Update July 10, 2026: The EU regulation on "preventing and combating child sexual abuse" - better known as Chat Control - has taken a new turn: on July 9, 2026, the attempt to stop the return of voluntary chat control failed in the EU Parliament. The reinstatement of the interim rules until 2028 is thus effectively waved through - at least with an explicit exemption for end-to-end encrypted services. The permanent regulation, meanwhile, remains stuck in the trilogue. Read on to find out what this means for companies and why self-hosted communication remains the most robust answer.
Update of October 12, 2026: The Council formally adopted the interim rules on July 23, 2026, including the exemption for end-to-end encrypted communications. They apply as Regulation (EU) 2026/1881 from late July 2026 until April 3, 2028. The sixth trilogue round on the permanent regulation on September 29, 2026 again brought no agreement on scanning private chats.
Table of Contents
- Chat Control in 2026: Where Do We Stand?
- What is Chat Control?
- Why chat control is dangerous
- Germany's position
- What does this mean for companies?
- The solution: secure, self-hosted communication
- Why self-hosted solutions?
- Act now: Protect your corporate communications
- Our services for your secure communication
- Consulting and conception
- Installation and Setup
- Operation and maintenance
- Training and Support
- Conclusion: Digital sovereignty is not a luxury, but a necessity
- Get in touch with us
- Further Links and Sources
Chat Control in 2026: Where Do We Stand?
A lot has happened since the original version of this article (September 2025). The key milestones:
- October 9/14, 2025: The Danish Council Presidency takes the planned vote on mandatory scanning off the agenda - Germany's no to indiscriminate chat control made a qualified majority impossible.
- November 26, 2025: The Council adopts its position - mandatory scanning is scrapped (and with it forced client-side scanning). In return, voluntary scanning is to be made permanent and expanded (to include text and video), plus mandatory age verification and an EU centre. A review clause lets the Commission examine after three years whether mandatory scanning should be introduced after all.
- December 2025 to June 2026: Five trilogue rounds between Council, Parliament and Commission - without agreement. The only provisional consensus is to exempt encrypted content; indiscriminate scanning remains contested. Negotiations continue under the Irish Council Presidency.
- April 3, 2026: The interim regulation ("Chat Control 1.0") expires after Parliament rejected an extension at the end of March - Google, Meta, Microsoft and Snap kept scanning anyway, without a legal basis.
- July 2-9, 2026: Using a procedural trick, the Council and the Parliament's leadership bring back the textually identical old proposal. On July 9, the motion to reject it falls short of the required absolute majority in Parliament (314 votes in favor) - voluntary chat control returns until 2028. At least an amendment was adopted that explicitly exempts end-to-end encrypted services from scanning (the Council confirmed this change on July 23, 2026).
- July 24/28, 2026: The interim rules are signed as a self-standing Regulation (EU) 2026/1881 and published in the Official Journal. It applies until April 3, 2028 and excludes end-to-end encrypted communications.
- September 29, 2026: The sixth trilogue round ends without agreement on scanning private chats; agreement was only reached on the planned EU Centre. No date has been set for the next political round.
For companies, this means as of today: no scanning obligation for providers, E2EE services are exempt from voluntary scanning - but indiscriminate voluntary screening by the big US platforms is back, and the review clause keeps the door open for mandatory scanning. If you do not want your business communication to depend on this back and forth, move it onto your own infrastructure.
What is Chat Control?
Chat Control (officially: the CSAR Regulation) is an EU legislative project that was meant to oblige messaging services and email providers to scan all messages from their users for suspicious content - this obligation has been off the table since the Council position of November 2025, but the review clause keeps it lurking as a potential comeback. Affected would be:
- WhatsApp, Signal, Telegram and other messengers
- E-mail communication
- Cloud storage and file sharing
- Even encrypted communication is to be screened
The technical problem: client-side scanning
The proposed technology is called Client-Side Scanning (CSS). Messages and files are scanned directly on your device before they are encrypted and sent. This means that
- End-to-end encryption is effectively undermined
- A backdoor to all private data is created
- The security of all EU citizens is compromised
As Patrick Breyer, former EU parliamentarian for the Pirate Party, warns: "With demonstrably false claims, the Danish Council Presidency is trying to push through the controversial Chat Control 2.0."
Why chat control is dangerous
1. Undermining the encryption
The Internet Architecture Board (IAB) clarifies: Chat Control would "impose unrestricted access to private content and thus undermine end-to-end encryption."
2. Mass surveillance
Every message, every image, every file would be scanned - without suspicion, without a court order. This is mass surveillance without cause.
3. Technical uncertainty
Over 470 scientists from 34 countries have taken a stand against chat control. The technology is prone to errors and opens the door to abuse.
4. False Positives
Automated scans produce false hits. Vacation photos of your own children could be incorrectly marked.
Germany's position
Officially, the German government rejects indiscriminate mandatory scanning. Federal Minister of Justice Stefanie Hubig put it succinctly in October 2025: "Indiscriminate chat control must be taboo in a state governed by the rule of law." That rejection derailed the planned Council vote in October 2025.
The full picture is less clear-cut, however: according to internal documents, the Federal Ministry of the Interior, which leads the Council negotiations, supports the broadest possible voluntary, indiscriminate scanning with minimal restrictions - and Germany backed both the Council position of November 2025 and the reinstatement of the interim rules in July 2026. Germany's data protection authorities, by contrast, are calling for chat control to be abandoned entirely. No one should count on a stable political no.
What does this mean for companies?
Chat control would have disastrous consequences for companies:
- Company secrets could be compromised
- Confidential customer data would be at risk
- Compliance issues with GDPR and other data protection regulations
- Industrial espionage would open the floodgates
- Legal and medical confidentiality could no longer be guaranteed
The solution: secure, self-hosted communication
The best protection against chat control and other surveillance measures is digital sovereignty through self-hosted communication solutions. WZ-IT offers you professional implementation and operation of the following secure alternatives:
1. Matrix with element
Matrix is an open standard for secure, decentralized communication. With Element as a professional client, you get:
- ✅ Genuine end-to-end encryption without backdoors
- ✅ Federation between different servers
- ✅ Complete data sovereignty on your own infrastructure
- ✅ GDPR-compliant and auditable
- ✅ Voice & video calls encrypted
- ✅ Used by NATO, the German Armed Forces and the French government
2. Mattermost
Mattermost is the open source alternative to Slack and Microsoft Teams:
- ✅ Self-hosted on your infrastructure
- ✅ End-to-end encryption available
- ✅ Extensive integration into existing systems
- ✅ DevOps features and workflow automation
- ✅ GDPR-compliant without US cloud dependency
3. Rocket.Chat
Rocket.Chat offers a flexible communication platform:
- ✅ Omnichannel communication (chat, e-mail, social media)
- ✅ End-to-end encryption
- ✅ White label-capable with own branding
- ✅ LiveChat for customer service
- ✅ Federation between servers possible
4. Zulip
Zulip revolutionizes team communication with thread-based conversations:
- ✅ Topic-based organization instead of chronological chaos
- ✅ Asynchronous communication perfect for distributed teams
- ✅ Open source and transparent
- ✅ Mobile and desktop apps
- ✅ Powerful search across all messages
Why self-hosted solutions?
Complete control
You retain complete control over your data. No cloud providers, no third-party providers, no hidden access.
No back doors
Open source software is transparent and auditable. The code can be checked by experts - backdoors are ruled out.
GDPR-compliant
All data remains in Germany or your desired jurisdiction. No transfers to unsafe third countries.
Independence
No vendor lock-in, no dependence on US companies, no sudden price increases or service closures.
Act now: Protect your corporate communications
The permanent regulation has not been adopted yet - but voluntary chat control is back, and the development clearly shows that digital privacy is under attack. Companies that rely on secure, self-hosted solutions now are not only protected from chat control, but also from:
- Industrial espionage
- Data leaks
- Compliance violations
- Reputational damage
Our services for your secure communication
WZ-IT supports you in the implementation of secure communication solutions:
Consulting & conception
- Analysis of your communication requirements
- Selecting the optimal solution (Matrix, Mattermost, Rocket.Chat, Zulip)
- Migration strategy for existing systems
Installation & Setup
- On-premise in your data center
- Private cloud on dedicated servers
- Hybrid solutions according to your requirements
- Integration into existing IT infrastructure (LDAP, SSO, etc.)
Operation & maintenance
- 24/7 monitoring
- Automatic backups
- Security updates
- Performance optimization
- SLA with defined response times
Training & Support
- Employee training
- Admin training
- Documentation
- Personal contact person
Still unsure which tool fits? In the collaboration selection you try the candidates for files, chat and video as demo instances and receive a reasoned decision paper. From €3,900 excl. VAT, credited against the rollout.
Conclusion: Digital sovereignty is not a luxury, but a necessity
The Chat Control Regulation clearly shows that encryption and privacy can no longer be taken for granted. Companies that want to protect their communications must act now.
With self-hosted solutions such as Matrix, Mattermost, Rocket.Chat or Zulip, you not only secure your data, but also your independence and digital sovereignty.
"Privacy is not a crime - it is a fundamental right."
Get in touch with us
Would you like to secure your corporate communications? We will be happy to advise you on suitable solutions.
Arrange a free initial consultation
Further Links and Sources
- EUR-Lex: Regulation (EU) 2026/1881 of 24 July 2026
- Council of the EU: interim measure reinstated (2026-07-23)
- netzpolitik.org: Chat control negotiations - member states and Parliament still divided (2026-10-01)
- netzpolitik.org: EU Parliament - voluntary chat control passes via procedural trick (2026-07-09)
- netzpolitik.org: EU Council agrees on chat control - worst fang pulled, but still dangerous (2025-11-26)
- netzpolitik.org: Trilogue on chat control enters the decisive phase (2026-06-12)
- netzpolitik.org: Big Tech wants to keep scanning without a legal basis (2026-04-07)
- heise: The double game around the EU chat control
- Council of the EU: press release on the general approach (2025-11-26)
- Patrick Breyer - Chat Control overview
- Campaign against Chat Control
- Society for Civil Rights (GFF)
