On 25 August 2023 the four-month compliance period expired for the seventeen very large online platforms and two very large online search engines designated by the European Commission under the Digital Services Act. They began to discharge the full set of obligations addressing systemic risk.
This was not the general effective date of the DSA. For most online platforms and search engines, general obligations apply from 17 February 2024. Designated platforms face heavier, earlier duties, and are closer to regulatory questioning.
Who was designated
Designation covers platforms and search engines with more than 45 million monthly active users in the EU, spanning social media, e-commerce, app stores, video and search. The threshold is scale, not place of incorporation. A non-EU company serving EU users at that scale may be designated.
For Chinese companies expanding abroad, the practical point is that EU-facing products may fall within designation even with a domestic entity; those not designated cannot assume they are unregulated, since general obligations still apply in February 2024.
Systemic risk at the core
Obligations revolve around systemic risk: assessment and mitigation of risks to the dissemination of illegal content, fundamental rights, electoral processes, public security, minors and mental health. Platforms must establish risk assessment mechanisms and adopt proportionate mitigation.
Risk assessment is not a one-off document. It must be updated periodically, externally audited and reported to regulators. For product teams, changes to recommendation, advertising and community rules may all trigger an update.
Transparency and choice
Platforms must provide transparency on content moderation and recommender systems, including advertising transparency, explanations of recommender parameters and the user’s right to opt out of profiling-based recommendations. For products that rely on personalisation for engagement and conversion, these requirements directly affect product logic and data use.
Platforms must also establish internal compliance functions, appoint a compliance officer, submit to independent audit and open data to researchers. The scope and method of data access involve balancing trade secrets against personal information protection.
What companies can prepare
First, assess whether the designation threshold is met, counting EU monthly active users rather than global users. Second, document content moderation and recommendation mechanisms in an explainable form. Third, establish risk assessment and mitigation processes with owners, cycles and evidence. Fourth, check that advertising transparency and user choice are implemented in the product. Fifth, prepare a compliance officer and internal function rather than outsourcing all obligations to counsel.
Companies not yet designated but serving EU users should still prepare for general obligations in February 2024, including notice-and-action mechanisms, points of contact, terms transparency and moderation statements.
For EU platform regulation and multi-jurisdiction compliance, see our multi-jurisdiction service; for data and content handling, see data compliance; for platform terms and merchant agreements, see commercial contracts.
This article is based on the EU Digital Services Act and related Commission designation decisions of 2023. It is for reference only and does not constitute legal advice.