EU DSA vs UK Online Safety Act platform duties compared
This comparison helps separate EU intermediary and platform duties from UK online safety duties for user-to-user and search services.
The practical split is scope first, then regulator, risk assessment, illegal and harmful content duties, child protection, transparency, enforcement, and the team that owns implementation.
The EU Digital Services Act and UK Online Safety Act can both govern one service, but they use different territorial, service, and risk tests. The DSA classifies intermediary services offered in the EU and adds duties by role and size. The UK Act covers each or search service with links to the UK, including overseas services that meet the Act's UK nexus. Its illegal-content safety duties have applied since 17 March 2025, and its child-safety duties since 25 July 2025. Classify each product surface under both regimes before reusing a control or risk assessment.
Side-by-side comparison
EU Digital Services Act vs UK Online Safety Act
Use these rows to decide which regime applies, what each one requires, and where evidence can be reused without merging different legal duties.
EU regime for intermediary services offered to recipients in the Union, with layered duties for hosting services, online platforms, marketplaces, VLOPs, and VLOSEs.
Second framework
UK Online Safety Act
UK regime for regulated user-to-user services, search services, and related online services, supervised by Ofcom with duties focused on illegal content, children, transparency, and service accountability.
Covers intermediary services with a substantial connection to the EU, including mere conduit, caching, hosting, online platforms, online marketplaces, and online search engines. Duties increase by service tier and by VLOP/VLOSE designation.
Covers regulated user-to-user services and search services, with additional structures for services likely to be accessed by children, categorised services, and services involving regulated provider pornographic content.
Classify the EU intermediary role and the UK regulated-service type separately before deciding whether the same product surface is in scope under both regimes.
National Digital Services Coordinators supervise many DSA providers, while the European Commission directly supervises and enforces the VLOP and VLOSE obligations.
Ofcom is the independent UK online-safety regulator and sets codes, guidance, transparency expectations, information requests, enforcement notices, and penalties.
VLOPs and VLOSEs must assess systemic risks in the EU from service design, functioning, algorithmic systems, and use of the service, including illegal content, fundamental rights, civic discourse, public security, public health, minors, gender-based violence, and wellbeing.
Regulated services must work through illegal-content risk, children's access, children's risk, and Ofcom code or guidance expectations where relevant to the service.
Do not collapse DSA systemic-risk work into the UK illegal-content or child-safety assessment; keep the assessment scope, source, reviewer, and mitigation evidence labelled.
The UK Act is organised around illegal content duties, child-safety duties, content harmful to children, provider pornographic content, reporting and complaints, and Ofcom codes of practice.
Use a shared owner matrix only if each row has a DSA or UK label, a cited source, an accountable delivery team, and the evidence artifact that proves the control is operating.
Online platforms accessible to minors must use appropriate and proportionate privacy, safety, and security measures, and must not present profiling-based ads to minors when aware with reasonable certainty that the recipient is a minor.
In-scope services likely to be accessed by children must address child-safety duties, including measures to prevent children accessing the most harmful content and protect them from harmful or age-inappropriate content.
This row helps separate the evidence pack: DSA minor-protection measures on one side, UK child-safety evidence on the other, and only mark controls as shared when both sources support the same artifact.
The Commission can investigate VLOPs and VLOSEs, request information and data or algorithm access, impose interim measures, and impose fines for DSA breaches up to 6% of global annual turnover, with separate procedural penalties available.
Ofcom can investigate non-compliance, issue enforcement action, and impose fines up to GBP 18 million or 10% of qualifying worldwide revenue, whichever is greater, according to GOV.UK's Online Safety Act overview.
Escalation records should name the correct authority, response deadline, source request, and penalty framework instead of using a generic platform-regulator risk label.
DSA evidence includes terms-and-conditions explanations, content-moderation transparency reports, statement-of-reasons submissions, advertising disclosures, recommender-system parameters, VLOP/VLOSE ad repositories, and risk or audit reporting where applicable.
UK evidence includes risk-assessment records, terms enforcement, user reporting and complaints processes, transparency reporting for relevant services, Ofcom information responses, and records showing code or alternative-measure compliance.
If the product surface is an EU intermediary service, map the DSA tier and obligations first; if it is a VLOP or VLOSE, add the systemic-risk, audit, data-access, and recommender obligations on top.
If the product surface is a UK or search service, map the Ofcom duty set first; if children are likely to access it, add the child-safety and age-assurance pack.
Do not treat the scope rows as the decision itself. Use them to choose the legal track, then attach the control pack that matches that track and its regulator.
Covers intermediary services with a substantial connection to the EU, including mere conduit, caching, hosting, online platforms, online marketplaces, and online search engines. Duties increase by service tier and by VLOP/VLOSE designation.
Covers regulated user-to-user services and search services, with additional structures for services likely to be accessed by children, categorised services, and services involving regulated provider pornographic content.
Classify the EU intermediary role and the UK regulated-service type separately before deciding whether the same product surface is in scope under both regimes.
National Digital Services Coordinators supervise many DSA providers, while the European Commission directly supervises and enforces the VLOP and VLOSE obligations.
Ofcom is the independent UK online-safety regulator and sets codes, guidance, transparency expectations, information requests, enforcement notices, and penalties.
VLOPs and VLOSEs must assess systemic risks in the EU from service design, functioning, algorithmic systems, and use of the service, including illegal content, fundamental rights, civic discourse, public security, public health, minors, gender-based violence, and wellbeing.
Regulated services must work through illegal-content risk, children's access, children's risk, and Ofcom code or guidance expectations where relevant to the service.
Do not collapse DSA systemic-risk work into the UK illegal-content or child-safety assessment; keep the assessment scope, source, reviewer, and mitigation evidence labelled.
The UK Act is organised around illegal content duties, child-safety duties, content harmful to children, provider pornographic content, reporting and complaints, and Ofcom codes of practice.
Use a shared owner matrix only if each row has a DSA or UK label, a cited source, an accountable delivery team, and the evidence artifact that proves the control is operating.
Online platforms accessible to minors must use appropriate and proportionate privacy, safety, and security measures, and must not present profiling-based ads to minors when aware with reasonable certainty that the recipient is a minor.
In-scope services likely to be accessed by children must address child-safety duties, including measures to prevent children accessing the most harmful content and protect them from harmful or age-inappropriate content.
This row helps separate the evidence pack: DSA minor-protection measures on one side, UK child-safety evidence on the other, and only mark controls as shared when both sources support the same artifact.
The Commission can investigate VLOPs and VLOSEs, request information and data or algorithm access, impose interim measures, and impose fines for DSA breaches up to 6% of global annual turnover, with separate procedural penalties available.
Ofcom can investigate non-compliance, issue enforcement action, and impose fines up to GBP 18 million or 10% of qualifying worldwide revenue, whichever is greater, according to GOV.UK's Online Safety Act overview.
Escalation records should name the correct authority, response deadline, source request, and penalty framework instead of using a generic platform-regulator risk label.
DSA evidence includes terms-and-conditions explanations, content-moderation transparency reports, statement-of-reasons submissions, advertising disclosures, recommender-system parameters, VLOP/VLOSE ad repositories, and risk or audit reporting where applicable.
UK evidence includes risk-assessment records, terms enforcement, user reporting and complaints processes, transparency reporting for relevant services, Ofcom information responses, and records showing code or alternative-measure compliance.
If the product surface is an EU intermediary service, map the DSA tier and obligations first; if it is a VLOP or VLOSE, add the systemic-risk, audit, data-access, and recommender obligations on top.
If the product surface is a UK or search service, map the Ofcom duty set first; if children are likely to access it, add the child-safety and age-assurance pack.
Do not treat the scope rows as the decision itself. Use them to choose the legal track, then attach the control pack that matches that track and its regulator.
How should teams decide whether one control can cover both regimes?
First classify the service separately under the DSA and the UK Online Safety Act.
Then map the duty: DSA intermediary or platform duty, VLOP/VLOSE systemic-risk duty, UK illegal-content duty, UK child-safety duty, transparency duty, or regulator-response duty.
Reuse evidence only when the artifact answers both cited duties without hiding different regulators, content categories, user notices, or assessment triggers.
Escalate when a product change adds user-to-user functionality, search functionality, marketplace trading, recommender ranking, targeted advertising, child access, or VLOP/VLOSE-scale exposure.
Start with the service classification, not a shared online-safety label
A service can fall under the DSA because it is a mere conduit, caching, hosting, online platform, marketplace, online search engine, VLOP, or VLOSE offered to recipients in the EU. That analysis is not the same as the UK test for regulated user-to-user services, search services, or services involving regulated provider pornographic content. A service has links with the UK if it has a significant number of UK users, targets the UK market, or is capable of being used in the UK and creates a material risk of significant harm to people there.
Check exclusions under each law before mapping duties. Under the DSA, the service role determines which obligation layer applies, and a provider can operate several differently classified surfaces. Under the UK Act, Schedule 1 excludes specified services or functions, including email, SMS and MMS, certain limited-functionality services, internal business services, and some public-body, education, childcare, and healthcare services. Apply the statutory conditions rather than treating the presence of comments, reviews, messaging, or search as conclusive by itself.
For comparison work, keep two service inventories: one that classifies the EU intermediary role and one that classifies the UK service type. Reuse product facts such as user-generated content, search functionality, age access, recommender systems, advertising, and moderation flows, but do not copy the legal conclusion from one regime into the other.
DSA scoping asks whether the service is an intermediary service and which DSA tier applies.
UK Online Safety Act scoping asks whether the service is a , search service, or related regulated service category.
Marketplace, app-store, social, search, forum, hosting, and messaging features may need separate classification if they are operated as distinct service surfaces.
Under the DSA, all covered services need tier-appropriate governance, but the formal systemic-risk assessment regime is concentrated on VLOPs and VLOSEs. Those providers assess risks such as illegal content, fundamental-rights impacts, civic discourse, public security, public health, protection of minors, gender-based violence, and physical or mental wellbeing, then apply mitigation measures.
Under the UK Online Safety Act, risk work is tied to illegal content, child access, children's risk, provider pornography, service categorisation, and Ofcom codes and guidance. Providers had to complete illegal-content risk assessments by 16 March 2025 before the safety duties took effect on 17 March 2025. Services likely to be accessed by children had to record children's risk assessments by 24 July 2025 and comply with the child-safety duties from 25 July 2025. New or materially changed services still need event-driven assessment and review under the Act and Ofcom guidance. Since 7 April 2026, the Act has also required regulated user-to-user providers to report detected and previously unreported child sexual exploitation and abuse content to the National Crime Agency. For providers outside the UK, the duty is limited to UK-linked content; Ofcom states that commencement for search services will follow later.
Keep DSA VLOP/VLOSE systemic-risk evidence separate from UK illegal-content and children's-risk assessments.
For recommender, moderation, age-assurance, and advertising changes, record which regime created the control requirement.
Do not present a single global online-safety risk assessment as satisfying both regimes unless each required source, owner, and output is mapped.
Child protection overlaps, but the compliance evidence is not identical
The DSA requires online platforms accessible to minors to put in place appropriate and proportionate measures for privacy, safety, and security, and restricts profiling-based advertising to minors where the platform is aware with reasonable certainty that the recipient is a minor. For VLOPs and VLOSEs, minors also appear inside the systemic-risk and mitigation framework.
The UK Online Safety Act is more explicitly organised around child access and child-safety duties for regulated user-to-user and search services. Ofcom's child-safety codes and related guidance focus on governance, safer platform design, age understanding or age assurance, recommender and moderation measures, reporting, complaints, and tools for children and carers.
DSA evidence should show platform accessibility to minors, safety measures, advertising controls, recommender settings, and any VLOP/VLOSE risk treatment.
UK evidence should show children's access assessment, children's risk assessment, age-assurance approach, content reporting, complaints, and code-of-practice implementation choices.
A shared child-safety product control can serve both regimes only if the DSA article or Commission guidance and the UK Act, Ofcom code, or GOV.UK source are both cited.
Implementation ownership should follow the duty, regulator, and product control
For the DSA, legal and compliance teams should classify the service, while trust and safety, marketplace operations, advertising, recommender-system, content-moderation, and data-access owners maintain the operational evidence. VLOP and VLOSE work also needs compliance-function, audit, research-access, and regulatory-response ownership.
For the UK Online Safety Act, Ofcom-facing accountability should sit with legal or regulatory compliance, but delivery depends on child-safety, trust and safety, search, recommender systems, moderation, age assurance, reporting and complaints, engineering, and policy teams. The same person should not be asked to certify both regimes without a cited split of duties.
Assign one owner for EU service-tier classification and one owner for UK regulated-service classification.
Name separate operational owners for notices, content moderation, complaints, transparency reporting, age assurance, advertising, recommender systems, and regulator requests.
Keep an evidence index that labels each artifact as DSA-only, UK-only, or reusable for both with cited support.
Sorena can help turn this comparison into a service inventory, owner matrix, risk-assessment tracker, and evidence index that keeps DSA and UK Online Safety Act obligations distinct.
Current Ofcom implementation calendar supporting the 7 April 2026 CSEA reporting commencement for regulated user-to-user services and the later commencement for search services.