- ClassificationCategoryDigital Services & PlatformsDomainRisk ManagementFramework FamilyOther
- Regulatory ContextTypeRegulationLegal InstrumentRegulationSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionEuropeRegion DetailEuropean UnionPublisherEuropean Parliament and Council of the European Union
- VersioningVersionRegulation (EU) 2022/2065Effective DateNovember 16, 2022 (entry into force); applies to all providers from February 17, 2024Issue DateOctober 19, 2022 (signed); published October 27, 2022
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
The Regulation is EU law published in the Official Journal and is included with the platform for reference.
Framework text is licensed by its publisher and is included only where stated above.
- The Digital Services Act (Regulation (EU) 2022/2065) sets rules for providers of intermediary services that reach people in the EU.
- It entered into force November 16, 2022 and has applied to all providers since February 17, 2024.
- Duties are layered: contact points and transparency reports for all, notice and action for hosting, and complaint handling and advertising rules for platforms.
- Very large platforms and search engines with 45 million or more monthly EU users add systemic risk assessment, mitigation, audit, and data access.
- Each Member State names a Digital Services Coordinator, and the European Commission supervises very large providers directly.
Overview
The Digital Services Act (Regulation (EU) 2022/2065) sets rules for providers of intermediary services that reach people in the European Union: conditional exemptions from liability, notice-and-action procedures for illegal content, and extra duties for online platforms and for very large platforms and search engines with 45 million or more average monthly active recipients. It entered into force on November 16, 2022 and has applied to all providers since February 17, 2024.
The European Parliament and the Council adopted it on October 19, 2022. Each Member State names a Digital Services Coordinator, and the European Commission supervises very large online platforms and very large online search engines directly. It applies to intermediary services offered to recipients established or located in the Union wherever the provider is established (Article 2).
Duties are layered. All intermediary services have contact points, terms and conditions and transparency reports. Hosting services add notice and action (Article 16) and statements of reasons (Article 17). Online platforms add complaint handling, trusted flaggers and rules on interface design, advertising, recommender systems and minors. Very large providers add systemic risk assessment, mitigation, audit and data access.
Why does it matter?
The DSA turns platform moderation into a set of documented duties with regulators and fines behind them. A provider needs to know which category its service falls into, because the obligations differ by category and only micro and small enterprises are partly exempt.
Key benefits include:
- Duties that grow with reach
Obligations are cumulative across intermediary services, hosting services, online platforms and very large online platforms and search engines.
- A defined path for illegal content
Hosting providers must offer notice mechanisms, decide notices diligently and explain restrictions with a statement of reasons (Articles 16 and 17).
- Users can challenge decisions
Online platforms give an internal complaint system and access to out-of-court dispute settlement (Articles 20 and 21).
- Systemic risk is regulated
Very large platforms must assess and mitigate systemic risks and be independently audited (Articles 34, 35 and 37).
- Fines up to 6 percent of turnover
The Commission can fine very large providers up to 6 percent of worldwide annual turnover (Article 74), and Member States set penalties up to the same level (Article 52(3)).
How does it work?
The Regulation has five chapters. Chapter I sets scope and definitions. Chapter II gives the liability exemptions for mere conduit (Article 4), caching (Article 5) and hosting (Article 6), and bars general monitoring obligations (Article 8). Chapter III sets due diligence obligations in five sections. Chapter IV covers implementation and enforcement, and Chapter V final provisions.
Section 1 of Chapter III applies to all intermediary services: points of contact (Articles 11 and 12), legal representatives for providers not established in the Union (Article 13), terms and conditions (Article 14) and transparency reporting (Article 15). Section 2 adds hosting duties. Section 3 adds online platform duties, and Section 4 adds marketplace duties such as traceability of traders (Article 30). Section 5 covers very large providers.
Online platforms must publish the number of average monthly active recipients in the Union every six months (Article 24(2)). The Commission designates a service as very large when it reaches 45 million (Article 33). Providers that are micro or small enterprises are excluded from Sections 3 and 4 except where they are very large (Articles 19 and 29).
Key Elements
- Liability framework (Articles 4 to 8)
Mere conduit, caching and hosting are exempt from liability under conditions, and providers have no general monitoring duty.
- Notice and action and statement of reasons (Articles 16 and 17)
Notices need a reasoned explanation, the exact location, the notifier's identity and a good-faith statement. Restrictions on content, payments, services and accounts need a clear statement of reasons.
- Online platform duties (Articles 20 to 28)
Internal complaints, out-of-court settlement, trusted flaggers, protection against misuse, transparency on dark patterns and advertising, recommender transparency and protection of minors.
- Trader traceability (Article 30)
Online marketplaces collect and check trader information before allowing them to offer products or services to consumers.
- Very large providers (Articles 33 to 43)
Systemic risk assessment, mitigation, crisis response, independent audit, recommender options, advertising repositories, data access for researchers, a compliance function and a supervisory fee.
- Enforcement (Articles 49 to 82)
Digital Services Coordinators, complaints (Article 53), compensation (Article 54), Commission decisions on non-compliance (Article 73) and fines (Article 74).
What does it cover?
The DSA applies to providers of intermediary services (mere conduit, caching and hosting) offered to recipients established or located in the Union, whatever the provider's establishment (Article 2). It does not apply to services that are not intermediary services. Online platforms and online search engines with at least 45 million average monthly active recipients in the Union are designated very large and face the heaviest duties.
What are its objectives?
The DSA aims for a safe, predictable and trusted online environment that protects fundamental rights.
Harmonize the rules for intermediary services in the internal market.
Keep conditional liability exemptions while adding clear due diligence duties.
Give users ways to notify illegal content and to contest moderation decisions.
Require very large providers to assess and reduce systemic risks and to open themselves to audit.
Provide supervision by national coordinators and the Commission with real penalties.
Framework in Context
The DSA sits beside Union law on copyright, consumer protection, audiovisual services and personal data, and it leaves Directive 2000/31/EC in place while amending it (Articles 2 and 89). Obligations on personal data processing, such as profiling for advertising, remain governed by the GDPR. It is separate from rules on digital markets that address gatekeepers.
Common Framework Mappings
Organizations map the EU Digital Services Act (DSA) to other global privacy, cybersecurity, and digital services regulations to ensure compliance across overlapping requirements for risk management, data protection, and digital platform operations.
Mapped frameworks include:
Digital Markets Act (DMA)
ePrivacy Directive (2002/58/EC)
EU General Data Protection Regulation (GDPR)
ISO/IEC 27001
ISO/IEC 27701
NIS2 Directive
NIST Cybersecurity Framework
SOC 2
How SmartSuite Supports EU DSA
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Compliance Management to hold the DSA obligations for the category each of your services falls into, with owners and evidence, Cyber & IT Risk for systemic risk assessments, and Privacy Management for interface, advertising and recommender-system records.
Service Category Register
Record each service, its DSA category and whether the micro and small enterprise exclusion applies (Articles 19 and 29).
Notice and Statement of Reasons Log
Track notices received, decisions, statements of reasons and redress options (Articles 16 and 17).
Complaints and Dispute Settlement
Run the internal complaint system and out-of-court dispute cases with deadlines and outcomes (Articles 20 and 21).
Transparency Reporting Calendar
Schedule the annual transparency report and the six-monthly recipient number publication (Articles 15 and 24).
Systemic Risk Register
Hold risk assessments, mitigation measures, audit findings and action plans for very large services (Articles 34, 35 and 37).
Regulator Contact File
Keep contact points, legal representative details and Digital Services Coordinator or Commission correspondence in one record (Articles 11 to 13).
Related frameworks
SOC 2 is the AICPA examination, under AT-C 105 and 205, of a service organization's controls against the 2017 Trust Services Criteria, issued as a type 1 or type 2 attestation report.
The GDPR (Regulation (EU) 2016/679) sets principles, lawful bases, individual rights and accountability duties for personal data, with fines up to EUR 20 million or 4 percent of turnover.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
ISO/IEC 27017:2026 gives cloud security control guidance for customers and providers, built on ISO/IEC 27002:2022, with four cloud-specific controls; it replaced the 2015 edition.
ISO/IEC 27018:2025 gives guidelines for protecting PII in public clouds acting as PII processors, built on ISO/IEC 27002:2022 with an extended control set.
ISO/IEC 27701:2025 specifies requirements for a stand-alone privacy information management system (PIMS) for PII controllers and processors, replacing the 2019 edition.
Frequently Asked Questions For EU Digital Services Act (DSA)
It entered into force on November 16, 2022 and applies to all providers from February 17, 2024. A few provisions, such as the rules on recipient numbers and the designation of very large platforms, applied earlier, from November 16, 2022 (Article 93).
Intermediary services offered to recipients established or located in the Union, wherever the provider is established: mere conduit, caching and hosting, and within hosting, online platforms and online search engines (Articles 2 and 3).
Offer an easy notice mechanism, process notices diligently and objectively, tell the notifier the decision and redress options (Article 16), and give affected recipients a clear statement of reasons for restrictions on content, payments, services or accounts (Article 17).
An online platform or search engine with at least 45 million average monthly active recipients in the Union that the Commission designates (Article 33). It then faces systemic risk assessment, mitigation, independent audit, data access and a compliance function (Articles 34 to 43).
The Commission can fine very large providers up to 6 percent of worldwide annual turnover (Article 74). Member States set penalties for other providers, with a maximum of 6 percent for failing to comply with an obligation and a lower cap for incorrect information (Article 52).
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.