DSA Crisis Response

Article 36 applies only where a crisis has occurred. The DSA defines that as extraordinary circumstances leading to a serious threat to public security or public health in the Union or in significant parts of it.

The mechanism is addressed to one or more providers of Commission-designated very large online platforms or very large online search engines. Article 33 sets the designation threshold at average monthly active recipients in the Union equal to or higher than 45 million; meeting that figure does not replace the Commission designation decision.

An Article 36 decision can require the provider to assess whether and how the functioning or use of its service significantly contributes to the serious threat, identify and apply effective and proportionate measures, and report to the Commission by the date or intervals specified in the decision.

The decision does not prescribe a universal emergency deadline for every provider. The Commission must specify a reasonable implementation period, account for urgency and implementation time, and limit required actions to no more than three months. Acting on a Board recommendation, it may extend the measures for no more than a further three months when the crisis and the provider's contribution continue.

The addressed provider chooses the specific measures, but the Commission monitors them and can require the provider to review measures it considers ineffective or disproportionate after consulting the Board. The provider should therefore preserve both the selection rationale and the evidence used to measure rights impacts and effectiveness.

Crisis response depends on the provider's Article 34 and Article 35 risk machinery. VLOPs and VLOSEs must assess systemic risks from the design, functioning, and use of their services, including algorithmic systems, content moderation systems, advertising systems, terms enforcement, data practices, intentional manipulation, and rapid dissemination.

Article 35 mitigation measures can include changes to service design, terms enforcement, content moderation speed and quality, recommender systems, advertising systems, internal resources, cooperation with trusted flaggers or other providers, user-facing information, child-protection measures, and markings for generated or manipulated media.

The crisis owner should be the VLOP/VLOSE compliance function, with direct escalation to management. Article 41 requires an independent compliance function with sufficient authority, resources, and access to the management body, and requires compliance officers to ensure Article 34 risks are reported and Article 35 mitigation measures are taken.

Commission requests can arrive outside the Article 36 decision itself. Article 67 allows the Commission to request information by simple request or decision; Article 72 allows monitoring actions, including access to databases and algorithms and retention of documents necessary to assess implementation and compliance.

Article 48 establishes voluntary crisis protocols. The European Board for Digital Services may recommend that the Commission initiate a protocol for extraordinary circumstances affecting public security or public health. The Commission coordinates participation by VLOPs, VLOSEs, and, where appropriate, other online platforms or search engines.

A usable protocol should specify the extraordinary circumstance and objective, participant roles, activation procedure, period of measures, fundamental-rights safeguards, and public reporting after the crisis.