What is the Digital Services Act? A guide for digital platforms

Trust is the currency of the digital economy. For years, the rules governing how online platforms operate, moderate content, and protect users have been somewhat fluid with regulatory frameworks dependent on the country where platforms were primarily based.

That landscape changed profoundly, leading many to ask: what is the Digital Services Act? The Digital Services Act (DSA) – the European Union’s groundbreaking rulebook for online intermediaries. It isn’t just a policy update; it’s a fundamental shift in how covered online platforms must approach online safety. The goal is simple but ambitious: create a digital space that is safer, more transparent, and accountable.

For platforms, this means new responsibilities. For users, it means stronger rights. For some companies understanding the DSA is no longer optional, it’s essential for doing business.

Here is everything you need to know about the DSA, who it affects, and how to prepare.

A new architecture for online trust

The DSA represents a comprehensive overhaul of digital regulations. Unlike previous attempts that merely tweaked existing rules, the DSA establishes a modern, risk-focused architecture. It places three core values at the center of platform operations: transparency, accountability, and user protection.

The law applies to a defined set of covered companies and intermediaries. It establishes baseline due diligence obligations for those in scope, while layering additional requirements on the largest players. The logic is straightforward: the greater the impact, the greater the responsibility.

Under the DSA, you must adapt your policies to meet clearer requirements around notice-and-action procedures, advertising transparency, and risk mitigation. The ultimate aim is to give users control over the services they use while ensuring systemic risks are identified proactively.

Get your free access to the report

Explore the latest insights into digital fraud trends with the Future of Payments Report.

Download Now

Who does the DSA apply to?

The DSA casts a wide net, but it doesn’t treat everyone the same. It distinguishes between four main categories, with obligations calibrated to the role the service plays in the digital ecosystem:

1. Intermediary services: “Mere conduit” such as services like internet access providers; “Caching services” such as content delivery networks and proxy caching services ;“Hosting services” such as cloud and web hosting services.
2. Online platforms: Marketplaces, app stores, and social networks that bring users together.
3. Very large online platforms (VLOPs) and search engines (VLOSEs): Services with more than 45 million monthly active users in the EU.

If your service enables direct interactions between users or hosts user-uploaded content, you likely fall within the DSA’s reach. While basic transparency duties apply broadly, the heavy lifting regarding systemic risk targets the largest services due to their societal impact.

“Too Big to Care” is over

The DSA specifically targets services with systemic reach. It designates VLOPs and VLOSEs for heightened obligations, recognizing that the practices of a few major platforms can create risks to fundamental rights and public security.

For these giants, scale now brings increased legal responsibility. They must conduct comprehensive risk assessments to address issues like the spread of illegal content, negative effects on civic discourse, and public security concerns. They must also open their doors to independent audits and regulatory scrutiny.

The message is clear: You cannot deprioritize user safety or hide operational choices behind complexity.

Turning best practices into legal obligations

Many platforms have voluntarily adopted practices like clear terms of service or fast takedowns. The DSA turns these “best practices” into legal requirements.

Notice-and-action mechanisms are central here. You are now required to provide straightforward channels for users to flag potentially illegal content. Once notified, you must act quickly to assess and, if necessary, remove the content. Crucially, you must also protect against arbitrary removal by providing clear justifications and accessible complaint mechanisms.

Essential responsibilities to be aware of

The DSA brings together a defined set of legal responsibilities. Here are the key requirements that compliance teams need to implement:

1. Notice-and-action systems

You must provide easy-to-use mechanisms for users to report illegal content. When you take action, you must provide a clear explanation to the user.

2. Transparent terms of service

Your terms must be intelligible and accessible. Content moderation policies must be publicly available so users understand the consequences of their actions on your platform.

3. User complaint mechanisms

Users must be able to challenge your decisions. You need an effective internal complaint-handling system and must inform users about out-of-court dispute options.

4. Transparency reporting

Regular transparency reports are now mandatory. You must document content moderation decisions, the number of notices received, and the actions taken. This helps the public evaluate how you handle harmful content.

5. Ad transparency

Users have a right to know why they are seeing an ad, who paid for it, and the criteria used for targeting. This aims to reduce opaque micro-targeting practices.

6. Risk Assessments (VLOPs Only)

Large platforms must assess systemic risks to fundamental rights, public health, and minors, implementing mitigation measures where necessary.

7. Data access for researchers

The DSA creates frameworks for vetted researchers to access platform data to monitor systemic risks, balancing transparency with privacy.

8. Protection for minors

Platforms must ensure high levels of privacy and safety for minors, including stricter rules on advertising and default settings that prioritize safety.

Strengthening user rights

The DSA isn’t just about compliance checklists; it’s about empowering people. Users now benefit from clearer information about platform rules and explanations when their content is removed.

This balances user safety with freedom of expression. Content moderation cannot be arbitrary. By requiring internal complaint mechanisms, the DSA gives users a practical way to contest decisions. This ensures that the enforcement of platform rules doesn’t erode fundamental rights.

Implications for marketplaces and financial services

If you operate as online marketplaces, the DSA presents unique challenges and opportunities.

• For marketplaces: You will need to strengthen identity verification (KYC) for sellers. “Know Your Business Customer” (KYBC) principles are becoming vital to ensure traceability and remove illegal listings.
• For financial services: Firms hosting user-generated content must ensure their anti-fraud and anti-money laundering (AML) systems interface effectively with DSA requirements.

Transparency and risk-assessment obligations mean that onboarding providers may need to share data with platform investigators. This is an opportunity to treat compliance not as a burden, but as a chance to demonstrate leadership in building a trustworthy ecosystem.

Your DSA compliance checklist

Meeting Digital Services Act (DSA) requirements involves operational, legal, and technical adjustments. Use the framework below to assess your organisation’s preparedness and identify areas that may require strengthening.

Complying with the Digital Services Act requires more than isolated policy updates — it demands a coordinated, organisation-wide approach that embeds transparency, accountability, and risk management into platform operations. From correctly identifying your regulatory classification to strengthening moderation policies, reporting workflows, and appeal mechanisms, each step contributes to a more structured and defensible governance framework. At the same time, platforms must enhance their ability to collect and disclose moderation data, provide clear advertising transparency, and reinforce user due diligence measures where transactions are involved. Ultimately, sustainable DSA readiness depends not only on procedural changes but on strong internal alignment across legal, compliance, product, engineering, and risk teams, ensuring that regulatory obligations are operationalised effectively and maintained over time.

Global Impact: Beyond the EU

Although the DSA is an EU regulation, its ripple effects are global. Platforms serving EU users must comply regardless of where they are headquartered.

For multinational companies, the DSA often sets the de facto global standard. It is often more practical to run a unified moderation system across all regions than to fragment operations. Aligning with DSA principles: transparency, redress, and risk assessment, can help you present a consistent, trustworthy face to customers worldwide.

Building a safer future

The Digital Services Act is rewriting the social contract of the online world. It puts transparency and accountability at the core of the digital experience.

For decision-makers, this is a strategic opportunity. Compliance can be a competitive differentiator. By embracing safety-by-design and transparent practices, you can attract users who value trust and clarity. The DSA is already reshaping the digital space. Contact us today to help build a safer, fairer online environment for everyone.