An official source overview of DSA requirements by service tier, from intermediary-service baseline duties through hosting, platform, marketplace, VLOP and VLOSE obligations.
Use it to identify the specific DSA control set for notice and action, statements of reasons, complaints, trader checks, advertising, recommenders, transparency reports, systemic-risk work, audits, data access and enforcement readiness.
Structured answer sets in this page tree.
Cited legal and guidance references.
The Digital Services Act has applied generally since 17 February 2024 and does not impose one flat checklist on every digital service. It layers duties by service type: all have baseline obligations; hosting services add notice, action and statement-of-reasons duties; online platforms add complaint, dispute, advertising, recommender and transparency duties; marketplaces that let consumers contract with traders add trader-traceability and product-interface duties; and designated very large online platforms and very large online search engines carry systemic-risk, audit, data-access and enhanced transparency obligations four months after notification of designation.
Start with the service actually offered in the EU. The DSA covers and then adds obligations for hosting services, online platforms, online marketplaces, and designated very large online platforms or very large online search engines. A product can have more than one service surface, so classify each surface separately instead of assigning one global label.
The minimum requirements record should identify the service, EU targeting or establishment facts, service tier, whether the micro or small enterprise exclusions are relevant, average monthly active recipient reporting status for platforms or search engines, and whether the Commission has designated the service as a VLOP or VLOSE. Under Recommendation 2003/361/EC, a microenterprise has fewer than 10 staff and annual turnover or annual balance-sheet total no higher than EUR 2 million; a small enterprise has fewer than 50 staff and annual turnover or annual balance-sheet total no higher than EUR 10 million. Apply the Recommendation's partner- and linked-enterprise calculations before relying on either DSA exclusion. For the Article 19 online-platform exclusion, record the 12-month continuation after loss of micro or small status and the exception for a designated VLOP.
Hosting services need a notice-and-action mechanism that collects enough information to identify the alleged illegal content without a detailed legal investigation: explanation, exact electronic location, notifier contact details where required, and a good-faith statement. The provider must acknowledge receipt when it has contact details, decide in a timely, diligent, non-arbitrary and objective way, and tell the notifier the decision and redress options.
When a hosting provider restricts content, monetisation, service access or an account because user-provided information is allegedly illegal or incompatible with terms, it must give affected recipients a clear statement of reasons where contact details are known. Online platforms covered by Article 24(5) must also send statements of reasons to the Commission's DSA Transparency Database without personal data; record any Article 19 exclusion for a qualifying micro or small provider.
Online platforms need user-facing governance controls beyond hosting. The requirements file should connect terms, moderation, complaints, ads, recommender systems, protection of minors and misuse policies to product surfaces that users actually see.
Marketplace-style platforms have a separate Article 30-32 control set. They should not treat trader onboarding as a purely commercial KYC workflow: the DSA requires specified trader data, best-efforts reliability checks, secure retention for six months after the contractual relationship ends, selected trader information displayed to consumers, and consumer notifications when an illegal product or service is discovered.
DSA transparency reporting is not one report for every provider. All in scope publish annual content-moderation reports unless an exclusion applies; hosting services report notice data; online platforms add dispute and misuse-suspension data; and VLOPs and VLOSEs publish enhanced reports at least every six months. Article 42 adds moderation staffing, qualifications, linguistic expertise, and language-level accuracy fields for VLOPs, while both VLOPs and VLOSEs report active recipients by Member State. Risk, mitigation, audit, audit-implementation, and consultation materials follow the separate Article 42(4) publication path.
The implementing transparency templates make reporting operational. A useful DSA requirements register should therefore maintain the raw counters, report period, service name, Member State order data, notice-and-action data, complaint and dispute data, automated-moderation descriptions, AMAR numbers, staffing and language fields, methodology notes, and links to each published report.
A designated VLOP or VLOSE needs a separate enhanced-obligations workstream. The Commission designation is based on average monthly active recipients in the EU meeting the DSA threshold, and the enhanced duties apply to the designated service rather than every product operated by the same company.
The practical requirement is a traceable risk and assurance system: annual and change-triggered risk assessments, mitigation design, board and compliance-function oversight, independent audit, audit implementation, public reporting, data access for regulators and vetted researchers, recommender options not based on profiling, and a public ad repository where advertising is presented.
DSA enforcement is split between national Digital Services Coordinators and the Commission. Member States designate competent authorities and a Digital Services Coordinator for national supervision and enforcement, while the Commission has exclusive competence for the enhanced VLOP/VLOSE obligations and shares competence for other obligations imposed on those services.
A requirements overview should therefore include an enforcement evidence index. The index should make it possible to answer authority requests quickly without over-collecting personal data: source article, service tier, owner, production system, evidence store, publication URL, last report, complaint route, authority contact point, and escalation owner for Commission or Digital Services Coordinator requests.
Classify the service tier first. Baseline intermediary-service duties apply broadly, hosting services add notice-and-action and statements of reasons, online platforms add complaint, dispute, ads, recommender and reporting duties, marketplaces add trader traceability, and designated VLOPs/VLOSEs add systemic-risk, audit, data-access and enhanced reporting duties.
No. The systemic-risk, independent-audit, ad-repository, vetted-researcher data-access and non-profiling recommender-option duties are enhanced duties for services designated by the Commission as VLOPs or VLOSEs.
Keep the service-tier analysis, Article mapping, notice and moderation logs, statements of reasons, complaint and dispute records, trader checks where relevant, ad and recommender disclosures, transparency-report inputs and publications, AMAR publications, VLOP/VLOSE risk and audit files, data-access requests, authority communications and source URLs.
Sorena can help convert the DSA requirements on this page into article mappings, owner assignments, evidence requests and reusable review checks for intermediary, hosting, platform, marketplace, VLOP and VLOSE obligations.
Ask questions tied to cited sources about DSA service tiers, moderation duties, transparency reporting, VLOP/VLOSE obligations and enforcement.
Check whether your service tier, evidence set and public disclosures match the DSA obligations that apply to your service.
"supervising, enforcing and monitoring"
"investigative and sanctioning measures"
"clear and specific statements of reasons"
"Risk assessment and audit reports"
"greater control and more choices"
"four months to comply"
"transparency reporting templates"
"Competent authorities and Digital Services Coordinators"