A grounded overview of DSA requirements by service tier, from intermediary-service baseline duties through hosting, platform, marketplace, VLOP and VLOSE obligations.
Use it to identify the specific DSA control set for notice and action, statements of reasons, complaints, trader checks, advertising, recommenders, transparency reports, systemic-risk work, audits, data access and enforcement readiness.
Structured answer sets in this page tree.
Cited legal and guidance references.
The Digital Services Act does not apply one flat checklist to every digital service. It layers duties by service type: all intermediary services have baseline obligations; hosting services add notice, action and statement-of-reasons duties; online platforms add complaint, dispute, advertising, recommender and transparency duties; marketplaces that let consumers contract with traders add trader-traceability and product-interface duties; and designated very large online platforms and very large online search engines carry systemic-risk, audit, data-access and enhanced transparency obligations.
Start with the service actually offered in the EU. The DSA covers intermediary services and then adds obligations for hosting services, online platforms, online marketplaces, and designated very large online platforms or very large online search engines. A product can have more than one service surface, so classify each surface separately instead of assigning one global label.
The minimum requirements record should identify the service, EU targeting or establishment facts, service tier, whether the micro or small enterprise exclusions are relevant, average monthly active recipient reporting status for platforms or search engines, and whether the Commission has designated the service as a VLOP or VLOSE.
Hosting services need a notice-and-action mechanism that collects enough information to identify the alleged illegal content without a detailed legal investigation: explanation, exact electronic location, notifier contact details where required, and a good-faith statement. The provider must acknowledge receipt when it has contact details, decide in a timely, diligent, non-arbitrary and objective way, and tell the notifier the decision and redress options.
When a hosting provider restricts content, monetisation, service access or an account because user-provided information is allegedly illegal or incompatible with terms, it must give affected recipients a clear statement of reasons where contact details are known. Online platforms must also send statements of reasons to the Commission's DSA Transparency Database without personal data.
Online platforms need user-facing governance controls beyond hosting. The requirements file should connect terms, moderation, complaints, ads, recommender systems, protection of minors and misuse policies to product surfaces that users actually see.
Marketplace-style platforms have a separate Article 30-32 control set. They should not treat trader onboarding as a purely commercial KYC workflow: the DSA requires specified trader data, best-efforts reliability checks, secure retention for six months after the contractual relationship ends, selected trader information displayed to consumers, and consumer notifications when an illegal product or service is discovered.
DSA transparency reporting is not one report for every provider. All intermediary services in scope publish annual content-moderation reports unless an exclusion applies; hosting services report notice data; online platforms add dispute and misuse-suspension data; and VLOPs/VLOSEs publish enhanced reports at least every six months with additional staffing, linguistic expertise, accuracy, active-recipient and risk/audit information.
The implementing transparency templates make reporting operational. A useful DSA requirements register should therefore maintain the raw counters, report period, service name, Member State order data, notice-and-action data, complaint and dispute data, automated-moderation descriptions, AMAR numbers, staffing and language fields, methodology notes, and links to each published report.
A designated VLOP or VLOSE needs a separate enhanced-obligations workstream. The Commission designation is based on average monthly active recipients in the EU meeting the DSA threshold, and the enhanced duties apply to the designated service rather than every product operated by the same company.
The practical requirement is a traceable risk and assurance system: annual and change-triggered risk assessments, mitigation design, board and compliance-function oversight, independent audit, audit implementation, public reporting, data access for regulators and vetted researchers, recommender options not based on profiling, and a public ad repository where advertising is presented.
DSA enforcement is split between national Digital Services Coordinators and the Commission. Member States designate competent authorities and a Digital Services Coordinator for national supervision and enforcement, while the Commission has exclusive competence for the enhanced VLOP/VLOSE obligations and shares competence for other obligations imposed on those services.
A requirements overview should therefore include an enforcement evidence index. The index should make it possible to answer authority requests quickly without over-collecting personal data: source article, service tier, owner, production system, evidence store, publication URL, last report, complaint route, authority contact point, and escalation owner for Commission or Digital Services Coordinator requests.
Classify the service tier first. Baseline intermediary-service duties apply broadly, hosting services add notice-and-action and statements of reasons, online platforms add complaint, dispute, ads, recommender and reporting duties, marketplaces add trader traceability, and designated VLOPs/VLOSEs add systemic-risk, audit, data-access and enhanced reporting duties.
No. The systemic-risk, independent-audit, ad-repository, vetted-researcher data-access and non-profiling recommender-option duties are enhanced duties for services designated by the Commission as VLOPs or VLOSEs.
Keep the service-tier analysis, Article mapping, notice and moderation logs, statements of reasons, complaint and dispute records, trader checks where relevant, ad and recommender disclosures, transparency-report inputs and publications, AMAR publications, VLOP/VLOSE risk and audit files, data-access requests, authority communications and source URLs.
Sorena can help convert the DSA requirements on this page into article mappings, owner assignments, evidence requests and reusable review checks for intermediary, hosting, platform, marketplace, VLOP and VLOSE obligations.
Ask source-linked questions about DSA service tiers, moderation duties, transparency reporting, VLOP/VLOSE obligations and enforcement.
Check whether your service tier, evidence set and public disclosures match the DSA obligations that apply to your service.
"supervising, enforcing and monitoring"
"investigative and sanctioning measures"
"clear and specific statements of reasons"
"Risk assessment and audit reports"
"greater control and more choices"
"four months to comply"
"transparency reporting templates"
"Competent authorities and Digital Services Coordinators"