The Joint Research Centre and Europol have mapped a new generation of privacy-enhancing technologies that could strengthen European digital security while making criminal investigations more technically demanding, shifting the debate beyond encryption alone towards the skills and infrastructure police need when privacy-preserving systems become part of ordinary digital services.

The horizon-scanning study was developed by the EU Policy Lab at the JRC and Europol’s Innovation Lab, drawing on law enforcement, academia, research, industry, and civil society. Almost 200 signals of technological and contextual change were considered before ten technologies and innovations were selected for deeper examination.

The underlying tension is that technologies protecting identities, communications, and sensitive datasets do not divide neatly into tools that help citizens and tools that obstruct policing. The same system can strengthen cyber security and public trust while also making criminal activity harder to observe, particularly when investigators lack the technical capacity to work with encrypted or highly distributed evidence.

That makes the policy problem partly legal but increasingly operational. Police may need to understand privacy-preserving computation, AI-generated evidence, digital identity, distributed ledgers, post-quantum security, and new communications architectures while maintaining the procedural standards required for evidence to survive scrutiny in court.

Privacy tools can support investigations

Fully homomorphic encryption provides one of the clearest examples because it allows analysis to be performed on encrypted information without first exposing the underlying data. In principle, investigators could search for patterns associated with financial crime while unrelated transaction information remained protected from direct inspection.

Such capability would offer a route towards more privacy-preserving investigation, although the governance question does not disappear. Authorities still need rules defining who may run a search, which indicators can legitimately be tested, how results are interpreted, and what happens when a protected computation produces a lead affecting an individual.

Artificial intelligence presents a similarly mixed set of effects. Investigators can use models to identify patterns across large datasets, connect information in complex cases, and detect manipulated media, while criminals can use the same technology to automate fraud, generate convincing synthetic content, or make assessments of authenticity more difficult.

Distributed ledgers produce another two-sided outcome because cryptocurrency networks can facilitate illicit finance while persistent transaction histories also provide material for forensic analysis. Digital identity systems can reduce fraud and improve service security, yet compromised credentials or tokenised assets can create new routes for theft if implementation is weak.

Capability becomes the limiting factor

The study places considerable weight on preparedness because legal authority is of limited use when investigators lack the expertise or infrastructure needed to understand a technology. Encrypted computing, quantum systems, AI, distributed ledgers, and future communications networks require specialist software, hardware, training, and forensic methods that many public bodies cannot sustain independently.

That creates a workforce and procurement problem across Europe. Advanced cyber and AI skills are already contested by private employers, while sophisticated forensic environments are expensive to maintain, particularly when investigations cross borders and evidence must remain traceable across several legal systems.

Quantum technology adds a longer-term infrastructure challenge because sufficiently capable quantum computers could eventually undermine widely used cryptographic systems. Governments and businesses are already preparing for post-quantum cryptography, while law-enforcement bodies also have to understand how those new protections will affect evidence collection and forensic practice.

Shared capabilities therefore become more attractive. Instead of every national or regional force attempting to build identical expertise, European cooperation can support common tools, specialist centres, standards, and research programmes, provided those arrangements preserve accountability when investigations cross jurisdictions.

The lawful-access debate gets wider

The JRC and Europol do not resolve Europe’s recurring political argument over access to encrypted communications, nor do they suggest weakening every privacy technology to simplify investigations. Their analysis widens the set of options by examining how privacy-preserving systems can themselves support legitimate investigative work when agencies have the right technical and legal controls.

That distinction becomes more important as encryption, AI, digital identity, and protected computation move deeper into banking, communications, government services, and enterprise infrastructure. Police will encounter these technologies as part of ordinary economic systems rather than as specialist tools used only by sophisticated cyber criminals.

The resulting challenge for governments is therefore broader than legislating for access. They also need investigators who can understand unfamiliar technical environments, procurement processes capable of acquiring specialist tools, forensic standards that travel across borders, and governance strong enough to prevent powerful investigative technologies from undermining the privacy they were built to preserve.

Europe’s policing dilemma is becoming less about choosing between privacy and security than about whether public institutions can develop the technical capacity to operate effectively in systems designed to protect both. If that capacity does not keep pace, the gap between lawful authority and practical ability will widen regardless of what the legislation says.