hash matching. It expired on 3 April 2026 when the Council and Parliament could not agree to extend it. On 2 July 2026 the member states adopted a position, by written procedure, for a formally new but substantially identical regulation to close the gap.

The rule covers the services most people treat as private: messenger apps, webmail and internet calling. Providers may scan the content and traffic data, and the processed data must be deleted at the latest twelve months after a detection unless a concrete suspicion is confirmed. The Council frames this as a necessary tool for child protection and to prevent a patchwork of national rules.

Voluntary for the provider is not private for you

This is the lighter measure. The mandatory, suspicion free scanning of encrypted communication, known as Chat Control 2.0, remains stalled against resistance in Parliament. But the distinction that matters to an owner is not mandatory versus voluntary. It is that the channel you use for confidential business may again be lawfully scanned by the company that runs it.

The timing is deliberate. The draft is pushed onto the agenda before the summer break, already in a second reading where it can only be stopped or amended by an absolute majority of members, a bar that is hard to clear when many have already left. The direction of travel in EU law is toward normalizing content scanning of the channels businesses rely on.

Decide your channel, do not inherit it

Confidentiality is not a feature you can assume from a consumer app. An owner who runs deal flow, legal matters, board discussion or personnel decisions over mainstream messengers is now doing so on a channel whose scanning status is set by policy, not by contract. The governance question is simple: do you know what your most sensitive conversations run on, and did you choose it on purpose?

Sovereignty over a communication channel is a decision an owner makes once and lives with for years. Servola helps owners map where their confidential communication actually flows, weigh the providers and architectures against real requirements, and put confidentiality on a footing that a procedural vote cannot quietly move.

Frequently asked questions

Does this mean my encrypted messages are now read by the government?

No. The revived rule permits providers to voluntarily scan for known abuse material and grooming, and processed data must be deleted within twelve months unless a concrete suspicion is confirmed. The separate mandatory scanning proposal, Chat Control 2.0, remains stalled. The point for owners is that the content of mainstream channels can again be lawfully scanned by the provider.

Is this a German rule or an EU rule?

It is an EU rule. The Council of the member states adopted the position and the draft now goes to the European Parliament. It applies across the Union, which is why owners in every member state, not only Germany, should register the shift.

What should an owner do about it now?

Map where your genuinely confidential communication flows today, decide deliberately which channels carry it, and where confidentiality is essential choose providers or architectures where it is guaranteed by contract and technology rather than by the current state of a political vote.

A channel you did not choose is a channel someone else governs.

DigitaleSouveraenitaet Chatkontrolle Verschluesselung Datenschutz ePrivacy EURegulierung Kommunikationssicherheit Briefgeheimnis Compliance Mittelstand Familienunternehmen Risikomanagement Unternehmensfuehrung DSGVO Servola