Digital Services Act (DSA)

Think of the internet as a massive city. In the early days, platform owners set their own rules with little oversight — more Wild West than metropolis. The DSA acts as the city-wide building code. Just as a shopping-mall owner must ensure fire safety and that shops follow local law, the DSA requires digital platforms to take responsibility for the safety of their digital spaces. Once a platform becomes large enough to function as the city’s main public square, it faces stricter rules to protect the crowd from systemic risks like misinformation, illegal content, and threats to public health.

How the DSA Works: Tiers and Obligations

The DSA does not treat every website the same. It uses a tiered system based on the nature of the service and its societal impact. At the base are intermediary services — internet service providers (mere conduits), caching services, and hosting providers. As services grow in complexity and user base, they enter categories like online platforms and online marketplaces, which face progressively higher accountability.

The most stringent rules are reserved for the largest players: Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs). These are services that reach at least 45 million average monthly active users in the EU. Because these platforms can shape public discourse and influence millions of lives, they are held to a much higher standard of transparency and risk management.

Systemic Risk and Mitigation

For VLOPs and VLOSEs, the DSA mandates an annual systemic risk assessment under Articles 34-35 of the regulation. This is not a box-ticking exercise. Platforms must analyze how their systems — including algorithmic recommenders and advertising infrastructure — might contribute to negative societal outcomes. Assessments must cover the dissemination of illegal content, impacts on fundamental rights, civic discourse and electoral integrity, public security, gender-based violence, public health, and the mental well-being of minors.

Once risks are identified, platforms must implement proportionate mitigation measures: redesigning algorithms to slow viral harmful content, changing how advertising systems target users, or overhauling content moderation policies. To verify these measures actually work, the DSA requires annual independent audits.

Enforcement and Penalties

The enforcement structure splits between national and European authorities. National Digital Services Coordinators supervise smaller intermediaries, while the European Commission holds exclusive competence for overseeing VLOPs and VLOSEs — ensuring the largest platforms face consistent standards across the entire EU.

Penalties are designed to matter even to the largest tech companies:

• Up to 6% of worldwide annual turnover for serious infringements such as failing to comply with systemic risk obligations
• Up to 1% of worldwide annual turnover for minor infractions like failing to respond to information requests
• Up to 5% of average daily worldwide turnover per day in periodic penalty payments for non-compliance with Commission orders

The Commission has enforced these penalties against major platforms, including fines exceeding EUR 500 million for systemic risk-assessment failures. These figures are not theoretical — they establish the DSA as one of the most consequential regulatory frameworks in the digital economy.

The AI Evolution: VLOSE Scope

The DSA’s scope evolves with technology. AI-powered search engines now fall under the regulation, recognizing that generative AI tools functioning as search engines are subject to the same oversight as other VLOSEs. Designated services have four months to comply with the full VLOP/VLOSE obligations, including systemic risk assessments and annual audits.

Why It Matters

For developers, Web3 builders, and anyone working in the crypto or AI space, the DSA represents a fundamental shift in the digital operating environment. Even decentralized projects that provide intermediary services to EU users may eventually fall under its scope. The DSA is complemented by the EU AI Act, forming the EU’s comprehensive digital regulatory stack. Compliance is no longer optional — it is a baseline requirement for operating in the European market.