Skip to content
DRAFT REPORT (COM(2022)0209 – C90174/2022 – 2022/0155(COD))

On the proposal for a regulation of the European Parliament and of the Council Laying down rules to prevent and combat child sexual abuse

LIBE-PR-746811

Committee on Civil Liberties, Justice and Home Affairs · Rapporteur: Javier Zarzalejos

Official HTML ↗ PDF DOCX
✦ In shortFull text
✦ In short · AI summary of this text, generated 25 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

This is the rapporteur's draft report on the Commission proposal for a regulation laying down rules to prevent and combat child sexual abuse. It amends the proposal to cover online search engines and artificial intelligence systems, add delisting orders, and create voluntary detection orders. It keeps detection orders as a measure of last resort, adds safeguards for end-to-end encryption and metadata processing, and strengthens victims' rights to information, removal and support. It sets up a Victims' Consultative Forum and changes the rules on the seat, governance and tasks of the EU Centre on Child Sexual Abuse.

Committee position. The rapporteur proposes to amend the Commission proposal to cover online search engines and AI systems, add delisting orders and voluntary detection orders, strengthen safeguards for encryption and metadata, reinforce victims' rights, and create a Victims' Consultative Forum.

Key points

  1. The regulation applies to providers of hosting services, publicly available interpersonal communications services, and now also online search engines and artificial intelligence systems.
  2. Providers must identify, analyse and assess the risk of their services being used for online child sexual abuse, and may draw on a risk assessment under Regulation (EU) 2022/2065.
  3. Providers must put in place reasonable, proportionate, targeted and effective mitigation measures, including privacy and safety by design, parental controls, flagging tools and self-reporting.
  4. Providers may request a voluntary detection order from the Coordinating Authority to keep using specific technologies to detect, report and remove child sexual abuse.
  5. Detection orders are a measure of last resort, issued only where there is evidence of a significant risk and mitigation measures are not effective, and must be targeted and limited in time.
  6. Nothing in the regulation prohibits or weakens end-to-end encryption, but providers may be authorised to process metadata to detect suspicious patterns without accessing encrypted content.
  7. Coordinating Authorities can request removal orders for hosting services and blocking orders for internet access services, and can issue delisting orders to search engines and AI systems.
  8. Victims have the right to information about reported material depicting them, to assistance with removal or disabling of access, and to support from the EU Centre.
  9. Providers must designate a single point of contact for communication with authorities and users, and must not be liable for good-faith compliance activities.
  10. Member States must ensure effective, proportionate and dissuasive penalties, with maximum periodic penalty payments of 5% of average daily global turnover.
  11. The EU Centre must store personal data for a maximum of 24 months, with possible review for another 24 months, and must keep records of processing activities.
  12. A Victims' Consultative Forum of up to fifteen members is established to advise the EU Centre on victim-related matters.

Who is affected

  • Providers of hosting services, interpersonal communications services, online search engines and AI systems: must assess risks, take mitigation measures and comply with orders.
  • Victims of child sexual abuse: gain rights to information, removal assistance and support from the EU Centre.
  • Coordinating Authorities: gain powers to request detection, removal, blocking and delisting orders and to impose penalties.
  • The EU Centre on Child Sexual Abuse: tasked with supporting detection, reporting, removal and victim assistance, and with managing databases of indicators.

Figures and deadlines

  • Maximum retention period of 24 months for personal data stored by the EU Centre.
  • Maximum periodic penalty payment of 5% of average daily global turnover per day.
  • Removal orders must be executed within 24 hours of receipt unless a shorter period is indicated.
  • Detection orders concerning solicitation of children apply only to communications between a child user and an adult.
  • Risk assessment must be updated at the latest four months before the expiry of a detection order.
  • Coordinating Authority must decide on a voluntary detection order no later than three months from the provider's request.
  • Time periods for law enforcement requests to the EU Centre must not exceed 18 months.
  • The Victims' Consultative Forum shall consist of a maximum of fifteen members.

Legal basis: Article 294(2) and Article 114 of the Treaty on the Functioning of the European Union.