Digital Investigations

Call for proposals:Internal Security Fund (ISF) Digital Investigations and Standardisation ISF-2026-TF2 to strengthen EU law enforcement and judicial capacity for cybercrime and digital investigations. Single-stage electronic submission via the EU Funding & Tenders Portal opens 15 September 2026 with deadline 15 December 2026 at 17:00 Brussels time. Indicative topic budget is approximately €5,000,000 with expected grants of €1,000,000–2,500,000 per Digital Investigations project and typical maximum duration of 24 months. Eligible applicants are legal entities including law enforcement and judicial authorities in participating EU Member States, consortia must include beneficiaries from at least two different Member States, and cooperation with private entities is supported where operationally relevant.

What it funds

Scope summary

Grants to strengthen EU law enforcement and judicial capacity for digital investigations and countering cybercrime: operational training, investigative techniques and tools (digital forensics, malware analysis, crypto tracing, OSINT, AI/LLM adaptation for investigations), encryption-related investigative toolboxes (not weakening general encryption), cross-border cooperation, 24/7 contact points, public-private information exchange and improving reporting of cybercrime. Projects must be implementation-ready (not feasibility studies) and should prioritise Europol IOCTA 2025 threat areas.

Who can apply:Legal entities (public or private) established in eligible countries; main beneficiaries expected are law enforcement and judicial authorities in EU Member States (entities from third countries with an operational agreement with Europol may participate under specific conditions). Consortia rules differ by topic (topic Digital Investigations requires minimum 2 beneficiaries from 2 different EU Member States). See call for full eligibility rules Call page. ¹

1. 1Project duration up to 24 months
2. 2Maximum EU grant per project: €1,000,000 to €2,500,000 for Digital Investigations
3. 3Funding rate: up to 90% (budget-based mixed actual costs with unit cost elements)

Key deadlines and process:opening 15 September 2026; submission deadline 15 December 2026 (Brussels time). Single-stage submission via the EU Funding & Tenders Portal. Admissibility, eligibility, financial/operational capacity checks and evaluation against Relevance, Quality and Impact criteria apply.

Application practicalities:use the Portal Application Form (Part A online; Part B PDF upload), respect page limits, register participants in the Participant Register (PIC/LEAR) and follow the Model Grant Agreement (ISF Action Grant Budget-Based). Contact HOME-ISF@ec.europa.eu for call-specific support.

Footnotes

1. 1Full call document, topic description, templates and legal conditions are on the Funding & Tenders Portal: Digital Investigations and Standardisation Topic page.

Opportunity summary

Call title:Digital Investigations and Standardisation. Funding programme: Internal Security Fund (ISF) Thematic Facility. Topic identifier: ISF-2026-TF2. Type of action: ISF Project Grants (ISF-PJG) under the ISF Action Grant Budget-Based Model Grant Agreement (ISF-AG). Opening date: 15 September 2026. Deadline: 15 December 2026 at 17:00 Brussels time (single-stage submission). Total call budget: €6 500 000 for the combined topics; topic Digital Investigations indicative topic budget: €5 000 000. Expected number of projects: up to four projects under Digital Investigations; one project under Standardisation. Projects maximum duration: normally 24 months. Maximum EU contribution per project for Digital Investigations: between €1,000,000 and €2,500,000. For Standardisation: up to €1,500,000. Proposals must be submitted electronically via the EU Funding & Tenders Portal Submission System using the AMIF/ISF/BMVI standard application form (Part A online; Part B PDF template uploaded).

Call webpage and documents:Full topic page, call document, annexes and templates are available on the Funding & Tenders Portal Digital Investigations ¹.

Scope, objectives and expected impact

Overall aim:fund operational projects to strengthen EU law enforcement and judicial authorities in investigating cyber-attacks and cyber-enabled crime, to increase availability and uptake of technical tools, to foster cross-border cooperation and private-public cooperation, and to support standards where relevant. Objectives: (1) develop capacity and expertise of law enforcement and judicial authorities; (2) contribute to implementation of EU law and strategic documents; (3) foster cross-border cooperation between law enforcement/judicial authorities and private entities.

Priority areas and scope details:Projects should deliver operational outcomes (training, tools, platforms, secondments, points of expertise, toolboxes, cooperation mechanisms) with a focus on top threat priorities identified in Europol IOCTA 2025, excluding online child sexual abuse (covered elsewhere). Areas of particular attention identified by Member States include digital forensics (mobile, computer, network, IoT including automotive, cloud), visual data analysis, malware analysis and reverse engineering, cryptocurrency tracing, disruption of criminal infrastructures, seizure and analysis, storage/processing/analysis of big data and large datasets, threat intelligence and metadata exploitation, OSINT, crimes involving AI, and addressing encryption challenges via lawful investigation techniques that do not weaken general encryption.

Additional thematic priorities:development, adaptation and lawful use of Large Language Models and AI-based solutions for analysis, translation, transcription, and detection of AI-generated criminal materials; improve cross-border cooperation (digital evidence collection/provision, 24/7 contact points, secondments, dedicated platforms); improve cooperation and information exchange interfaces with private sector actors; improve reporting of cybercrime to law enforcement.

Eligibility and consortium rules

Eligible participants:legal entities (public or private bodies) established in eligible countries (EU Member States participating in ISF, including overseas countries and territories, excluding Denmark; third countries that have operational agreements with Europol may participate exceptionally but only as part of a consortium that includes at least two independent legal entities, one established in an EU Member State). Natural persons generally are not eligible except self-employed persons where applicable. International organisations may participate as beneficiaries but cannot count towards the minimum eligible country requirement. Beneficiaries and affiliated entities must be registered and validated in the Participant Register (PIC, LEAR processes).

Consortium composition requirements:Topic Digital Investigations: minimum two applicants (beneficiaries) from at least two different participating EU Member States. Coordinator cannot be a profit-making entity, an international organisation or an entity established in a non-EU country. Topic Standardisation: at least one applicant from a participating EU Member State ensuring participation of practitioners from at least five EU Member States; preferably a consortium from at least two Member States. Affiliated entities are permitted and must be recorded; associated partners, subcontractors and third parties giving in-kind contributions are allowed under defined roles.

Eligible applicant types

1. 1Primary beneficiaries targeted: law enforcement authorities and judicial authorities (public bodies), national authorities and relevant public practitioners.
2. 2Other eligible applicant types: non-profit public/private entities, research institutions, universities, SMEs and industry actors (as beneficiaries or partners), national standardisation bodies (for Standardisation topic), technology providers, NGOs and civil society where relevant.
3. 3Entities from third countries with operational Europol agreement: may participate only as co-beneficiaries within consortia that include EU beneficiaries (see call conditions).
4. 4International organisations: may participate as beneficiaries but cannot be coordinators for certain topics and do not contribute to minimum country count.

Funding type and financial modalities

Funding type:grant — ISF Project Grants under budget-based ISF Action Grant (mixed actual cost grant with unit cost and flat-rate elements permitted). Funding rate: typically 90% (as indicated in call legal setup), to be confirmed in the Grant Agreement Data Sheet. Form of funding: actual eligible costs for most categories, unit costs allowed for travel/accommodation/subsistence and certain personnel categories (SME owners, volunteers) where applicable; indirect costs reimbursed at a flat rate of 7% of eligible direct costs (categories A-D, excluding volunteers and exempted categories). VAT rules: non-deductible VAT may be eligible except VAT paid by public bodies acting as public authority is not eligible. No profit rule applies.

Budget and award:Topic budget for Digital Investigations: €5,000,000 (indicative). Call total budget covering both topics: €6,500,000. Expected to fund up to four projects under Digital Investigations; maximum EU contribution per Digital Investigations project between €1,000,000 and €2,500,000. Maximum for Standardisation: €1,500,000. The awarding authority reserves the right not to award all available funds or to redistribute between topics depending on evaluation outcomes.

Eligible activities and outputs

Permitted activities include development, testing, validation, deployment and roll-out of operational tools and techniques, operational training, establishment and networking of points of expertise, development of toolboxes of alternative lawful investigative techniques (without weakening encryption), adaptation and operational use of AI/LLMs for investigative tasks, cryptocurrency and infrastructure analysis tools, cross-border cooperation mechanisms and platforms, secondments and 24/7 contact point improvements, enhanced reporting mechanisms and private-public information exchange interfaces, standardisation activities and participation support in standards processes (topic STANDARD). Financial support to third parties is not allowed under this call unless explicitly stated; call text clarifies financial support to third parties is not permitted for these topics.

Evaluation, award criteria and process

Submission and evaluation:single-stage electronic submission. Evaluation uses a two-step procedure: pre-selection based on Relevance (first step) followed by full evaluation against all award criteria for pre-selected proposals. An evaluation committee assesses admissibility and eligibility, operational capacity and award criteria. Ranking and tie-break: ex aequo tie-breaking uses scores on Relevance, then Impact, then Quality; additional prioritisation may consider portfolio balance and synergies.

1. 1Award criteria and scoring: Relevance (30 points, individual threshold 21/30); Quality (50 points); Impact (20 points). Overall pass threshold: 70/100.
2. 2Evaluation timeline (indicative): evaluation Dec 2026 — March 2027; information to applicants April 2027; grant agreement signature May 2027.
3. 3Number of evaluation stages for applicants: 2 (pre-selection on Relevance; full evaluation on all award criteria).

Admissibility, application format and templates

Applications must be submitted through the Funding & Tenders Portal using the AMIF/ISF/BMVI standard Application Form. Part A (administrative) is filled online; Part B (technical description) is a PDF using the portal template (maximum 50 pages for Part B, excluding annexes). Mandatory annexes include the list of previous projects (template provided in Part B as a separate annex) and other documents required for legal entity validation. Part C contains key performance indicators to be filled online. Proposals must be complete on submission and the Coordinator must confirm mandate for applicants. Paper submissions are not accepted.

Application page limits and formatting:Part B must not exceed 50 pages without annexes. Font minimum Arial 9. Margins and layout rules apply as per Part B template. Excess pages will be disregarded by evaluators.

Financial and operational capacity checks

Financial capacity:beneficiaries must show stable and sufficient resources to implement the project. Financial capacity checks apply except for public bodies, international organisations and cases where requested EU contribution is <= €60,000. The granting authority may require additional financial guarantees, prefinancing in instalments or joint and several liability if capacity is deemed insufficient. Operational capacity: applicants must demonstrate relevant experience, staff expertise and resources; assessed in the Quality criterion. Public bodies and international organisations are exempt from certain checks.

Reporting, payments and contract modalities

Once selected, successful projects enter grant preparation and sign the ISF Action Grant Model Grant Agreement (AMIF/ISF/BMVI MGA). Grants are budget-based mixed actual cost grants with unit costs and flat rates where applicable. Prefinancing is normally paid (prefinancing amount and guarantees set in Grant Agreement). No interim payments are foreseen in some grant configurations; the standard payment schedule includes prefinancing and final payment, with periodic reporting obligations. Indirect costs reimbursed at 7% flat rate. Certificates on financial statements (CFS) may be required above thresholds in the Data Sheet. Grants are subject to audits, checks, OLAF and Court of Auditors procedures and the EU Financial Regulation. No financial support to third parties is allowed for these topics.

Security, ethics and data handling

Projects must respect highest ethical standards, EU values, fundamental rights and applicable legislation. Actions involving classified information require security scrutiny and compliance with Decision 2015/444 and may require facility security clearances and personnel security clearances. Projects must ensure data protection compliance with the GDPR and Portal privacy rules. Proposals must demonstrate safeguards for individual rights and freedoms. Specific ethics or security aspects may trigger additional rules or requirements in the Grant Agreement (security aspects letters, SALs).

Special programme considerations and requirements

Tools and software expectations:tools developed should be made available to EU LEAs and Europol at little or no cost and distribution via the Europol Tools Repository will be an asset. Projects should build on prior EU research and R&I results (Horizon Europe, ISF etc.), re-use existing outputs, exploit Europol sandbox for testing where relevant, and ensure LEAs are involved throughout development and obtain ownership by LEAs. Standardisation topic should deliver concrete standards and increase practitioner participation in standards bodies. Proposals must avoid duplicating existing tools and demonstrate added value, user needs and sustainability after project end.

Key restrictions and exclusions

1. 1Online child sexual abuse is explicitly excluded from the scope of this topic and is funded under specific other calls.
2. 2Financial support to third parties is not allowed for this call unless the call text explicitly permits it; the ISF call indicates it is not allowed.
3. 3Measures that weaken encryption in general or have indiscriminate impact on large numbers of people are excluded. The call allows development of alternative investigative techniques that do not weaken encryption.
4. 4Projects must not duplicate existing publicly funded work and should demonstrate complementarity and added value.

Administrative contacts and helpdesk

For call-specific questions contact:HOME-ISF@ec.europa.eu. For submission system and IT issues use the Funding & Tenders Portal IT Helpdesk and the Online Manual available on the Portal. Topic Q&A on the topic page contains clarifications and portal FAQs include answers to repeated questions (e.g., inclusion of eligible third-country participants triggers a system warning but does not block submission).

Structured extraction of requested fields

Eligible Applicant Types:Eligible applicant types: public bodies (law enforcement and judicial authorities), non-profit public/private entities, research institutes and universities, SMEs and large enterprises (as beneficiaries or partners, but not eligible as coordinators for certain topics), international organisations (can participate but not as coordinators in specified cases), affiliated entities, NGOs and other stakeholders with relevant operational expertise. Natural persons generally not eligible except self-employed persons where company lacks separate legal personality. Entities from third countries having operational agreement with Europol may participate only as co-beneficiaries in consortia including at least one EU Member State beneficiary.

Funding Type:Primary financial mechanism: grant (ISF Project Grants; budget-based mixed actual cost grants with unit cost and flat-rate elements).

Consortium Requirement:Requirement: consortium (topic Digital Investigations requires minimum two independent beneficiaries from at least two different participating EU Member States; topic Standardisation can be single beneficiary but must ensure participation of practitioners from at least five Member States; coordinators must meet restrictions such as non-profit requirement for coordinator).

Beneficiary Scope (Geographic Eligibility):Geographic eligibility: applicants established in participating EU Member States (including OCTs) excluding Denmark are eligible; third countries with operational agreements with Europol may participate exceptionally as part of consortia that include at least one EU beneficiary; international organisations may participate under specific rules.

Target Sector:Target sectors and themes: cybersecurity, cybercrime, digital investigations, digital forensics (mobile, computer, network, IoT including automotive, cloud), malware analysis, reverse engineering, visual data analysis, cryptocurrencies/crypto-tracing, AI/LLM adaptation for law enforcement, threat intelligence/metadata exploitation, OSINT, cross-border law enforcement cooperation, standards for lawful access and interoperability, private-public cooperation in cybersecurity and incident response.

Mentioned Countries:Explicitly mentioned geographic references: EU Member States (general), Denmark excluded from ISF regulation application; third countries having operational agreements with Europol (not individually listed on the topic page). Region: European Union and associated third countries with Europol operational agreements.

Project Stage:Expected maturity: demonstration, validation and deployment/implementation stage. Projects should build on existing R&I results and prototypes; feasibility or scoping studies are not eligible as primary activities — preparatory work must be completed before grant signature.

Funding Amount:Funding range: Digital Investigations — €1,000,000 to €2,500,000 per project. Standardisation — up to €1,500,000 per project. Topic-level indicative budget: Digital Investigations €5,000,000; whole call €6,500,000.

Application Type:Method of submission: open call via Funding & Tenders Portal electronic submission system, single-stage. Applicants must use the AMIF/ISF/BMVI standard application form templates provided in the Submission System.

Nature of Support:Nature of support: monetary (grant funding reimbursing eligible costs) combined with non-financial expected outputs such as tools, training materials, standards, platforms, datasets and operational networks. Tools are expected to be made available to LEAs and Europol at little or no cost; testing via Europol sandbox is encouraged.

Application Stages:Evaluation stages: 2 main stages — Step 1 pre-selection on Relevance; Step 2 full evaluation against Relevance, Quality and Impact award criteria. Successful proposals invited to grant preparation (evaluation committee and grant preparation stage).

Success Rates:Success rate estimate: not provided explicitly. Indicative number of grants expected (Digital Investigations up to 4; Standardisation 1) relative to the number of submissions will determine success rate; competition will be strong given thematic interest and limited budget.

Co-funding Requirement:Co-funding: projects should ensure balanced budgets; own contributions, income generated by the action or third-party contributions may be included in the budget. The call does not require a fixed co-funding percentage beyond the funding rate applied to eligible costs; beneficiaries must show stable resources. The no-profit rule applies.

Application templates and structure guidance

Applicants must use the standard Application Form AMIF/ISF/BMVI templates available in the Portal Submission System. Part A is filled online and captures administrative data, participants, budget summary and declarations. Part B is the technical description using the standard template (maximum 50 pages) with structured sections aligned to evaluation criteria: Relevance (context, objectives, needs analysis, complementarity and EU added value), Quality (concept and methodology, consortium setup, project teams and staff, management, monitoring and risk management, cost-effectiveness), Impact (expected impacts, communication, dissemination, sustainability), Workplan (work packages, deliverables, milestones, staff effort, subcontracting justification, equipment), Ethics and Security sections, and annexes (mandatory list of previous projects as separate annex). Part C contains KPI declarations.

1. 1Part B structure: Cover page and summary; 1. Relevance (background, needs, complementarity); 2. Quality (methodology, consortium, staff, management, monitoring, finance); 3. Impact (communication, sustainability, replicability); 4. Workplan and WP details; 5. Other (ethics, security); Declarations and Annexes.
2. 2Mandatory annex: list of previous projects (last 4 years) using template in Part B and uploaded as separate PDF annex (failure to upload this mandatory annex renders application inadmissible).
3. 3Budget: Part A online budget summary; detailed breakdown follows Annex 2 and Annex 2a method elements (unit cost calculations) during grant preparation; ensure consistency between Part B descriptions and Part A values.

Tips and important practical points

Key recommendations:involve EU LEAs in the full development cycle; demonstrate linkage to Europol/EC3, EMPACT and existing EU funded R&I outputs; justify access to realistic datasets and plan validation (use Europol sandbox where possible); commit to tool availability for LEAs and Europol; avoid activities that would reduce encryption integrity; provide sustainability and ownership plans, including maintenance, licensing and distribution via Europol tools repository if relevant; plan for security clearance needs early if project involves classified information; allow time for legal entity validation and upload all required documents well before deadline to avoid portal issues.

Quick checklist for proposal preparation

• Confirm consortium composition meets topic-specific minimum country and participant rules.
• Register all beneficiaries and affiliated entities in Participant Register (PIC) and ensure LEARs are appointed.
• Use AMIF/ISF/BMVI Part B template; stay within 50-page limit for Part B (annexes excluded).
• Prepare mandatory annex: list of previous projects (last 4 years).
• Demonstrate operational ownership and clear plan for LEA ownership and distribution of tools, including licensing and Europol repository commitment.
• Provide KPIs with baseline and targets, deliverables, milestones and a realistic workplan for up to 24 months.
• Address ethics, data protection (GDPR), and security (facility/personnel clearances if needed).
• Prepare financial information for financial capacity checks and plan for potential prefinancing guarantee if requested.
• Ensure no duplication of existing EU-funded tools and show complementarity with prior R&I projects and Europol activities.

This summary is prepared from the official Funding & Tenders Portal topic page and the Call Document (Call for proposals ISF-2026-TF2-AG-CYBER) published on 15 September 2026. Candidates should consult the official topic page and call documentation for full legal details and to download templates and submission forms before preparing applications ¹.

Footnotes

1. 1Official topic page and call documents: Digital Investigations. Available at: ec.europa.eu

This is an open single-stage Internal Security Fund call for proposals under Digital Investigations and Standardisation, designed to strengthen cybercrime investigation capacity, technical tools, and cross-border cooperation for law enforcement and judicial authorities. The official topic page is the authoritative source for the call details¹. A public EU funding bulletin also records the topic as open from 15 September 2026 to 15 December 2026[1].

What the funding is about

The call supports projects that improve operational capabilities in countering cybercrime and supporting digital investigations. The expected impact is to increase the operational capacity of law enforcement and judicial authorities, increase the availability of technical tools, and improve awareness of best practices and available solutions through stronger synergies among relevant stakeholders.

The objectives are to develop the capacity and expertise of law enforcement and judicial authorities, contribute to the implementation of EU law and strategic documents, and foster cross-border cooperation between law enforcement or judicial authorities and private entities.

The scope is broad but clearly practical. It includes training, investigative techniques, and tools for investigating cyber-attacks and cyber enabled crime, with a focus on top threat priorities identified in Europol Internet Organised Crime Threat Assessment 2025. Online child sexual abuse is excluded because it is covered by separate calls.

• Digital forensics, including mobile, computer, network, IoT, automotive, and cloud forensics
• Visual data analysis
• Malware analysis and reverse engineering
• Cryptocurrency tracing
• Identifying and disrupting criminal infrastructures
• Analysis and seizure
• Storage, processing, analysis, and transfer of big data and large datasets
• Use of threat intelligence, metadata, and OSINT
• Crime involving the use of AI by offenders
• Tools and techniques addressing encryption in criminal investigations without weakening encryption in general
• Use or adaptation of large language models and AI based solutions for analysis, translation, transcription, and detection of AI generated criminal materials
• Cross-border digital evidence cooperation, secondment of officials, and more efficient 24/7 cybercrime contact points
• Cooperation between private entities and authorities, including information exchange systems
• Improved reporting of cybercrime to law enforcement authorities

Who can apply

The call is aimed at projects involving law enforcement and or judicial authorities, and it explicitly supports cooperation with private entities where this strengthens cybersecurity and digital investigations. The exact eligible countries, applicant types, and any consortium requirements are set out in section 6 of the call document, so applicants should verify eligibility before drafting the proposal.

Because the topic is framed around operational capacity, expertise, cross-border cooperation, and practical tooling, strong applicants are likely to be those able to demonstrate direct relevance to investigative work, access to operational partners, and clear pathways to implementation and uptake.

Key funding facts

Conditions and requirements applicants should note

1. 1Admissibility rules on proposal page limit and layout are defined in section 5 of the call document and in Part B of the application form.
2. 2Eligible countries and other eligibility conditions are defined in section 6 of the call document.
3. 3Financial and operational capacity, together with exclusion rules, are defined in section 7 of the call document.
4. 4Submission and evaluation processes are described in section 8 of the call document and the Online Manual.
5. 5Award criteria, scoring, and thresholds are described in section 9 of the call document.
6. 6Indicative timeline for evaluation and grant agreement is described in section 4 of the call document.
7. 7Legal and financial set up of the grant is described in section 10 of the call document.

The topic is published in the EU Funding and Tenders Portal, and the submission session is available. Applications must be submitted electronically through the portal submission system rather than by paper.

Assessment of the opportunity

This is a focused operational cybersecurity and justice cooperation call rather than a research call. It is well suited to proposals that can show immediate practical value, cross border utility, and strong involvement of competent public authorities, with private sector interfaces where appropriate.

Applicants should pay special attention to the explicit exclusion of measures that would weaken encryption in general or affect an indiscriminate number of people. Proposals that use AI should present a concrete investigative benefit, a clear legal and ethical framework, and a realistic implementation plan.

Footnotes

1. 1Official topic page: Digital Investigations.