EU DSA vs UK Online Safety Act platform duties compared
This comparison helps separate EU intermediary and platform duties from UK online safety duties for user-to-user and search services.
The practical split is scope first, then regulator, risk assessment, illegal and harmful content duties, child protection, transparency, enforcement, and the team that owns implementation.
The EU Digital Services Act and UK Online Safety Act can both govern one service, but they use different territorial, service, and risk tests. The DSA classifies intermediary services offered in the EU and adds duties by role and size. The UK Act covers each or search service with links to the UK, including overseas services that meet the Act's UK nexus. Its illegal-content safety duties have applied since 17 March 2025, and its child-safety duties since 25 July 2025. Classify each product surface under both regimes before reusing a control or risk assessment.
Side-by-side comparison
EU Digital Services Act vs UK Online Safety Act
Use these rows to decide which regime applies, what each one requires, and where evidence can be reused without merging different legal duties.
EU regime for intermediary services offered to recipients in the Union, with layered duties for hosting services, online platforms, marketplaces, VLOPs, and VLOSEs.
Second framework
UK Online Safety Act
UK regime for regulated user-to-user services, search services, and related online services, supervised by Ofcom with duties focused on illegal content, children, transparency, and service accountability.
Covers intermediary services with a substantial connection to the EU, including mere conduit, caching, hosting, online platforms, online marketplaces, and online search engines. Duties increase by service tier and by VLOP/VLOSE designation.
Article 3 supplies the DSA service definitions used for this scope row.
online platform
Covers regulated user-to-user services and search services, with additional structures for services likely to be accessed by children, categorised services, and services involving regulated provider pornographic content.
The Act's Part 3 and schedules identify the UK regulated-service categories used for this scope row.
search services
Classify the EU intermediary role and the UK regulated-service type separately before deciding whether the same product surface is in scope under both regimes.
National Digital Services Coordinators supervise many DSA providers, while the European Commission directly supervises and enforces the VLOP and VLOSE obligations.
Commission guidance describes the DSA enforcement split and Commission competence for VLOPs and VLOSEs.
Commission
Ofcom is the independent UK online-safety regulator and sets codes, guidance, transparency expectations, information requests, enforcement notices, and penalties.
VLOPs and VLOSEs must assess systemic risks in the EU from service design, functioning, algorithmic systems, and use of the service, including illegal content, fundamental rights, civic discourse, public security, public health, minors, gender-based violence, and wellbeing.
Article 34 supports the DSA systemic-risk categories for VLOPs and VLOSEs.
systemic risks
Regulated services must work through illegal-content risk, children's access, children's risk, and Ofcom code or guidance expectations where relevant to the service.
The Act's table of contents identifies illegal-content risk assessments, children's access assessments, and children's risk assessments as UK duty areas.
risk assessments
Do not collapse DSA systemic-risk work into the UK illegal-content or child-safety assessment; keep the assessment scope, source, reviewer, and mitigation evidence labelled.
Articles 16, 17, 20, 21, and 22 support DSA notice, statement-of-reasons, complaint, dispute, and trusted-flagger duties.
statements of reasons
The UK Act is organised around illegal content duties, child-safety duties, content harmful to children, provider pornographic content, reporting and complaints, and Ofcom codes of practice.
The memorandum supports UK owners for governance, platform design, age assurance, moderation, reporting, complaints, and child-facing support.
governance and accountability
Use a shared owner matrix only if each row has a DSA or UK label, a cited source, an accountable delivery team, and the evidence artifact that proves the control is operating.
The DSA text supports evidence mapping across service classification, notices, complaints, transparency, risk assessment, mitigation, audit, and compliance governance.
Online platforms accessible to minors must use appropriate and proportionate privacy, safety, and security measures, and must not present profiling-based ads to minors when aware with reasonable certainty that the recipient is a minor.
Article 28 supports the DSA minor-protection and minor-advertising comparison point.
minors
In-scope services likely to be accessed by children must address child-safety duties, including measures to prevent children accessing the most harmful content and protect them from harmful or age-inappropriate content.
The memorandum explains the child-safety duties and Ofcom codes for user-to-user and search services.
protect children
Keep DSA minor-protection measures and UK child-safety evidence labelled by duty. Reuse a control only when its records answer the requirements on both sides.
The Commission can investigate VLOPs and VLOSEs, request information and data or algorithm access, impose interim measures, and impose fines for DSA breaches up to 6% of global annual turnover, with separate procedural penalties available.
Commission guidance supports the DSA investigation powers and 6% global annual turnover fine cap.
6%
Ofcom can investigate non-compliance, issue enforcement action, and impose fines up to GBP 18 million or 10% of qualifying worldwide revenue, whichever is greater, according to GOV.UK's Online Safety Act overview.
GOV.UK states the Online Safety Act fine cap as GBP 18 million or 10% of qualifying worldwide revenue, whichever is greater.
10 percent
Escalation records should name the correct authority, response deadline, source request, and penalty framework instead of using a generic platform-regulator risk label.
DSA evidence includes terms-and-conditions explanations, content-moderation transparency reports, statement-of-reasons submissions, advertising disclosures, recommender-system parameters, VLOP/VLOSE ad repositories, and risk or audit reporting where applicable.
Articles 14, 15, 17, 24, 26, 27, 39, and 42 support DSA transparency, advertising, recommender, and reporting evidence.
transparency reporting
UK evidence includes risk-assessment records, terms enforcement, user reporting and complaints processes, transparency reporting for relevant services, Ofcom information responses, and records showing code or alternative-measure compliance.
If the product surface is an EU intermediary service, map the DSA tier and obligations first; if it is a VLOP or VLOSE, add the systemic-risk, audit, data-access, and recommender obligations on top.
Article 3 supplies the DSA service definitions used for this scope row.
online platform
If the product surface is a UK or search service, map the Ofcom duty set first; if children are likely to access it, add the child-safety and age-assurance pack.
The Act's Part 3 and schedules identify the UK regulated-service categories used for this scope row.
search services
Do not treat the scope rows as the decision itself. Use them to choose the legal track, then attach the control pack that matches that track and its regulator.
The memorandum explains the practical distinction between user-to-user services and search services for UK child-safety codes.
search service
Scope boundary
EU Digital Services Act
Covers intermediary services with a substantial connection to the EU, including mere conduit, caching, hosting, online platforms, online marketplaces, and online search engines. Duties increase by service tier and by VLOP/VLOSE designation.
Article 3 supplies the DSA service definitions used for this scope row.
online platform
UK Online Safety Act
Covers regulated user-to-user services and search services, with additional structures for services likely to be accessed by children, categorised services, and services involving regulated provider pornographic content.
The Act's Part 3 and schedules identify the UK regulated-service categories used for this scope row.
search services
Operational implication
Classify the EU intermediary role and the UK regulated-service type separately before deciding whether the same product surface is in scope under both regimes.
The memorandum explains the practical distinction between user-to-user services and search services for UK child-safety codes.
search service
Regulators
EU Digital Services Act
National Digital Services Coordinators supervise many DSA providers, while the European Commission directly supervises and enforces the VLOP and VLOSE obligations.
Commission guidance describes the DSA enforcement split and Commission competence for VLOPs and VLOSEs.
Commission
UK Online Safety Act
Ofcom is the independent UK online-safety regulator and sets codes, guidance, transparency expectations, information requests, enforcement notices, and penalties.
The DSA legal text supports the Digital Services Coordinator and Commission supervision structure.
Digital Services Coordinator
Risk assessments
EU Digital Services Act
VLOPs and VLOSEs must assess systemic risks in the EU from service design, functioning, algorithmic systems, and use of the service, including illegal content, fundamental rights, civic discourse, public security, public health, minors, gender-based violence, and wellbeing.
Article 34 supports the DSA systemic-risk categories for VLOPs and VLOSEs.
systemic risks
UK Online Safety Act
Regulated services must work through illegal-content risk, children's access, children's risk, and Ofcom code or guidance expectations where relevant to the service.
The Act's table of contents identifies illegal-content risk assessments, children's access assessments, and children's risk assessments as UK duty areas.
risk assessments
Operational implication
Do not collapse DSA systemic-risk work into the UK illegal-content or child-safety assessment; keep the assessment scope, source, reviewer, and mitigation evidence labelled.
Articles 16, 17, 20, 21, and 22 support DSA notice, statement-of-reasons, complaint, dispute, and trusted-flagger duties.
statements of reasons
UK Online Safety Act
The UK Act is organised around illegal content duties, child-safety duties, content harmful to children, provider pornographic content, reporting and complaints, and Ofcom codes of practice.
The memorandum supports UK owners for governance, platform design, age assurance, moderation, reporting, complaints, and child-facing support.
governance and accountability
Operational implication
Use a shared owner matrix only if each row has a DSA or UK label, a cited source, an accountable delivery team, and the evidence artifact that proves the control is operating.
The DSA text supports evidence mapping across service classification, notices, complaints, transparency, risk assessment, mitigation, audit, and compliance governance.
compliance function
Child protection and evidence split
EU Digital Services Act
Online platforms accessible to minors must use appropriate and proportionate privacy, safety, and security measures, and must not present profiling-based ads to minors when aware with reasonable certainty that the recipient is a minor.
Article 28 supports the DSA minor-protection and minor-advertising comparison point.
minors
UK Online Safety Act
In-scope services likely to be accessed by children must address child-safety duties, including measures to prevent children accessing the most harmful content and protect them from harmful or age-inappropriate content.
The memorandum explains the child-safety duties and Ofcom codes for user-to-user and search services.
protect children
Operational implication
Keep DSA minor-protection measures and UK child-safety evidence labelled by duty. Reuse a control only when its records answer the requirements on both sides.
The collection provides public UK implementation context for child-safety guidance and Ofcom materials.
children
Enforcement
EU Digital Services Act
The Commission can investigate VLOPs and VLOSEs, request information and data or algorithm access, impose interim measures, and impose fines for DSA breaches up to 6% of global annual turnover, with separate procedural penalties available.
Commission guidance supports the DSA investigation powers and 6% global annual turnover fine cap.
6%
UK Online Safety Act
Ofcom can investigate non-compliance, issue enforcement action, and impose fines up to GBP 18 million or 10% of qualifying worldwide revenue, whichever is greater, according to GOV.UK's Online Safety Act overview.
GOV.UK states the Online Safety Act fine cap as GBP 18 million or 10% of qualifying worldwide revenue, whichever is greater.
10 percent
Operational implication
Escalation records should name the correct authority, response deadline, source request, and penalty framework instead of using a generic platform-regulator risk label.
The collection links public Ofcom enforcement and fees materials for UK implementation planning.
enforcement powers
Transparency evidence
EU Digital Services Act
DSA evidence includes terms-and-conditions explanations, content-moderation transparency reports, statement-of-reasons submissions, advertising disclosures, recommender-system parameters, VLOP/VLOSE ad repositories, and risk or audit reporting where applicable.
Articles 14, 15, 17, 24, 26, 27, 39, and 42 support DSA transparency, advertising, recommender, and reporting evidence.
transparency reporting
UK Online Safety Act
UK evidence includes risk-assessment records, terms enforcement, user reporting and complaints processes, transparency reporting for relevant services, Ofcom information responses, and records showing code or alternative-measure compliance.
Commission VLOP/VLOSE guidance supports enhanced transparency evidence for advertising, recommender systems, audit, and data access.
recommender systems
Practical decision rule
EU Digital Services Act
If the product surface is an EU intermediary service, map the DSA tier and obligations first; if it is a VLOP or VLOSE, add the systemic-risk, audit, data-access, and recommender obligations on top.
Article 3 supplies the DSA service definitions used for this scope row.
online platform
UK Online Safety Act
If the product surface is a UK or search service, map the Ofcom duty set first; if children are likely to access it, add the child-safety and age-assurance pack.
The Act's Part 3 and schedules identify the UK regulated-service categories used for this scope row.
search services
Operational implication
Do not treat the scope rows as the decision itself. Use them to choose the legal track, then attach the control pack that matches that track and its regulator.
The memorandum explains the practical distinction between user-to-user services and search services for UK child-safety codes.
search service
Practical decision rule
How should teams decide whether one control can cover both regimes?
First classify the service separately under the DSA and the UK Online Safety Act.
Then map the duty: DSA intermediary or platform duty, VLOP/VLOSE systemic-risk duty, UK illegal-content duty, UK child-safety duty, transparency duty, or regulator-response duty.
Reuse evidence only when the artifact answers both cited duties without hiding different regulators, content categories, user notices, or assessment triggers.
Escalate when a product change adds user-to-user functionality, search functionality, marketplace trading, recommender ranking, targeted advertising, child access, or VLOP/VLOSE-scale exposure.
Primary source for the UK side of the decision rule: regulated-service categories, risk assessment areas, transparency duties, and Ofcom powers.
regulated services
1
Section 1
Start with the service classification, not a shared online-safety label
A service can fall under the DSA because it is a mere conduit, caching, hosting, online platform, marketplace, online search engine, very large online platform (VLOP), or very large online search engine (VLOSE) offered to recipients in the EU. That analysis is not the same as the UK test for regulated user-to-user services, search services, or services involving regulated provider pornographic content. A service has links with the UK if it has a significant number of UK users, targets the UK market, or is capable of being used by individuals in the UK and there are reasonable grounds to believe that user-generated or search content on the service presents a material risk of significant harm to individuals there.
Check exclusions under each law before mapping duties. Under the DSA, the service role determines which obligation layer applies, and a provider can operate several differently classified surfaces. Under the UK Act, Schedule 1 excludes specified services or functions, including email, SMS and MMS, certain limited-functionality services, internal business services, and some public-body, education, childcare, and healthcare services. Apply the statutory conditions rather than treating the presence of comments, reviews, messaging, or search as conclusive by itself.
For comparison work, keep two service inventories: one that classifies the EU intermediary role and one that classifies the UK service type. Reuse product facts such as user-generated content, search functionality, age access, recommender systems, advertising, and moderation flows, but do not copy the legal conclusion from one regime into the other.
DSA scoping asks whether the service is an intermediary service and which DSA tier applies.
UK Online Safety Act scoping asks whether the service is a , search service, or related regulated service category.
Marketplace, app-store, social, search, forum, hosting, and messaging features may need separate classification if they are operated as distinct service surfaces.
The Act's table of contents and Part 3 structure identify regulated user-to-user and search-service duties, which are the UK scoping side of this comparison.
user-to-user services and search services
2
Section 2
Risk work is different on each side
Under the DSA, all covered services need tier-appropriate governance, but the formal systemic-risk assessment regime is concentrated on VLOPs and VLOSEs. Those providers assess risks such as illegal content, fundamental-rights impacts, civic discourse, public security, public health, protection of minors, gender-based violence, and physical or mental wellbeing, then apply mitigation measures.
Under the UK Online Safety Act, risk work is tied to illegal content, child access, children's risk, provider pornography, service categorisation, and Ofcom codes and guidance. Providers had to complete illegal-content risk assessments by 16 March 2025 before the safety duties took effect on 17 March 2025. Services likely to be accessed by children had to record children's risk assessments by 24 July 2025 and comply with the child-safety duties from 25 July 2025. New or materially changed services still need event-driven assessment and review under the Act and Ofcom guidance. Since 7 April 2026, the Act has also required regulated user-to-user providers to report detected and previously unreported child sexual exploitation and abuse content to the National Crime Agency. For providers outside the UK, the duty is limited to UK-linked content; Ofcom states that commencement for search services will follow later.
Keep DSA VLOP/VLOSE systemic-risk evidence separate from UK illegal-content and children's-risk assessments.
For recommender, moderation, age-assurance, and advertising changes, record which regime created the control requirement.
Do not present a single global online-safety risk assessment as satisfying both regimes unless each required source, owner, and output is mapped.
Commission guidance explains the VLOP/VLOSE threshold and enhanced DSA duties, including systemic risk assessment, mitigation, audits, data access, and recommender obligations.
Current government implementation source confirming that illegal-content duties have applied since 17 March 2025 and child-safety duties since 25 July 2025.
Current Ofcom implementation calendar supporting the 7 April 2026 CSEA reporting commencement for regulated user-to-user services and the later commencement for search services.
7 April 2026
3
Section 3
Child protection overlaps, but the compliance evidence is not identical
The DSA requires online platforms accessible to minors to put in place appropriate and proportionate measures for privacy, safety, and security, and restricts profiling-based advertising to minors where the platform is aware with reasonable certainty that the recipient is a minor. For VLOPs and VLOSEs, minors also appear inside the systemic-risk and mitigation framework.
The UK Online Safety Act is more explicitly organised around child access and child-safety duties for regulated user-to-user and search services. Ofcom's child-safety codes and related guidance focus on governance, safer platform design, age understanding or age assurance, recommender and moderation measures, reporting, complaints, and tools for children and carers.
DSA evidence should show platform accessibility to minors, safety measures, advertising controls, recommender settings, and any VLOP/VLOSE risk treatment.
UK evidence should show children's access assessment, children's risk assessment, age-assurance approach, content reporting, complaints, and code-of-practice implementation choices.
A shared child-safety product control can serve both regimes only if the DSA article or Commission guidance and the UK Act, Ofcom code, or GOV.UK source are both cited.
The UK source identifies child-safety duties, Ofcom codes of practice, and measures for harmful and age-inappropriate content.
child safety duties
4
Section 4
Implementation ownership should follow the duty, regulator, and product control
For the DSA, legal and compliance teams should classify the service, while trust and safety, marketplace operations, advertising, recommender-system, content-moderation, and data-access owners maintain the operational evidence. VLOP and VLOSE work also needs compliance-function, audit, research-access, and regulatory-response ownership.
For the UK Online Safety Act, Ofcom-facing accountability should sit with legal or regulatory compliance, but delivery depends on child-safety, trust and safety, search, recommender systems, moderation, age assurance, reporting and complaints, engineering, and policy teams. Name accountable owners for each regime and record which duties each owner reviews.
Assign one owner for EU service-tier classification and one owner for UK regulated-service classification.
Name separate operational owners for notices, content moderation, complaints, transparency reporting, age assurance, advertising, recommender systems, and regulator requests.
Keep an evidence index that labels each artifact as DSA-only, UK-only, or reusable for both with cited support.
Commission enforcement guidance supports DSA ownership for VLOP/VLOSE investigations, requests for information, data and algorithm access, interim measures, and sanctions.
The GOV.UK collection explains Ofcom's role as independent online-safety regulator and links the Act, codes, guidance, and enforcement materials.
independent regulator
Recommended next step
Build one evidence index with two legal labels
Sorena can help turn this comparison into a service inventory, owner matrix, risk-assessment tracker, and evidence index that keeps DSA and UK Online Safety Act obligations distinct.
Primary EU legal text for DSA definitions, intermediary-service tiers, platform duties, VLOP/VLOSE obligations, supervision, and penalties.
Article 3 defines intermediary services, hosting services, online platforms, search engines, advertisements, recommender systems, and content moderation for the DSA scoping side.
Article 28 supports the DSA child-protection side by requiring appropriate and proportionate measures for platforms accessible to minors.
Show 8 more
Article 3 supplies the DSA service definitions used for this scope row.
The DSA legal text supports the Digital Services Coordinator and Commission supervision structure.
Article 34 supports the DSA systemic-risk categories for VLOPs and VLOSEs.
Articles 16, 17, 20, 21, and 22 support DSA notice, statement-of-reasons, complaint, dispute, and trusted-flagger duties.
The DSA text supports evidence mapping across service classification, notices, complaints, transparency, risk assessment, mitigation, audit, and compliance governance.
Article 28 supports the DSA minor-protection and minor-advertising comparison point.
Articles 14, 15, 17, 24, 26, 27, 39, and 42 support DSA transparency, advertising, recommender, and reporting evidence.
Primary source for the EU side of the decision rule: service tier, DSA duties, VLOP/VLOSE obligations, and supervisory route.
Government collection source for Ofcom's role, codes and guidance, implementation materials, and UK enforcement overview.
Current government implementation source confirming that illegal-content duties have applied since 17 March 2025 and child-safety duties since 25 July 2025.
The GOV.UK collection explains Ofcom's role as independent online-safety regulator and links the Act, codes, guidance, and enforcement materials.
Show 4 more
The GOV.UK collection identifies Ofcom as the independent regulator for online safety.
The collection links Ofcom guidance, illegal-harms materials, child-safety materials, and enforcement materials for operational categorisation.
The collection provides public UK implementation context for child-safety guidance and Ofcom materials.
The collection links public Ofcom enforcement and fees materials for UK implementation planning.
Primary UK legal text for regulated user-to-user services, search services, risk assessment duties, transparency, Ofcom powers, fees, and penalties.
The Act's table of contents and Part 3 structure identify regulated user-to-user and search-service duties, which are the UK scoping side of this comparison.
The Act's Part 3 and schedules identify the UK regulated-service categories used for this scope row.
Show 3 more
The Act's table of contents identifies illegal-content risk assessments, children's access assessments, and children's risk assessments as UK duty areas.
The Act includes transparency-report guidance and Ofcom transparency reports in the regulated-service framework.
Primary source for the UK side of the decision rule: regulated-service categories, risk assessment areas, transparency duties, and Ofcom powers.
Commission source for the VLOP/VLOSE threshold and enhanced obligations such as systemic risk assessment, mitigation, audit, data access, and recommender options.
Commission guidance explains the VLOP/VLOSE threshold and enhanced DSA duties, including systemic risk assessment, mitigation, audits, data access, and recommender obligations.
Commission VLOP/VLOSE guidance supports ownership for audits, data access, risk mitigation, advertising, recommender systems, and transparency.
Show 1 more
Commission VLOP/VLOSE guidance supports enhanced transparency evidence for advertising, recommender systems, audit, and data access.
Commission enforcement guidance supports DSA ownership for VLOP/VLOSE investigations, requests for information, data and algorithm access, interim measures, and sanctions.
Commission guidance describes the DSA enforcement split and Commission competence for VLOPs and VLOSEs.
Commission guidance supports the DSA investigation powers and 6% global annual turnover fine cap.
Current Ofcom implementation calendar supporting the 7 April 2026 CSEA reporting commencement for regulated user-to-user services and the later commencement for search services.