The Digital Services Act is a European Union regulation adopted in 2022 that sets obligations for online intermediaries, hosting services, and platforms operating in the EU. It requires clear moderation policies, notice-and-action procedures for illegal content, complaint and redress mechanisms, transparency reporting, and — for the largest services — assessment and mitigation of systemic risks. It predates and sits alongside the EU AI Act and the Digital Markets Act, and is the instrument through which the European Commission has most often addressed algorithmic and AI-mediated harms.
| Field | Value |
|---|---|
| Instrument | Regulation (EU) 2022/2065 |
| Adopted | 2022 |
| Enforcer | European Commission (for VLOPs/VLOSEs), national Digital Services Coordinators |
| Maximum fine | Up to 6% of global annual turnover |
Scope and definitions
The DSA applies tiered obligations by service type, with the heaviest duties falling on very large online platforms (VLOPs) and very large online search engines (VLOSEs) — services designated by the Commission on the basis of user reach. Designated services are subject to direct Commission supervision; other intermediaries are supervised by national Digital Services Coordinators.
Key provisions
- Notice-and-action. Services must provide mechanisms for reporting illegal content and act on notices.
- Complaint and redress. Users can appeal moderation decisions, including automated ones, through internal complaint-handling and out-of-court dispute settlement.
- Human oversight of automated moderation. The regulation requires human review of automated moderation decisions, particularly where legal content is removed under a service's own community standards — a requirement that directly constrains purely model-based moderation pipelines. See AI and Content Moderation.
- Transparency reporting. VLOPs must publish moderation statistics and disclose recommender-system parameters.
- Systemic-risk assessment and mitigation. VLOPs and VLOSEs must assess systemic risks to fundamental rights, civic discourse and electoral processes, publish mitigation measures, and submit to independent audit. See AI in Elections and Democratic Institutions.
Enforcement
A confirmed non-compliance decision can carry a fine of up to 6% of global annual turnover.
The Commission opened formal proceedings under the DSA against TikTok in 2024 over its handling of the Romanian elections, and against X over content moderation and advertising transparency. As of 2026 the DSA is the most active regulatory instrument applied to AI-in-elections questions globally, ahead of US federal action (see AI in Elections and Democratic Institutions).
On July 24, 2026, the Commission issued preliminary findings that TikTok breached the DSA by failing to keep minors' accounts safe. The Commission found that users aged 13 to 15 could switch their accounts from private to public with little friction, and that accounts belonging to 16- and 17-year-olds remained visible to anyone online, including people without a TikTok login (Source: digital-strategy.ec.europa.eu; cnbc.com). See ByteDance / Doubao.
Designation of ChatGPT as a very large online search engine
On 31 August 2026 the Commission said that ChatGPT, Reddit and Roblox must comply with the DSA's rules for very large online platforms and search engines, after each service declared that it reaches at least 45 million monthly users in the European Union. ChatGPT qualifies as an online search engine under the act, while Roblox and Reddit qualify as online platforms because they let users disseminate third-party content to the public. The three have four months from designation to meet the additional obligations, which include assessing and mitigating the risk of illegal content spreading through their services, mitigating negative effects on minors and on users' physical and mental wellbeing, and limiting risks to fundamental rights, electoral processes and public security. The Commission supervises compliance directly and gains investigative powers to assess the functionalities behind the services (Source: reuters.com).
The designation places a general-purpose conversational assistant inside a regime written for search engines and content platforms, so the systemic-risk assessment and independent-audit duties described above attach to OpenAI alongside the obligations it carries under the EU AI Act.
Relation to other EU instruments
The DSA governs the handling of content and systemic risk on platforms; the Digital Markets Act governs the conduct of designated gatekeepers in competition terms; and the EU AI Act governs AI systems and general-purpose models by risk tier. Under the AI Act, general-purpose models used in content moderation carry transparency obligations covering training data and capabilities, and high-risk content-moderation systems may face conformity assessment — obligations that layer onto, rather than replace, the DSA's process duties.
The Commission's EU KIDS Act proposal of 17 September 2026 would specify the DSA's minor-protection duty for social networks, video-sharing platforms and video gaming platforms: providers that comply with the proposal would be deemed to comply with DSA Article 28(1) for the matters it covers, and its obligations would be enforced through the DSA's Chapter IV. Very large online platforms in scope would have to notify an independently audited compliance plan to the Commission (Proposal for an EU KIDS Act, COM(2026) 681 — Source Summary; Source: digital-strategy.ec.europa.eu). Under Article 5 of the proposal the plan is due within four months of a platform's designation as a very large online platform, or within 30 days of the Regulation's entry into application for platforms already designated, and the auditors report within two months of receiving it; later compliance reporting is folded into the platform's DSA Article 34 risk assessment and Article 37 audit (Proposal for an EU KIDS Act, COM(2026) 681 — Source Summary).
The proposal describes its safety-by-design provisions as setting in "hard law" the specifications of the Commission's October 2025 guidelines on the protection of minors under Article 28, and states that ongoing Article 28 cases are unaffected; its memorandum cites ten DSA preliminary findings on the protection of minors, including on addictive design, safe accounts and age assurance. Its Chapter IV enforcement route also covers software application stores. It would require social networking and video-sharing services that use recommender systems to offer minors at least one option not based on profiling, a choice DSA Article 38 requires only of very large platforms; treat restrictions imposed after reports by minors as visibility restrictions under Article 17(1)(a); subject the Commission's DSA enforcement against very large platforms to best-efforts targets of [30] working days for preliminary findings and 90 working days for a final decision; and fund the added supervision through a top-up to the Article 43 supervisory fee capped at 0.03% of a provider's worldwide annual net income (Proposal for an EU KIDS Act, COM(2026) 681 — Source Summary).
Relationships
- related: Digital Markets Act (EU), EU AI Act (Regulation 2024/1689), General Data Protection Regulation (GDPR) — parallel EU digital-regulation instruments.
- related: EU KIDS Act (proposed Regulation on the protection of minors online) — proposed Regulation (September 2026) that specifies and complements the DSA for minors and uses its Chapter IV enforcement for platforms.
- related: AI and Content Moderation, AI in Elections and Democratic Institutions — the domains in which the DSA's obligations bind most directly.
- regulated-by: applies to ByteDance / Doubao, Meta AI, xAI and other designated platforms.
- instance-of: EU vs. US AI Regulation: A Deep Comparison — the EU's process-and-transparency regulatory model.