EU Digital Services Act deadlines and compliance calendar

The DSA applies generally from 17 February 2024. A defined set of provisions applied earlier from 16 November 2022, including Article 24(2), (3), and (6) and Article 33(3) to (6). Those provisions enabled active-recipient publication, information requests, and VLOP/VLOSE designation before full application.

For providers within Article 15, the first annual content-moderation reporting cycle began with full application. Article 15(2) excludes providers that qualify as micro or small enterprises under Recommendation 2003/361/EC unless they are designated VLOPs. That exemption must be tested separately from Article 19, which excludes qualifying micro and small online platforms from most online-platform-specific duties but preserves Article 24(3) authority requests.

A service falls within the Article 33 designation test when it has at least 45 million average monthly active recipients in the Union and the Commission designates it. Crossing the numerical threshold does not by itself complete designation. The Commission may rely on published figures, requested information, or other available information and must notify its decision.

The Section 5 obligations for a designated VLOP or VLOSE apply four months after notification to the provider. The first cohort comprised 17 VLOPs and 2 VLOSEs designated on 25 April 2023; the Commission stated that their additional obligations applied from the end of August 2023.

Providers subject to Article 15 must publish content-moderation reports at least annually. The first cycle after full application ended when the provider published its first report, no later than 16 February 2025. A shortened transitional cycle then ran from the end of that provider's first reporting period through 31 December 2025.

Implementing Regulation (EU) 2024/2835 requires the Annex I CSV or XLSX templates for information covering content moderation from 1 July 2025. For the earlier part of the transitional cycle, template use was encouraged but not required. From 1 January 2026, the ordinary annual period is 1 January to 31 December, with publication no later than two months after period end.

Article 42 requires a VLOP or VLOSE to publish its first Article 15 report no later than two months after its Section 5 application date and then at least every six months. Implementing Regulation (EU) 2024/2835 now aligns those periods to 1 January through 30 June and 1 July through 31 December, with reports due no later than two months after each period.

The first VLOP/VLOSE cycle under the Annex I templates covered 1 July through 31 December 2025. From 2026, calendar two data-close and publication workstreams each year rather than calculating a rolling six-month date from an older report.

Statement-of-reasons work is event driven. Article 17 requires a hosting service to notify an affected recipient at the latest when it imposes a covered restriction, but only when the provider knows the relevant electronic contact details. Article 17 does not apply to deceptive high-volume commercial content or to Article 9 orders. Article 24(5) separately requires covered online platforms to submit the Article 17 decisions and statements to the Commission database without undue delay and without personal data.

Article 19 can exclude a qualifying micro or small online platform from Article 24(5), but not from the underlying Article 17 hosting duty. The operating control should reconcile covered moderation decisions, user notices, personal-data removal, and database submission status on a frequency proportionate to moderation volume.

Keep separate records for fixed legal dates, repeating reporting periods, designation-triggered deadlines, and event-driven submissions. The provider-level entity is not enough when different services fall into different DSA categories or only one service has been designated.

Use one line per service and legal clock. Record each exclusion decision and its evidence. Apply VLOP/VLOSE deadlines only to designated services, and keep the Commission database's operational retention policy separate from the provider's legal record-retention rules.