WorkflowEU DSA

DSA notice and action workflow

Build a notice queue that captures the Article 16 inputs, routes trusted flagger notices with priority, records the decision, and hands off restrictions to user communications and statement-of-reasons reporting.

This page gives hosting services and online platforms a practical, source-cited operating model for illegal-content notices under the EU Digital Services Act.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

Jul 25, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated Jul 25, 2026

Overview

The DSA notice-and-action workflow starts when a hosting service receives an electronic notice about a specific item of allegedly . The workflow checks whether the notice is precise enough to assess, separates trusted flagger notices, records the moderation decision, informs the notifier and affected user where required, creates any statement of reasons, and preserves the data needed for complaints, dispute settlement, transparency reporting, and regulator questions.

Section 1

1. Intake the notice as a specific content report

Article 16 applies to providers of hosting services, including online platforms. The intake channel should allow any individual or entity to submit notices electronically about specific items of information that they consider .

Do not treat a general abuse complaint, broad account grievance, or policy suggestion as a complete DSA notice unless it identifies the relevant content and gives enough information to assess the alleged illegality. Keep the original notice payload, timestamps, language, channel, and any automated routing flags.

Required notice fields: substantiated explanation of why the content is alleged to be illegal, exact URL or other exact electronic location, any additional locator needed for that content type, notifier name and email unless the DSA exception for certain child sexual abuse offences applies, and a bona fide accuracy-and-completeness statement.
Completeness triage: mark the notice complete, incomplete but follow-up possible, duplicate, wrong service, or urgent escalation. A complete notice is one that lets a diligent hosting provider identify and assess the specific item without a detailed legal examination.
Receipt acknowledgement: when the notice contains electronic contact information, send a confirmation of receipt without undue delay and store the acknowledgement event.
Knowledge marker: if the notice is sufficiently precise and adequately substantiated, record that it may give rise to actual knowledge or awareness for the specific item of information concerned.
Safety escalation: if the provider becomes aware of information giving rise to a suspicion that a criminal offence involving a threat to life or safety has taken place, is taking place, or is likely to take place, promptly inform the relevant law-enforcement or judicial authorities and provide all relevant information available.

Sources for this answer

Regulation (EU) 2022/2065 (Digital Services Act)

Article 16 sets the electronic notice mechanism and required notice elements for hosting services; Article 18 requires prompt notification of specified criminal-offence suspicions.

European Commission - The Digital Services Act

Commission overview describes easy flagging of illegal content and the platform response and appeal context.

Section 2

2. Prioritise trusted flaggers without outsourcing the decision

Online platforms need a separate trusted flagger lane. Trusted flaggers are designated by national Digital Services Coordinators and their notices, when submitted within the designated area of expertise through the Article 16 mechanism, must receive priority and be processed and decided on without undue delay.

Priority does not mean automatic removal. The Commission's trusted flagger page states that providers remain responsible for deciding on notices and removing content where justified. The workflow should therefore identify the trusted flagger, verify scope, speed the review, and still capture the platform's own legal or terms-based decision.

Trusted flagger validation: record the entity name, designation source, Digital Services Coordinator, area of expertise, notice channel, and whether the notice falls inside the trusted flagger's designated scope.
Priority routing: surface the case ahead of ordinary notices, assign a reviewer with the right language and subject-matter competence, and preserve the queue-time and decision-time metrics.
Decision control: require the same outcome fields as other notices: no action, content restriction, account/service restriction, monetisation restriction, escalation, or request for more information.
Misuse signal: if the platform has information indicating a significant number of insufficiently precise, inaccurate, or inadequately substantiated trusted flagger notices, prepare the supporting explanation and documents for the Digital Services Coordinator that awarded the status.
Reporting split: distinguish total notice-and-action mechanism notices from trusted flagger notices for transparency-report and automation metrics.

Sources for this answer

Regulation (EU) 2022/2065 (Digital Services Act)

Article 22 requires priority handling for trusted flagger notices and covers escalation of misuse information to the relevant Digital Services Coordinator.

European Commission - Trusted flaggers under the Digital Services Act

Commission page explains trusted flagger designation, priority treatment, scope, and the provider's continuing responsibility to decide notices.

Implementing Regulation (EU) 2024/2835 on DSA transparency reporting templates

Annex reporting instructions distinguish notice-and-action mechanism totals and trusted flagger notice counts.

Section 3

3. Decide, act, and communicate the outcome

For every complete notice, the reviewer should decide in a timely, diligent, non-arbitrary, and objective manner. The record should show whether the decision relied on law, terms and conditions, both, or no action, and whether automated means were used in processing or decision-making.

The notifier communication and affected-user communication are different handoffs. Article 16 requires the hosting provider to notify the person or entity that submitted the notice of the decision and available redress. Article 17 separately requires a clear and specific statement of reasons to affected recipients when covered restrictions are imposed and the relevant electronic contact details are known.

Decision fields: content identifier, alleged illegal-content category, legal ground if used, terms ground if used, action taken, territorial scope, duration, reviewer, automation used, and decision timestamp.
Notifier message: tell the notifier the decision on the reported information without undue delay and include redress information for that decision.
Affected user message: when content visibility, payments, service access, or account access is restricted on illegality or terms grounds, issue a statement of reasons at the latest when the restriction is imposed if the relevant electronic contact details are known.
Article 17 exclusions: do not treat an Article 9 authority order as an Article 17 statement-of-reasons event, and record separately when the restricted information is deceptive high-volume commercial content, for which Article 17(2) removes the statement duty. Other notice and order communications may still apply.
Statement-of-reasons content: include the measure, territorial scope and duration where relevant, facts and circumstances, whether the decision followed an Article 16 notice or own-initiative review, automated-means information where applicable, the legal or contractual ground, and redress options.
Automation disclosure: when automated means were used for notice processing or decision-making, include that information in the decision notification and retain the automation flag for reporting.

Sources for this answer

Regulation (EU) 2022/2065 (Digital Services Act)

Articles 16 and 17 define decision notification, automated-means disclosure, covered restrictions, and statement-of-reasons contents.

European Commission - DSA Transparency Database Q&A

Commission FAQ explains that statements of reasons help users understand and potentially challenge content moderation decisions.

Section 4

4. Hand off complaints, dispute routes, transparency reporting, and records

The notice workflow should not close merely because a moderation action was taken. Online platforms need downstream complaint handling for decisions on notices and covered moderation restrictions, and statement-of-reasons data may need submission to the Commission's DSA Transparency Database.

A durable record ties the original notice to the decision, communications, complaint status, out-of-court dispute status, and reporting metrics. That is the record a platform needs when a user appeals, a certified dispute settlement body asks for context, a transparency report is prepared, or a regulator examines trusted flagger handling.

Internal complaint route: for online platforms, provide electronic, free internal complaint access for at least six months after the relevant decision, including decisions not to act on a notice and covered restrictions affecting content, service, account, or monetisation.
Complaint review: handle complaints in a timely, non-discriminatory, diligent, and non-arbitrary manner, and reverse the decision without undue delay where the complaint shows the original decision was unfounded or the measure was not warranted.
Out-of-court dispute route: make clear and user-friendly information available about certified out-of-court dispute settlement, while preserving the option of judicial redress.
Transparency Database handoff: online platforms covered by Article 24(5) submit Article 17 decisions and statements of reasons to the Commission database without undue delay and remove personal data from the submitted information. For any Article 19 exclusion, record the Recommendation 2003/361/EC staff and financial test, partner or linked enterprises, the 12-month post-loss rule, and whether VLOP designation prevents reliance on the exclusion.
Records to retain: original notice, completeness assessment, trusted flagger status and scope check, receipt acknowledgement, decision rationale, action taken, notifier decision notice, affected-user statement of reasons, appeal and dispute events, automation flags, reversal outcomes, and median-time inputs for reporting.

Sources for this answer

Regulation (EU) 2022/2065 (Digital Services Act)

Articles 20, 21, 23, and 24 connect notice decisions to internal complaints, out-of-court dispute settlement, misuse suspensions, and transparency database submissions.

European Commission - Out-of-court dispute settlement bodies under the DSA

Commission page explains that users can contest platform moderation decisions, including rejected illegal-content notices, through internal complaints, certified ODS bodies, or national courts.

European Commission - DSA Transparency Database Q&A

Commission FAQ explains Article 24(5) statement-of-reasons submission, personal-data removal, and database availability for online platforms.

Implementing Regulation (EU) 2024/2835 on DSA transparency reporting templates

Annex reporting instructions identify notice, trusted flagger, action, automation, complaint, dispute, reversal, implementation, and median-time fields.

Commission Recommendation 2003/361/EC on micro, small and medium-sized enterprises

Defines the staff, financial, partner-enterprise, and linked-enterprise tests relevant to an Article 19 exclusion from the platform-section database duty.

Recommended next step

Map notice intake, moderation decisions, statements of reasons, and complaint routes

Sorena can help convert this notice-and-action workflow into queue fields, reviewer prompts, cited decision notes, and reporting handoffs for DSA implementation work.

Research workflow

Open Research Copilot for DSA notice handling

Ask questions tied to cited sources about Article 16 notices, trusted flaggers, statements of reasons, appeals, and reporting records.

Explore next step

Talk to Sorena

Discuss DSA notice-and-action operations

Review your intake fields, escalation paths, statement-of-reasons handoff, and complaint records with Sorena.

Explore next step

Primary sources

References and citations

Commission Recommendation 2003/361/EC on micro, small and medium-sized enterprises

eur-lex.europa.eu

Referenced sections

Defines the staff, financial, partner-enterprise, and linked-enterprise tests relevant to an Article 19 exclusion from the platform-section database duty.

European Commission - DSA Transparency Database Q&A

digital-strategy.ec.europa.eu

Referenced sections

Commission FAQ explains Article 24(5) statement-of-reasons submission, personal-data removal, and database availability for online platforms.

"publicly accessible and machine-readable"

European Commission - Out-of-court dispute settlement bodies under the DSA

digital-strategy.ec.europa.eu

Referenced sections

Commission page explains that users can contest platform moderation decisions, including rejected illegal-content notices, through internal complaints, certified ODS bodies, or national courts.

"notices of illegal content that were rejected"

European Commission - The Digital Services Act

digital-strategy.ec.europa.eu

Referenced sections

Commission overview describes easy flagging of illegal content and the platform response and appeal context.

"Easy flagging of illegal content"

European Commission - Trusted flaggers under the Digital Services Act

digital-strategy.ec.europa.eu

Referenced sections

Commission page explains trusted flagger designation, priority treatment, scope, and the provider's continuing responsibility to decide notices.

"Providers have the sole responsibility to decide upon notices"

Implementing Regulation (EU) 2024/2835 on DSA transparency reporting templates

eur-lex.europa.eu

Referenced sections

Annex reporting instructions identify notice, trusted flagger, action, automation, complaint, dispute, reversal, implementation, and median-time fields.

"median time"

Regulation (EU) 2022/2065 (Digital Services Act)

eur-lex.europa.eu

Referenced sections

Articles 20, 21, 23, and 24 connect notice decisions to internal complaints, out-of-court dispute settlement, misuse suspensions, and transparency database submissions.