EU Digital Services Act, AI and Algorithmic Accountability Provisions

Applies To

Overview

Regulation (EU) 2022/2065 on a Single Market for Digital Services (Digital Services Act, DSA) entered into force on 16 November 2022. Obligations for very large online platforms and search engines (VLOPs and VLOSEs) became applicable on 25 August 2023; those for all other in-scope providers on 17 February 2024. The DSA sets layered rules for online intermediary services, with AI-related duties in three areas: recommender systems (tools that pick what users see), targeted advertising, and systemic risk management. Online platforms must explain the main factors behind any recommender system they use, and let users switch options where several exist. Very large platforms must also offer at least one option not based on profiling (tailoring from personal data). All online platforms are prohibited from using dark patterns (designs that trick or pressure users into choices) in their interfaces. For VLOPs and VLOSEs, which the European Commission designates once they reach at least 45 million average monthly active recipients in the EU, the obligations are much stricter. Designated platforms must conduct annual systemic risk assessments covering risks from algorithmic amplification (automated boosting) of illegal content, fundamental rights impacts, civic discourse, electoral processes, and gender-based violence. They must adopt reasonable mitigation measures, undergo annual independent audits, give vetted researchers data access, appoint a compliance officer, and share data with the Commission and Digital Services Coordinators. All online platforms are barred from showing ads based on profiling with sensitive personal data, and profiling-based ads to users they know are minors. The Commission has exclusive power to enforce the duties specific to VLOPs and VLOSEs, with fines up to six percent of global annual turnover and, for repeated infringement, periodic penalty payments and eventually temporary access restriction. Member State Digital Services Coordinators enforce obligations applicable to smaller platforms, with fines of up to six percent of the provider's worldwide annual turnover.

Key Requirements

• •All online platforms: Explain the main parameters of any recommender system in plain language, and let users switch options where several exist (Article 27).
• •All online platforms: Prohibit the use of interface design that obscures choices or manipulates user behavior (dark patterns prohibition, Article 25).
• •All online platforms: Do not show ads based on profiling with sensitive personal data (Article 26(3)), or profiling-based ads to users known to be minors (Article 28(2)).
• •VLOPs and VLOSEs: Offer at least one recommender option not based on profiling (Article 38).
• •VLOPs and VLOSEs: Keep a public repository of the ads they show, including targeting parameters (Article 39).
• •VLOPs and VLOSEs: Conduct annual systemic risk assessments covering algorithmic amplification of illegal content, fundamental rights, democratic processes, and public health risks (Article 34).
• •VLOPs and VLOSEs: Design and implement proportionate risk mitigation measures and document those measures (Article 35).
• •VLOPs and VLOSEs: Submit to independent audits at least annually and publish audit reports (Article 37).
• •VLOPs and VLOSEs: Provide vetted researchers with access to data necessary for systemic risk research (Article 40).
• •VLOPs and VLOSEs: Appoint a DSA compliance officer at senior management level (Article 41).
• •VLOPs and VLOSEs: Publish annual transparency reports and submit enhanced transparency reports to the Commission (Articles 15 and 42).
• •All in-scope providers: Publish terms of service in plain language describing content moderation policies and any use of automated means in enforcement.

What Your Organization Must Do

• →Check whether your service is an in-scope online intermediary and whether the Commission has designated it a very large platform or search engine.
• →Rewrite recommender system disclosures in plain language, covering the main factors that decide what users see.
• →Audit advertising systems to block ads based on sensitive personal data and profiling-based ads to known minors.
• →Review interface designs with counsel to remove patterns that obscure choices or pressure users into decisions.
• →If designated, schedule annual systemic risk assessments, independent audits, and appoint a senior compliance officer.
• →Map overlaps with the EU AI Act, since a high-risk AI recommender may need to satisfy both frameworks.

Playbook Guidance

Step-by-step implementation guidance for compliance teams.

Governance Controls

Operational controls that implement requirements from this regulation.

Frequently Asked Questions

Which platforms are classified as VLOPs under the DSA and subject to the strictest algorithmic accountability rules?

The European Commission designates platforms as VLOPs when they reach at least 45 million average monthly active recipients in the EU. Current designees include major social media networks, large e-commerce marketplaces, and app stores. Designation triggers the full set of obligations including systemic risk assessments, independent audits, and researcher data access.

When did DSA obligations become enforceable for platforms that are not VLOPs or VLOSEs?

Baseline obligations for all other in-scope online intermediaries became applicable on 17 February 2024. VLOP and VLOSE obligations were already enforceable from 25 August 2023 following Commission designation decisions issued that year.

What are the maximum fines for violating the DSA algorithmic transparency and risk management provisions?

The European Commission can fine a VLOP or VLOSE up to 6 percent of its worldwide annual turnover. For repeated infringement, periodic penalty payments and temporary access restrictions are also available. National coordinators can fine other providers up to 6 percent of worldwide annual turnover.

Does the DSA require platforms to offer users a non-algorithmic feed or recommendation option?

Only very large platforms and search engines must, under Article 38. Other online platforms must explain their recommender systems' main parameters under Article 27, and let users choose where several options exist.

How do the DSA's algorithmic risk assessment obligations differ from those under the EU AI Act?

The DSA requires VLOPs and VLOSEs to conduct annual systemic risk assessments focused on societal harms such as electoral interference, illegal content amplification, and public health risks. The EU AI Act imposes conformity assessments on high-risk AI systems at the product level. A VLOP deploying a high-risk AI recommender system may need to satisfy both frameworks independently.

Does the DSA prohibit all targeted advertising on VLOPs, or only certain types?

The DSA does not ban targeted advertising broadly. All online platforms are barred from ads based on profiling with sensitive data such as health or religion, and from profiling-based ads to known minors. Only VLOPs and VLOSEs must keep a public ad repository.