Search every question across sub-FAQs

Keep evidence showing that the public disclosure, live user interface, and recommender implementation describe the same system. For VLOPs and VLOSEs, DSA risk assessment, mitigation, audit, and data-access provisions can require explanations of algorithmic-system design, logic, functioning, and testing.

Use the product's actual criteria and records rather than an assumed scoring formula: the criteria that matter most, why they have their relative importance, the UI choices available to recipients, and the releases that changed the disclosure.

A statement of reasons is triggered by the moderation decision, not by the label a team gives the workflow. Article 17 applies to providers of hosting services when they impose one of the listed restrictions because information provided by a recipient of the service is considered illegal content or incompatible with the provider's terms and conditions.

The covered restrictions include removing, disabling access to, demoting, or otherwise restricting visibility of specific information; suspending, terminating, or otherwise restricting monetary payments; suspending or terminating all or part of the service; and suspending or terminating the recipient's account.

Article 17 applies only where the provider knows the relevant electronic contact details, and it applies at the latest from the date the restriction is imposed. It does not apply to deceptive high-volume commercial content, and it does not apply to orders covered by Article 9.

Article 17 requires enough detail for the affected recipient to understand the decision and exercise available redress rights. The statement should identify the moderation measure, the territorial scope and duration where relevant, the facts and circumstances relied on, and whether the decision followed an Article 16 notice or voluntary own-initiative investigation.

If automated means were used, the statement should say so where applicable, including whether the moderated content was detected or identified using automated means. If the ground is alleged illegality, cite the legal ground and explain why the information is illegal on that ground. If the ground is terms incompatibility, cite the contractual ground and explain why the information conflicts with it.

Redress information is part of the statement itself. For platform decisions, that means the recipient-facing notice should connect the user to the internal complaint-handling route where available, out-of-court dispute settlement where applicable, and judicial redress.

The DSA Transparency Database does not collect every hosting-service statement of reasons. The Commission FAQ explains that it collects statements of reasons from online platforms, which are a subset of hosting services that store user-provided information and disseminate it publicly, such as online marketplaces, app stores, or social networks.

For online platforms, Article 24(5) requires submission of the Article 17 decisions and statements of reasons to the Commission without undue delay for inclusion in a publicly accessible, machine-readable database. The submitted information must not contain personal data. Article 19 can exclude qualifying micro and small online-platform providers from Article 24(5), subject to its post-loss transition and VLOP rule; it does not remove the underlying Article 17 recipient-notice duty for hosting services.

The Commission FAQ says redress options are not included in the public database because they are relevant only for the addressee of the statement of reasons. Operationally, keep the recipient-facing statement with redress information separately from the public database payload, and keep a personal-data removal check before submission.

For online platforms, Article 20 requires an effective internal complaint-handling system for at least six months after the recipient is informed about covered moderation decisions. Complaints must be handled in a timely, non-discriminatory, diligent, and non-arbitrary manner, and complaint decisions must be supervised by appropriately qualified staff rather than made solely by automated means.

Users can also turn to certified out-of-court dispute settlement bodies for covered platform moderation disputes, without losing the ability to go to court. The Commission's dispute-settlement page states that users may select any certified body whose expertise covers the dispute and whose language coverage fits the case.

Keep records that let reviewers connect the original moderation decision, the recipient-facing statement, the Transparency Database submission where required, and any complaint or dispute outcome. The Commission database FAQ also gives retention context for public database access: statements become available from the following day after successful insertion, search retains them for six months, daily dumps retain them for 18 months, and dashboard aggregate statistics cover the last five years.

Article 34 requires designated VLOPs and VLOSEs to assess systemic risks that are specific to their services and proportionate to the severity and probability of those risks. The risk categories include dissemination of illegal content, negative effects on fundamental rights, negative effects on civic discourse, electoral processes and public security, and negative effects involving gender-based violence, public health, minors, and physical or mental well-being.

The first assessment is due by the date the enhanced obligations begin to apply to the designated service, which Article 33 sets at four months after notification of the designation decision. The provider must reassess at least once every year thereafter and before deploying functionality likely to have a critical impact on the identified risks.

The assessment also has to examine how the design and operation of the service influence those risks. For a practical record, map each risk to the affected surface, such as search ranking, recommender systems, ads delivery, content moderation, notice handling, marketplace listings, user reporting, account creation, age assurance, or high-reach sharing features.

The assessment should not stop at a risk register. Article 35 requires reasonable, proportionate, and effective mitigation measures tailored to the specific Article 34 risks, with particular consideration for fundamental-rights impacts.

Useful mitigation records show why a control was selected or rejected. Examples supported by the DSA include adapting service design or functioning, recommender systems, terms enforcement, content moderation processes, notice-processing resources, advertising systems, crisis response, and child-protection tools such as age verification, parental controls, abuse-signalling tools, or support tools where appropriate.

Keep evidence that lets the provider, auditor, Commission, and Digital Services Coordinator understand how the assessment was performed and why the mitigation response fits the risk. Article 34 requires supporting documents to be preserved for at least three years and communicated to the Commission and the Digital Services Coordinator of establishment on request.

A practical evidence pack should include the risk-assessment report, risk register, source data, internal controls, product and policy change logs, governance approvals, consultations used to design mitigations, and links to audit workpapers or audit implementation actions where available.

The risk assessment feeds a public accountability cycle. VLOPs and VLOSEs are subject to independent audits at least once a year. After receiving an audit report, they must make public the risk-assessment report, mitigation measures, audit report, audit implementation report, and information about consultations no later than three months after receipt, subject to the DSA rules on confidential information. Taken together, the annual audit requirement and the three-month publication deadline place the first publication no later than 15 months after the enhanced obligations begin to apply to the service.

Supervision is not limited to public reports. The DSA also links the assessment to the compliance function, management-body oversight, Commission and Digital Services Coordinator access to supporting documents, data access for vetted researchers, and independent audit testing of internal controls and mitigation effectiveness.