The regulation, proposed on 24 June 2026, would permit Europol to evade procedural safeguards, such as ensuring data stored on people is limited and proportionate to their involvement in a crime. These safeguards are described in the proposal as “administrative burdens”. The plans would also hasten the expansion of data collection by police authorities in Europe as well as their use of experimental AI systems.
Europol is not currently allowed to search for and store personal data without, according to the European Data Protection Supervisor (EDPS), “indications” that the data is relevant.1 But in May 2026, former Europol officials revealed to investigative journalists that the agency has been running “shadow systems” for years. These parallel systems sit outside the agency’s mainframe, allowing them to avoid data protection and IT design requirements. An ongoing complaint by the strategic litigation NGO Front-LEX seeks to force the EDPS, Europol’s supervisory authority, to ban such “shadow systems”.
The Commission describes its plans for deregulation as necessary in order to keep pace with technological change, “modernise” Europol’s work and make the agency the EU’s leader in AI-driven policing.
Deregulation creeps further into policing
Since late 2024, the president of the European Commission, Ursula von der Leyen, has launched several legislative “simplification” packages. These include the AI omnibus adopted in June and the digital omnibus proposed in November 2025, which are designed to allow the Commission to weaken minimum standards and protections across a range of social, digital and environmental legislation. The Europol proposal is just one of the latest attempts to weaken privacy and data protection safeguards.
The plans would also expand Europol’s role in dealing with the private sector. The agency would become the central “hub” for private actors to share information and receive funding for digital policing tools development. Such tools include tech for subverting encryption, for instance, or for scaling up automated profiling.
Europol is also set to be given access to a wider set of funding mechanisms, allowing it to finance and participate in research projects for new digital technologies. The change would grant Europol access to funds such as Horizon Europe, which has a budget of €175bn for 2028-2034.
This is a significant expansion of its current advisory relationship with Horizon Europe. The agency was previously tasked with identifying “key research themes” for the fund but was forbidden from bidding for research projects itself under the 2022 Europol Regulation.
Supersizing Europol’s data powers
The latest Europol proposal would, in the words of the Commission, “eliminate the need for manual handling of data, accelerate the exchange of criminal intelligence, and allow member state authorities to focus on core law enforcement tasks rather than administrative processes.”
The agency is currently only allowed to store, in its operational system, limited data according to specific categories, such as ‘victim’ and ‘suspect’, and only in relation to existing investigations. In other words, Europol is not allowed to indiscriminately collect data and filter it afterwards in its system, but this is set to change.
The proposal would allow Europol to go ‘fishing for data’ on people not linked to an investigation, in order to decide whether it is relevant for its operations.
While current rules reflect the agency’s role as a facilitator of cooperation between police authorities (as outlined in the EU treaty), the new changes would turn Europol into what von der Leyen envisions as a “truly operational police agency” in its own right.
Without such ‘burdensome’ requirements as, for instance, distinguishing between suspects in a crime and innocent people, Europol would be free to crunch large datasets without restriction, argues the Commission in the proposal’s impact assessment. The Commission argues that this is needed to “support the use of advanced analytical tools and machine learning”.
Exemptions from transparency requirements
Europol has already obtained exemptions from the AI Act’s monitoring, oversight and transparency requirements in the deployment of high-risk AI. The agency’s “Innovation Hub” and “Innovation Lab” have taken the lead in coordinating EU research on AI projects for security, as well as developing and coordinating member states’ work on AI projects in policing and border enforcement.
There is little information about how Europol is currently deploying AI in its operations. In a recent advisory opinion acquired and published by Statewatch, the European Data Protection Supervisor gives some clues. It describes an environment in which Europol uses digital tools described as “scripts” to select and produce data from the internet, to be used in investigations. Europol explains that it will only keep a log of the modifications the automated system carried out on the data “to the extent it is possible”. In other words, some processing and modification by automated tools will be entirely untracked and unexplained.
An opaque system that is largely run autonomously is contrary to a ruling by the Court of Justice of the European Union, Ligue des droits humains (Case C-817/19), which requires that automation be explainable and identifiable in its modification of information, especially when it relates to a criminal investigation.
For Europol to lead in automated policing, the European Commission wants to build an infrastructure where the agency would receive massive amounts of data from member states, third countries and private actors. This is not a new plan, but the reasoning has changed. For years, law enforcement has invoked security in demanding access to personal data. Now, amid the rush to obtain data for AI training purposes, ‘modernised law enforcement’ has become the new key justification to turn over data en masse to the police.
A shared digital police space
As part of the new proposals, the Commission plans to build a cloud infrastructure and ‘Police Shared Data Space’ for member states, Europol and partners to work on the same operational data directly from their own systems. Plans for cloud infrastructure for policing date back at least to the 2020 European Data Strategy.
The EU police cloud would end a system that requires member states and partners (such as third countries and international organisations) to dispatch officers to Europol’s headquarters in The Hague to access Europol data. Instead, access would be enabled via the cloud.
This change is in lockstep with the Commission’s aim to systematically involve Europol in almost all criminal investigations across the bloc.
To avoid missing any information gathered by law enforcement in Europe, the proposal envisions that member states’ law enforcement authorities will upload any data relating to crimes falling within Europol’s scope of competence, where relevant to cross-border cooperation.2 The commission also wants to introduce a separate obligation for “immigration liaison officers” to provide “relevant information”.3
Automated technical tools called ‘data loaders’ would send information in national case management systems to the Europol cross-checking service. This would also allow the transfer of massive datasets.
Member state authorities would only be allowed to withhold data from Europol in exceptional cases, and with justification.4
Europol would also be given access to the Prüm II framework, a network of national databases including biometrics (DNA profiles, fingerprints and facial images), police record indexes (EPRIS) and vehicle registration data (EUCARIS). Statewatch and the digital rights group EDRi have voiced serious concerns about the system’s development that is “often linked to an increase in stigmatisation, control and policing over marginalised groups such as Black and Brown communities.”
Criminalisation at the border
Under the proposal, EU agencies would be connected to automated “hit/no hit” searches in their respective systems,5 subject to reciprocity.
Previously, EU agencies could only exchange information with Europol after evaluating if it would be relevant for the agency’s work. This legal standard did not, however, prevent Frontex from unlawfully sending the personal data of more than 10,000 people to Europol over the course of eight years. In January 2025, the EDPS admonished Frontex for having sent in bulk, without individual assessment, data collected during debriefing interviews of migrants newly arrived at EU borders. The programme, called PEDRA, aims to identify smugglers and smuggling networks. An investigation by Solomon established last year that human rights defenders working at EU borders have been criminalised, including by a third country, because of this mass data collection and processing in Europol’s database.
Last year, the EDPS required Frontex to send data to Europol only when there was a known and adequately assessed interest for Europol to process the information. In its impact assessment of the Europol proposal,6 the Commission complains that these new rules are too restrictive and that Europol should be given back systematic access to the Frontex database.
Risky AI policing experiments
The Europol proposal further opens up the possibility for private parties to test their automated software in Europol’s “Innovation Lab” environment. Since 2023, the lab has been developing ‘sandboxes’, which are closed digital environments to securely test AI tools and assess their performance. In July 2025, the commission pledged to invest one billion euros per year in AI research – doubling its previous commitment.
This year, the company Anthropic reported that its AI programme Claude managed to get online and hack into three organisations, even though it was supposed to be in an isolated test environment. This incident, while unrelated to Europol and its Innovation Lab, calls into question the security of the ‘sandbox’ system of secure test environments.
The US is also providing many similar examples of AI overdrive, such as attempts to detect “sentiment and emotion” in online posts, AI agents acting as bounty-hunters, and AI-generated video used in court.
When tested, these technologies can show abysmal results, such as the US company Flock misreading license plates 71% of the time in alerts sent to the police.
Protections further weakened
The new Europol regulation proposal is the latest step in a steady undermining of basic privacy protections. A regime of exception already exists for law enforcement to deploy mass surveillance in urgent or egregious cases such as child sexual abuse material. At every turn, civil society has warned that these exceptions would not remain limited, and that law enforcement would seek more powers. The European Commission is now working to make that a reality.
There is no doubt that Europol’s new data powers, if granted, would result in more arrests. And without a transparent use of digital tools and AI in policing, this likely means an increase in discrimination and miscarriages of justice. It would also mean an increasing dependence on opaque ‘black box’ technologies, with limited agency capacity or willingness to change course. As we’ve seen in the US, private tech companies also stand to benefit from this policy through privileged access to funding, and data to experiment on with their latest AI products.
The commission sees this reform as a necessary “modernisation” of Europol’s mandate, claiming that “advanced technological support are no longer exceptional requirements but have become core features of modern law enforcement cooperation”. However, the “administrative burdens” they want to do away with are the result of decades of work building data protection and procedural safeguards to protect people from police misuse of technology. Many people have been harmed by such misuse in the EU already – and when it comes to asylum seekers and migrants, many have only recently been allowed to seek some form of redress. Now, with this new proposal, the Commission is ensuring that digital systems remain opaque and redress becomes even harder to access.
Paragraph 57, EDPS supervisory opinion
Article 38, Europol Proposal
Article 29.3, Europol Proposal
Article 29.5, 38.2, Europol Proposal
Article 80, Europol Proposal
Footnote 75, Impact assessment on the proposal for the Europol revision
