Artifact GuideEU

DSA Crisis Response

An official source guide to Digital Services Act crisis response duties for very large online platforms and very large online search engines.

Use it to separate Article 36 Commission crisis-response decisions from Article 48 voluntary crisis protocols, and to prepare the records, governance, and mitigation evidence those mechanisms depend on.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

Jul 24, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated Jul 24, 2026

Overview

The Digital Services Act is an enhanced process triggered by a Commission decision, not a deadline for ordinary platform incidents. Article 36 allows the Commission, acting on a recommendation from the European Board for Digital Services, to require designated very large online platforms or very large online search engines to assess and limit their contribution to a serious public-security or public-health threat. separately covers voluntary crisis protocols for extraordinary circumstances affecting public security or public health.

Section 1

When the DSA crisis response mechanism applies

Article 36 applies only where a crisis has occurred. The DSA defines that as extraordinary circumstances leading to a serious threat to public security or public health in the Union or in significant parts of it.

The mechanism is addressed to one or more providers of Commission-designated very large online platforms or very large online search engines. Article 33 sets the designation threshold at average monthly active recipients in the Union equal to or higher than 45 million; meeting that figure does not replace the Commission designation decision.

Do not treat every trust-and-safety incident as an Article 36 crisis; first identify the public-security or public-health threat and whether the Commission has adopted a decision.
Confirm whether the service is designated as a VLOP or VLOSE, because Article 36 is written for those providers.
Separate Article 36 obligations from ordinary Article 34 risk assessment, Article 35 risk mitigation, and general enforcement requests.
Keep a crisis intake record with the Commission decision, Board recommendation context if available, affected service, threat description, scope, and responsible compliance officer.

Sources for this answer

Regulation (EU) 2022/2065 (Digital Services Act)

Article 36 defines when a DSA crisis exists and when the Commission may require VLOPs or VLOSEs to assess and address contribution to the threat.

European Commission - VLOPs and VLOSEs under the DSA

Commission overview for the VLOP/VLOSE threshold and the enhanced DSA obligations that apply after designation.

Section 2

What an Article 36 Commission decision can require

An Article 36 decision can require the provider to assess whether and how the functioning or use of its service significantly contributes to the serious threat, identify and apply effective and proportionate measures, and report to the Commission by the date or intervals specified in the decision.

The decision does not prescribe a universal emergency deadline for every provider. The Commission must specify a reasonable implementation period, account for urgency and implementation time, and limit required actions to no more than three months. Acting on a Board recommendation, it may extend the measures for no more than a further three months when the crisis and the provider's contribution continue.

The addressed provider chooses the specific measures, but the Commission monitors them and can require the provider to review measures it considers ineffective or disproportionate after consulting the Board. The provider should therefore preserve both the selection rationale and the evidence used to measure rights impacts and effectiveness.

Create an Article 36 response file with the assessment question, affected product surfaces, data reviewed, risk hypothesis, and evidence used to decide whether the service contributes to the threat.
Document the exact measures selected by the provider, because Article 36 leaves the choice of specific measures with the addressed provider.
Show proportionality: gravity of the threat, urgency, impact on users and other affected parties, and fundamental-rights considerations.
Track the Commission reporting date or interval exactly as written in the decision instead of applying an unsourced 24-hour, 72-hour, or internal incident-response timeline.

Sources for this answer

Regulation (EU) 2022/2065 (Digital Services Act)

Article 36 lists the assessment, mitigation, reporting, proportionality, implementation timing, three-month measure limit, possible further three-month extension, monitoring, amendment, and reporting-to-Parliament/Council rules for Commission crisis-response decisions.

European Commission - Digital Services Act Questions and Answers

Commission Q&A explains that crisis measures should be necessary, time-limited, and mindful of freedom of expression and information.

Section 3

Mitigation measures to prepare before a crisis

Crisis response depends on the provider's Article 34 and Article 35 risk machinery. VLOPs and VLOSEs must assess systemic risks from the design, functioning, and use of their services, including algorithmic systems, content moderation systems, advertising systems, terms enforcement, data practices, intentional manipulation, and rapid dissemination.

Article 35 mitigation measures can include changes to service design, terms enforcement, content moderation speed and quality, recommender systems, advertising systems, internal resources, cooperation with trusted flaggers or other providers, user-facing information, child-protection measures, and markings for generated or manipulated media.

Keep crisis-ready views of the systems most likely to contribute to rapid spread: recommender ranking, search, trends, ads delivery, live or short-form distribution, account creation, and content moderation queues.
Predefine evidence owners for trust and safety, ranking/recommender systems, advertising integrity, policy, legal, data science, communications, compliance, and executive review.
Prepare measure playbooks that can be activated proportionately: reduce amplification, adjust recommendations, add authoritative information panels, increase moderation resources, tune notice handling, or pause specific advertising or monetisation features where justified.
Test whether each measure can be measured for implementation and impact, because Article 36 reporting can ask for qualitative and quantitative impact.

Sources for this answer

Regulation (EU) 2022/2065 (Digital Services Act)

Articles 34 and 35 identify the systemic-risk assessment factors and the types of reasonable, proportionate, and effective mitigation measures relevant to crisis response.

European Commission - VLOPs and VLOSEs under the DSA

Commission overview confirms that VLOPs and VLOSEs must assess systemic risks, put mitigation measures in place, and maintain internal compliance functions.

Section 4

Governance, requests for information, and records

The crisis owner should be the compliance function, with direct escalation to management. Article 41 requires an independent compliance function with sufficient authority, resources, and access to the management body, and requires compliance officers to ensure Article 34 risks are reported and Article 35 mitigation measures are taken.

Commission requests can arrive outside the Article 36 decision itself. Article 67 allows the Commission to request information by simple request or decision; Article 72 allows monitoring actions, including access to databases and algorithms and retention of documents necessary to assess implementation and compliance.

Maintain a Commission-request log with legal basis, purpose, requested information, deadline, responder, source systems, privilege/confidentiality review, and completeness checks.
Keep supporting documents for Article 34 risk assessments for at least three years after the assessment, and be ready to provide them to the Commission or the Digital Services Coordinator of establishment on request.
Preserve crisis evidence in a reviewable package: decision received, measures considered, measures rejected, proportionality analysis, user-rights safeguards, implementation timestamps, metrics, communications, and Commission submissions.
Align crisis records with audit and transparency reporting, because VLOPs/VLOSEs must publish risk assessment results, specific Article 35 mitigation measures, audit reports, audit implementation reports, and consultation information after audit reporting events.

Sources for this answer

Regulation (EU) 2022/2065 (Digital Services Act)

Articles 34, 41, 42, 67, and 72 support the page's recordkeeping, compliance-function, transparency, request-for-information, and monitoring guidance.

European Commission - DSA enforcement framework

Commission enforcement overview describes RFIs, algorithm and data access orders, inspections, and possible fines for incorrect, misleading, incomplete, or late responses.

European Commission - How the DSA enhances transparency online

Commission transparency overview explains public risk assessment, mitigation, audit, implementation, and consultation reporting for VLOPs and VLOSEs.

Section 5

How Article 48 crisis protocols differ

establishes voluntary crisis protocols. The European Board for Digital Services may recommend that the Commission initiate a protocol for extraordinary circumstances affecting public security or public health. The Commission coordinates participation by VLOPs, VLOSEs, and, where appropriate, other online platforms or search engines.

A usable protocol should specify the extraordinary circumstance and objective, participant roles, activation procedure, period of measures, fundamental-rights safeguards, and public reporting after the crisis.

Does the EU Digital Services Act impose a fixed emergency response deadline for every platform crisis?

No. Article 36 uses a Commission decision for VLOPs and VLOSEs in a defined crisis and requires reporting by the date or intervals specified in that decision. Required measures may last no more than three months, with a possible further extension of no more than three months through the Article 36 process. protocols define their own activation period, limited to what is necessary for the extraordinary circumstances.

What evidence should a VLOP or VLOSE keep for DSA crisis response?

Keep the Article 36 decision or protocol, threat assessment, affected service surfaces, selected and rejected measures, proportionality and rights-safeguard analysis, implementation evidence, impact metrics, Commission submissions, request-for-information responses, and public reporting after protocol termination.

Protocol measures may include prominent display of crisis information from Member State, Union-level, or other reliable bodies.
The protocol should identify a crisis-management point of contact, which may be the Article 11 electronic point of contact or, for VLOPs/VLOSEs, the Article 41 compliance officer.
Resource adjustments should be tied to DSA workflows affected by the crisis, including notice handling, complaints, trusted-flagger processing, repeat misuse, and Article 35 mitigation.
After termination, retain the public report on measures taken, duration, and outcomes with the internal activation and deactivation record.

Sources for this answer

Regulation (EU) 2022/2065 (Digital Services Act)

Article 48 defines voluntary crisis protocols, their public-security/public-health boundary, participant roles, activation and duration procedures, safeguards, and post-crisis public reporting.

European Commission - Electoral systemic-risk guidelines for VLOPs and VLOSEs

Commission guidelines identify Articles 36 and 48 as relevant crisis-response mechanisms alongside Article 35 systemic-risk mitigation for election-related risks.

Recommended next step

Turn Article 36 and Article 48 duties into reviewable records

Sorena can help structure DSA crisis-response records around Commission requests, systemic-risk measures, proportionality checks, public reporting, and evidence retrieval.

Research workflow

Open Research Copilot for DSA crisis response

Ask questions tied to cited sources about Article 36 decisions, Article 48 protocols, VLOP/VLOSE obligations, Commission RFIs, and evidence records.

Explore next step

Talk to Sorena

Talk through implementation

Review your DSA crisis-response governance, mitigation evidence, reporting records, and source gaps with Sorena.

Explore next step

Primary sources

References and citations

European Commission - Digital Services Act Questions and Answers

digital-strategy.ec.europa.eu

Referenced sections

Commission Q&A explains that crisis measures should be necessary, time-limited, and mindful of freedom of expression and information.

"measures cannot go beyond what is necessary"

European Commission - DSA enforcement framework

digital-strategy.ec.europa.eu

Referenced sections

Commission enforcement overview describes RFIs, algorithm and data access orders, inspections, and possible fines for incorrect, misleading, incomplete, or late responses.

"send a request for information"

European Commission - Electoral systemic-risk guidelines for VLOPs and VLOSEs

digital-strategy.ec.europa.eu

Referenced sections

Commission guidelines identify Articles 36 and 48 as relevant crisis-response mechanisms alongside Article 35 systemic-risk mitigation for election-related risks.

"Articles 36 and 48 on Crisis Response Mechanisms and Protocols"

European Commission - How the DSA enhances transparency online

digital-strategy.ec.europa.eu

Referenced sections

Commission transparency overview explains public risk assessment, mitigation, audit, implementation, and consultation reporting for VLOPs and VLOSEs.

"publish their audit report together with the risk assessment reports"

European Commission - VLOPs and VLOSEs under the DSA

digital-strategy.ec.europa.eu

Referenced sections

Commission overview confirms that VLOPs and VLOSEs must assess systemic risks, put mitigation measures in place, and maintain internal compliance functions.

"identify, analyse, and assess systemic risks"

Regulation (EU) 2022/2065 (Digital Services Act)

eur-lex.europa.eu

Referenced sections

Article 48 defines voluntary crisis protocols, their public-security/public-health boundary, participant roles, activation and duration procedures, safeguards, and post-crisis public reporting.