Digital Services Act compliance guide

Build a service inventory around what the product does for recipients in the EU. Intermediary services need baseline governance such as points of contact, terms-and-conditions transparency, and content moderation transparency where moderation occurs. Hosting services add notice-and-action and statements of reasons. Online platforms add user complaint and dispute routes, misuse controls, transparency reporting, advertising and recommender disclosures, and protections for minors where relevant.

Marketplace-style online platforms that let consumers conclude distance contracts with traders need a separate trader file and product-listing control set. VLOPs and VLOSEs are a different tier: the 45 million average-monthly-active-recipient threshold and Commission designation trigger systemic-risk, audit, data-access, compliance-function, ad-repository, and enhanced transparency obligations.

Before assigning the online-platform controls, check the micro and small enterprise exclusions. Article 19 excludes qualifying providers from Section 3 platform duties except Article 24(3) information requests; Article 29 separately excludes qualifying marketplace providers from Section 4 trader and marketplace duties. Each exclusion can continue for 12 months after loss of the qualifying status, but neither applies to a service designated as a VLOP. Record the provider-size analysis alongside the service classification.

Hosting services need a notice-and-action mechanism that lets people notify specific items they consider illegal. The compliance record should show where the mechanism appears in the product, what information the notice form requests, how notices are routed, how trusted-flagger notices are prioritised when applicable, and how the team decides whether to remove, disable access to, restrict visibility of, or leave content available.

When a hosting provider restricts content or an account because content is illegal or violates terms, the DSA statement-of-reasons process should produce a user notice and, for online platforms, a submission record for the Commission's DSA Transparency Database without personal data. The evidence should connect the moderation decision, legal or terms basis, restriction type, redress route, decision owner, automation status, and database submission status.

Online platforms need an internal complaint-handling system for users and notice submitters to challenge moderation decisions covered by Article 20. Access must last at least six months after the decision notice, complaints must be electronic and free of charge, and final complaint decisions must not be made solely by automated means.

The complaint workflow should also surface out-of-court dispute settlement information. Certified bodies can handle disputes about content moderation decisions, including rejected illegal-content notices. Transparency evidence should capture complaint outcomes, reversals, median handling time, out-of-court disputes, and suspensions for manifestly illegal content or manifestly unfounded notices and complaints.

Online platforms that show ads need real-time ad labels and disclosures for the person on whose behalf the ad is presented, the payer if different, and meaningful targeting parameters. Platforms with recommender systems need plain-language terms describing main parameters and any user options to modify or influence them. Platforms accessible to minors need proportionate privacy, safety, and security measures and must not use profiling-based advertising to minors when they know with reasonable certainty that the recipient is a minor.

Marketplaces that let EU consumers conclude distance contracts with traders should treat trader traceability as an onboarding gate. Before a trader can offer products or services, the platform should collect and assess trader identity, contact, payment account, register details where applicable, and a self-certification to offer only products or services compliant with EU law. Listing interfaces should let traders provide required pre-contractual, product-safety, compliance, labelling, and marking information.

A platform or search engine at or above 45 million average monthly active recipients in the EU can be designated by the Commission as a VLOP or VLOSE. The enhanced obligations apply four months after the provider is notified of the designation decision. The service then needs a systemic-risk governance programme alongside content moderation. Risk assessments must cover illegal content, fundamental-rights effects, civic discourse and elections, public security, public health, minors, gender-based violence, and physical or mental wellbeing where relevant.

VLOP/VLOSE evidence should be ready for regulator requests, independent audits, public reporting, and vetted researcher access. The record should include risk assessments, mitigation measures, management-body review, independent compliance function materials, annual audit reports, audit implementation reports, ad repository controls, non-profiling recommender options, data-access procedures, and Article 42 transparency report inputs.

A useful DSA evidence pack should be organised by service tier, not by department. Legal can own interpretation, but product, trust and safety, marketplace operations, ads, data science, engineering, support, and compliance teams need retrievable records for the controls they run.

Do not keep only policy text. Keep operational proof: live interface captures, form schemas, moderation samples, complaint outcomes, database submission logs, report workpapers, trader files, recommender and ad configuration records, risk registers, audit materials, and management approvals.

For reporting periods beginning in 2026, Implementing Regulation (EU) 2024/2835 fixes the ordinary annual cycle at 1 January through 31 December and the VLOP/VLOSE cycles at 1 January through 30 June and 1 July through 31 December. Covered providers publish no later than two months after each period ends, use the harmonised machine-readable templates, and keep every published version available for at least five years. Apply the Article 15 and Article 42 scope and enterprise exclusions before treating a template row as mandatory.