The last time this site wrote about the permanent regulation, the September 29 trilogue had just ended: no political agreement on detection, a drafted agreement on public-content scanning that reaches hosting providers of any size, Parliament holding the private-message line, a November trilogue named as the expected final attempt, and a working list of October dates on which the technical talks would run. October is over. Here is the October record — assembled from the Council's own public register read directly on 24 October, three meeting notices, one public but easy-to-miss Presidency paper, and the record notes of Brussels Record, which has been extracting this file's documents one access request at a time.

The October record, dates first

Everything below is checkable against the Council's public register for interinstitutional file 2022/0155(COD), or against the register's document pages directly:

  • 1–5 October. The General Secretariat calls the JHA counsellors for 5 October at 14:30. Agenda item: "Outcome of the trilogue on 29 September 2026 and next steps". The register lists two documents under that meeting date — "Outcome of the 6th trilogue on 29 September 2026 and way forward", and "Documents for the trilogue on 29 September 2026". Both are marked, in the register's own words: "The content of this document is not accessible." No outcome of the 5 October meeting has been published.
  • 9 October. Two meeting notices are issued, both dated that day. The morning meeting is for "JHA Counsellors + Experts (Law Enforcement Working Party – Police) (CSA Regulation)". The afternoon is for JHA Counsellors on the state of play.
  • 14 October. The afternoon meeting's paper, WK 15702/2026, enters the register dated this day, titled "State of play and way forward".
  • 20 October, 10:00. The Law Enforcement Working Party (Police) meets. Agenda item two, from the notice of meeting verbatim: "Technical discussion on a possible detection package — WK 15701/2026."
  • 20 October, 14:30. The JHA counsellors meet on "State of play of the interinstitutional negotiations and next steps", paper WK 15702/2026 — which the notice itself lists parenthetically as "(to be issued)".
  • 24 October (as of writing). The register still shows the two 20 October papers at the top of file 2022/0155(COD), both "not accessible". No outcome document for either 20 October meeting exists in the register. Brussels Record established the same status as of 22 October and asked the Council for both papers under Regulation (EC) No 1049/2001 on 15 October; the Council confirmed receipt and has 15 working days to reply — into early November.

What exists in public form for the negotiations' most consequential month is therefore: two meeting notices, four document titles, and four refusals. The working name of the compromise under construction — "a possible detection package" — is itself the most substantive phrase the Council has published on the file since September.

The register's refusal text is worth reading twice, because it ends with an offer: "Nevertheless, a request for access can be sent to the Access to documents department." The same instrument used by the outlet tracking this file is available to any reader; the form is here, the legal basis is Regulation 1049/2001, and the Council has a statutory reply clock that starts on receipt. Transparency on this file currently runs on that mechanism.

The public part of the record: a July reflection paper nobody has made much of

The register does have one recently-listed trove on this file that opens normally: WK 10939/2026, "Reflection paper on detection obligations / own-initiative searches", dated Brussels, 24 July 2026 — carrying the LIMITE marking and the "intended for a specific community of recipients" formula, yet posted on the register at INIT. A companion consultation table invited delegations' written comments on it by 3 September 2026.

It names what a "detection package" would consist of. The paper reconstructs a May 2026 compromise proposal from the Cyprus Presidency (document 9659/26) with five building blocks:

  • (a) own-initiative searches by providers in publicly accessible content, as a mitigation measure;
  • (b) own-initiative searches by the EU Centre in publicly accessible content — the European Parliament's proposal, since tentatively agreed at the September trilogue;
  • (c) detection orders for publicly accessible content;
  • (d) own-initiative searches by providers in non-public content — the paper's phrasing: "inspired by the derogation from e-privacy rules provided by the expired Regulation (EU) 2021/1232 (CSA Interim Regulation) but also including hosting services, with additional safeguards such as a notification obligation for providers to the EU Centre and a suspension mechanism for national authorities";
  • (e) detection orders for non-public content targeting "specific users linked to child sexual abuse" — and here the paper's exact words deserve their own line: targeting concepts were being developed "moving away from the concept of 'suspects' to avoid overlaps with criminal law."

Read that last clause again. The category of person whose private messages a detection order can reach is being engineered so that it does not collide with the procedural protections the word suspect carries in criminal law. That is not a bug list; it is a sentence from the Presidency's own record of where the negotiation is heading.

The paper also sets down the two sides' opening hands in each other's own words. The European Parliament's stated principles: detection orders in non-public content as a last resort; own-initiative searches targeted to specific users and subject to judicial authorisation; no generalised scanning of non-public content; full protection of end-to-end encryption; and no detection orders or searches for new CSAM or grooming — known material only.

And the Presidency's summary of the Council side, verbatim: "the clear preference of a majority of delegations in the Council to continue with the practice of own-initiative searches by providers for known and new CSAM and the solicitation of children, in line with the CSA Interim Regulation." One sentence, dated 24 July, in a public document: the Council majority wants the interim regime's scanning practice — the one this site has documented running, with its reports flowing to NCMEC's Palantir system — carried into the permanent law, with the practice extended to new material and grooming. Where that practice lands for the people running servers is what this site's September post on the operator-level decision is about.

The Presidency's own job description for this file, from the same paper: "to establish a way through on detection orders and own-initiative searches in non-public content, to satisfy the mandate of the Council to the maximum possible extent." The purpose, the paper says, is agreement paths "for the trilogue on 29 September 2026." That trilogue ended without a deal. The 20 October meetings of the "possible detection package" are the continuation of this effort — with the difference that October's application of these blocks is not public, where July's framing of them is.

What has not moved

  • The blocking count is unchanged. Per Brussels Record's governments page, as of 22 October no government has changed its position since the sixth trilogue: nine governments on record against mandatory scanning of private messages, representing 32.9% of the EU population — 2.1 points short of the more than 35% needed to block a Council vote. Germany's line, covered in the October 1 post, is what closes that gap when it closes. Brussels Record also keeps a running analysis of whether Sweden's election changes the count — worth watching, because the count can move in November without any new paper being published.
  • No seventh trilogue date. As of the record notes of 22 October, none has been published. The expectation of "a final attempt at a political deal in November" stands on Patrick Breyer's 30 September summary, not on a convocation.
  • The public-content basket is not reopened by any of this. The drafted public-content agreement — orders by administrative authorities, continuous monitoring of all public uploads, orders to any hosting provider regardless of size — survived September 29 and is the part of the law closest to a done deal. Nothing on the October register suggests otherwise.

The transparency pattern, stated plainly

Same file, same register, five months:

  • 29 June 2026 trilogue: four-column table WK 9794/2026 and outcome paper ST 11501/2026 — public, links live.
  • 29 September 2026 trilogue: outcome paper and documents, meeting date 5 October — "not accessible".
  • October detection talks: WK 15701/2026 and WK 15702/2026 — "not accessible".

The Council knows how to publish trilogue outcomes. It published them after June. The switch flipped when negotiations reached the endgame where every paragraph has a constituency. This is not a hypothesis about motive; it is three live links against three refusals.

What this means if you run anything

Three things carry over from the July paper's five blocks, and they are the load-bearing facts for community infrastructure:

  • Building block (d) is about your kind of server. "Also including hosting services" is the phrase that takes the interim regime's practice — scanning without suspicion, provider-initiated — and extends it from mail-and-chat platforms to hosting services generally. A Nextcloud with user files, a forum with attachment storage, a shared drive for a volunteer group: that is a hosting service. The paper's named "safeguards" are a notification to the EU Centre and a suspension mechanism for national authorities — neither is a court, and neither is encryption. If block (d) lands in the November package in this shape, the answer to it remains the one from the rest of this series: content that is end-to-end encrypted on the way out of a member's device cannot be searched by the provider holding the disk, and content stored in plaintext can. Design the stack as if the difference will be tested, because it is being written into law right now.
  • The "specific users" question is being defined around criminal law, not inside it. Building block (e)'s "moving away from the concept of 'suspects'" means the target category of detection orders is under explicit engineering to escape criminal-procedure protections. Whatever definition lands — "linked to child sexual abuse" as operationalised by whatever body — the community-relevant lesson is that the scope floor of the legal category is set by negotiation, not by statute's idea of a suspect. Your users' private spaces deserve a protection better than whatever that definition ends up being.
  • Your access rights are the October tool. The public register's own refusal text offers the access-request form to anyone who clicks. Regulation 1049/2001 has a reply clock. Filing requests on WK 15701/2026 and WK 15702/2026 — as one outlet has already done — is a way for operators, associations, or plain readers to convert "not accessible" into a published answer, with a deadline that has a date attached. The register is public; so is the form; the 15 working days are statutory.

Honest caveats

The reflection paper is a Presidency consultation document: its questions are questions, not agreed text, and delegations' written replies to it are not public. Its statement of the "clear preference of a majority of delegations" is the Presidency's characterisation of the Council side, dated 24 July — before the September and October talks. What the "possible detection package" actually contains is not published, and this record does not guess; the phrase itself, the meeting dates, and the register's not-accessible status are the verified facts. "Not accessible" also does not prove what was said in the meetings — only that nothing was published about them, which for a public register in a public legislative file is itself the finding. And the status here is fresh as of 24 October from a direct read of the register; if the Council posts the papers or an outcome tomorrow, this post will be wrong in the best possible way, and the links in it are the way to check.

What to watch

  1. Early November: the Council's Regulation 1049/2001 reply on WK 15701/2026 and WK 15702/2026 — due, on the clock, into early November. Brussels Record has committed to publishing whatever it says; the answer, whatever it is, becomes part of the file's public record.
  2. A seventh trilogue date appearing in a CM notice — the convocations are the one document type in this series that reliably publish in advance.
  3. Whether the June precedent recurs or not: if four-column outcome tables for the September 29 trilogue or the October package appear on the register INIT, the terms of the endgame become checkable by anyone. If they do not appear before the November deal attempt, the November text will arrive as the first readable word of what was negotiated — which is a way to build a law, and not a way to build one people can be expected to trust.

The November vote was already the deadline that matters. October added the working name, the closed register, and a July paper naming five blocks, one of which reaches hosting services and none of which has changed Parliament's red lines. The negotiation to satisfy one chamber's mandate "to the maximum possible extent" is being finished in a file where the lights went off at the endgame — and the last readable document on it is a public record of exactly what the fight is about.

Sources