You're right, it doesn't use the word "scan", it uses "detect". It doesn't say "chat", it says "interpersonal communication". There are 335 mentions of "child sexual abuse", I wouldn't call that "barely mentions". All of it is mentioned in the opening paragraph as background info.

Detection obligations have indeed been removed since the linked document (it wasn't before that, as you can see in that same document, page 3), thanks to the EP, but it still provides the legal framework for companies to do so anyway, without any reasonable suspicion. That's already bad enough.

Moreover, there are mitigation obligations:

Certain providers of high-risk services will have the obligation to take measures to develop relevant technologies to mitigate the risk of child sexual abuse identified on their services

In order to prevent and combat online child sexual abuse effectively, providers of hosting services and providers of publicly available interpersonal communications services should take all reasonable measures to mitigate the risk of their services being misused for such abuse, as identified through the risk assessment

Mitigation is very hard to do without identifying it. For that you'll have to detect it in some way, f.e. by scanning chats, which you are allowed to do through this. Scanning might not be the only way (though I can't think of another way), but it is the easiest way.

In particular, given the importance of ensuring that all possible risk mitigation measures have been taken in accordance with this Regulation, the competent authorities should be granted specific powers to require providers to adjust their risk assessment or mitigation measures so as to ensure compliance with the relevant requirements of this Regulation

Authorities can adjust the risk assessment themselves.

Accordingly, this Regulation should not apply to interpersonal communications services that are not available to the general public and the use of which is instead restricted to persons involved in the activities of a particular company, organisation, body or authority.

Very ironic. The ruling class and elites are excluded.

E2EE protection is nice, but pretty irrelevant. With clientside scanning, the E2EE is not broken, because your device has already decrypted it. It simply negates E2EE

This EU explainer, puts the document in simpler language: https://www.consilium.europa.eu/en/press/press-releases/2025/11/26/child-sexual-abuse-council-reaches-position-on-law-protecting-children-from-online-abuse/

The new law, once adopted, comes with obligations for digital companies to prevent the dissemination of child sexual abuse material and the solicitation of children.

How would a chat company do such a thing without scanning chats?

But, even if all of it was fully voluntary (what chat control 1 more or less is), it's still really bad. Why do we want to give companies the legal right to scan everything we do on their platforms?

I recommend taking a look at Patrick Breyer's site (ex-MEP for the Pirate Party) and the EDRi.