Records text chat, in the European Union

Directive 2002/58/EC, Art. 5(1) and (2) · Read the law's page

• Under the national law that transposes Article 5(1), do not listen to, tap, store, or otherwise intercept or monitor, as a person other than its users, the content or related traffic data of a communication carried over a public electronic communications network without the consent of the users concerned, unless legislation adopted under Article 15(1) authorises it as a necessary, appropriate and proportionate measure to safeguard national security, defence or public security, or for the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system.
• A recording that national law legally authorises and that is made in the course of lawful business practice to provide evidence of a commercial transaction or other business communication is not caught by the consent rule above; check the Member State's own law for whether, and on what further conditions, it authorises such recording.

Directive 2014/65/EU, Art. 16(7); Commission Delegated Regulation (EU) 2017/565, Art. 76 · Read the law's page

• It reaches you if you are an investment firm, meaning a legal person whose regular occupation or business is the provision of one or more investment services to third parties and/or the performance of one or more investment activities on a professional basis (Article 4(1), point (1), of the Directive): record the telephone conversations and electronic communications relating to, at least, transactions concluded when dealing on own account and the provision of client order services that relate to the reception, transmission and execution of client orders, including those intended to result in such transactions or services even if they do not (Article 16(7)).when it serves a financial business
• Take all reasonable steps to record the relevant telephone conversations and electronic communications made with, sent from or received by equipment you provide to an employee or contractor, or whose use by an employee or contractor you have accepted or permitted, and all reasonable steps to prevent an employee or contractor from making, sending or receiving relevant conversations and communications on privately-owned equipment you are unable to record or copy (Article 16(7)).when it serves a financial business
• Notify new and existing clients that telephone communications or conversations between you and your clients that result or may result in transactions will be recorded. The notification may be made once, before you provide investment services to the client (Article 16(7)).when it serves a financial business
• Before you provide services relating to the reception, transmission and execution of orders to a new or existing client, inform the client that conversations and communications are being recorded and that a copy of the recording will be available on request for five years and, where the competent authority requests, for up to seven years, in the same language or languages as you use to provide investment services to clients (Article 76(8)).when it serves a financial business
• Do not provide, by telephone, investment services and activities relating to the reception, transmission and execution of client orders to a client who has not been notified in advance about the recording of the client's telephone communications or conversations. A client may place orders through other channels, but those communications must be made in a durable medium such as mails, faxes, emails or documentation of client orders made at meetings (Article 16(7)).when it serves a financial business
• Record in a durable medium all relevant information related to relevant face-to-face conversations with clients, including at least the date and time of the meeting, its location, the identity of the attendees, the initiator of the meeting and relevant information about the client order including the price, volume, type of order and when it is to be transmitted or executed (Article 76(9)).when it serves a financial business
• Provide the records to the client involved upon request and keep them for five years and, where the competent authority requests, for up to seven years, counted from the date the record is created (Article 16(7) of the Directive and Article 76(11)).when it serves a financial business
• Store the records in a durable medium that allows them to be replayed or copied, retain them in a format that does not allow the original record to be altered or deleted, keep them readily accessible and available to clients on request, and ensure the quality, accuracy and completeness of the records of all telephone recordings and electronic communications (Article 76(10)).when it serves a financial business
• Establish, implement and maintain a written policy on recording telephone conversations and electronic communications, appropriate to the size and organization of the firm and the nature, scale and complexity of its business, which identifies the conversations and communications subject to recording and sets out the procedures to follow where exceptional circumstances leave you unable to record on devices you issued, accepted or permitted, with the evidence of those circumstances retained and accessible to competent authorities (Article 76(1)).for a financial business
• Give the management body effective oversight and control over the recording policies and procedures, keep the arrangements technology-neutral and evaluate them periodically (adopting further measures at least when a new medium of communication is accepted or permitted), keep and regularly update a record of the individuals with firm devices or approved privately owned devices, train employees in the procedures, monitor the records of transactions and orders periodically on a risk-based and proportionate basis, and demonstrate the policies, procedures and management oversight to the competent authorities on request (Article 76(2) to (7)).for a financial business
• Directive 2014/65/EU is addressed to the Member States (Article 97), which had to adopt and publish the measures necessary to comply with it by 3 July 2017 and apply them from 3 January 2018 (Article 93(1), as amended by Directive (EU) 2016/1034), so you meet its rules through each Member State's transposing law. Commission Delegated Regulation (EU) 2017/565 is directly applicable and applies from the same date (Article 91).

Commission Delegated Regulation (EU) 2025/1140, Art. 2(2) and Annex, Section 1; Regulation (EU) 2023/1114, Art. 68(9) · Read the law's page

• It reaches you if you are a crypto-asset service provider, meaning a legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis and that is allowed to provide crypto-asset services in accordance with Article 59 of Regulation (EU) 2023/1114 (Article 3(1), point (15), of that Regulation): keep records of telephone conversations or electronic communications relating to transactions or to the reception, transmission and execution of client orders, including where such conversations or communications do not result in the conclusion of a transaction or in the provision of the services of reception and transmission of orders or execution of order (Article 2(2) and Annex, Section 1, communication with clients).when it serves a financial business
• Retain the records in a medium that lets the competent authority access them readily and reconstitute each key stage of the processing of each crypto-asset service, activity, order or transaction, lets any corrections or other amendments and the earlier contents be ascertained, and does not allow the records to be manipulated or altered (Article 2(1)).when it serves a financial business
• Provide the records to clients upon request and keep them for five years and, where the competent authority requests before five years have elapsed, for up to seven years (Article 68(9) of Regulation (EU) 2023/1114).when it serves a financial business
• Delegated Regulation (EU) 2025/1140 is binding in its entirety and directly applicable in all Member States and entered into force on the twentieth day after its publication on 10 June 2025 (Article 18); it specifies the records that Article 68(9) of Regulation (EU) 2023/1114 requires crypto-asset service providers to keep (Article 68(10) of that Regulation).

Directive (EU) 2024/2853 · Read the law's page

• The Directive does not apply to free and open-source software that you develop or supply outside the course of a commercial activity (Art. 2(2)).
• If you develop or produce software, or have it developed under your name or trademark, and make it available in the course of a commercial activity, you answer as its manufacturer for damage it causes by a defect (Arts. 4(1), 4(10) and 8(1)(a)).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control; a defect caused by their absence, or by software, updates or upgrades within your control, is not excused because it arose after you placed the product on the market (Art. 11(2)(b) and (c)).
• Meet the product safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in deciding whether it is defective (Art. 7(2)(f)), and failing a mandatory product safety requirement that protects against the damage suffered presumes it defective (Art. 10(2)(b)).
• Account for what your product learns or acquires after release: the effect of any ability to continue to learn or acquire new features after it is placed on the market is weighed in deciding whether it is defective (Art. 7(2)(c)).
• Keep technical documentation you could produce if a court orders disclosure; failing to disclose presumes the product defective (Arts. 9(1), 10(2)(a)).
• If you are outside the EU, the importer or your authorized representative answers for the product in your place (Art. 8(1)(c)).
• If you substantially modify a product outside its manufacturer's control and then make it available on the market or put it into service, you are treated as its manufacturer (Art. 8(2)).
• Do not count on a contract term to limit or exclude your liability to an injured person; Article 15 bars it.
• Be able to show when you placed the product on the market or put it into service: you are not liable if you prove you did not, or that the defect probably did not exist at that time (Art. 11(1)(a) and (c)).