Regulationsby GlyphDigital Services Act
In force European Union · In force Nov 16, 2022 · next deadline Feb 18, 2027 (in 4 months)
Deadlines
Coming up
DSA SME impact reportCommission report under Article 91 on effects on SMEs.
Already passed
ChatGPT designated as VLOSE; Reddit and Roblox as VLOPsCommission designated ChatGPT as a very large online search engine and Reddit and Roblox as very large online platforms. They have four months (by January 2027) to meet VLOP/VLOSE obligations.
DSA first harmonised transparency reporting cycleFirst full annual reporting period (to 2026-12-31) under the harmonised templates for all intermediary services.
DSA review report on VLOP scope and interplayCommission report under Article 91 on Article 33 scope and interaction with other laws.
DSA delegated act on researcher data access in forceDelegated Regulation (EU) 2025/2050 sets the procedure for vetted researchers to access VLOP and VLOSE data under Article 40(4). Published in the OJ on 2025-10-09; in force on the 20th day.
DSA transparency report templates mandatoryImplementing Regulation (EU) 2024/2835 requires all intermediary services to use harmonised templates for content moderation data collected from this date.
DSA applies to all intermediary servicesFull application to all providers of intermediary services (Art 93(2)).
First VLOP/VLOSE designationsCommission designated the first 19 very large online platforms and search engines (e.g. Amazon Store, Facebook, Google Search, TikTok, X). Obligations apply four months after notification.
Platforms publish EU user numbersOnline platforms and search engines had to publish average monthly active EU recipients, and must update them at least every six months (Art 24(2)).
DSA enters into forceEntered into force twenty days after publication; VLOP designation provisions (Art 33(3)-(6)) and Commission enforcement sections apply from this date (Art 93).
Summaries for reference, not legal advice. Check the official text.
What it does
Layered obligations for intermediary services: notice-and-action for illegal content, statements of reasons, complaint handling, transparency reporting, and ad and recommender transparency. Profiling-based ads to minors and ads based on sensitive data are banned. Very large online platforms and search engines (45M+ EU users) must also run annual systemic-risk assessments and audits and give researchers data access.
- Who it applies to
- Intermediary services offered to EU recipients (mere conduit, caching, hosting, online platforms, marketplaces, search engines). VLOP/VLOSE tier: 45 million or more average monthly active EU recipients, designated by the Commission. Micro and small enterprises are exempt from some platform duties.
- Penalties
- Up to 6% of annual worldwide turnover for failure to comply. Up to 1% for incorrect, incomplete or misleading information or failure to submit to inspection. Periodic penalty payments up to 5% of average daily worldwide turnover (Arts 52, 74).
- Enforced by
- European Commission (VLOPs/VLOSEs); national Digital Services Coordinators; European Board for Digital Services
- Official name
- Regulation (EU) 2022/2065 on a Single Market for Digital Services (Digital Services Act)
- Citation
- OJ L 277, 27.10.2022, p. 1
- Topics
- Online safety, Children, Privacy
Research notes
The exact compliance date for the Aug 2026 designations depends on the notification date (four months after notification); the Commission says 'by January 2027', so no exact deadline row. The 31 Aug 2026 date is the date of the Commission news item.
Related
Cyber Resilience ActSets mandatory cybersecurity requirements for hardware and software products with digital elements sold in the EU: secure by design, vulnerability handling, security updates for the support period, SBOMs, and CE marking after conformity assessment. Manufacturers must report actively exploited vulnerabilities and severe incidents to CSIRTs and ENISA from 11 Sep 2026.Next: Dec 11, 2027 CRA fully applies · in 13 monthsDORAHarmonised ICT risk-management, major ICT-incident reporting, digital operational resilience testing (including threat-led penetration testing) and ICT third-party risk rules for EU financial entities. Financial entities must keep a register of all ICT third-party contracts. Critical ICT third-party providers (cloud, data centres and similar) come under direct EU oversight.In effect since Jan 16, 2023Data Governance ActSets conditions for re-use of protected public-sector data (personal data, trade secrets, IP) and creates a notification and neutrality regime for data intermediation services. It also sets up voluntary registration of 'recognised data altruism organisations'. Data intermediaries must stay neutral, separate the intermediation service from other services and notify a competent authority.In effect since Jun 23, 2022Digital Markets ActImposes ex-ante do's and don'ts on designated gatekeepers. Examples: no combining personal data across services without consent, no self-preferencing, interoperability, data portability, and business-user data access. Gatekeepers must notify all acquisitions and submit an audited description of consumer profiling techniques.In effect since Nov 1, 2022Digital Omnibus (data/GDPR)Commission proposal to simplify EU digital rules. It would amend the GDPR (personal data definition, processing for AI, a new cookie/terminal-equipment consent regime in Art 88a/88b, breach notification only for high-risk breaches within 96 hours) and the ePrivacy Directive, NIS2, CER Directive and Data Act. A single-entry point would handle incident reporting, and the Data Governance Act, Free Flow Regulation, Platform-to-Business Regulation and Open Data Directive would be repealed and merged into the Data Act. The AI Act part was split out and adopted separately as Regulation (EU) 2026/1744.No date setEU AI ActA risk-based product-safety regime for AI. It bans certain AI practices, imposes strict requirements on high-risk AI systems (risk management, data governance, documentation, human oversight, conformity assessment), sets transparency duties for chatbots, deepfakes and AI-generated content, and sets obligations for general-purpose AI model providers. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) pushed the high-risk dates back to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). It also softened the AI literacy duty and added bans on non-consensual sexual deepfakes and child sexual abuse material (CSAM) generation.Next: Dec 2 New bans on sexual deepfakes and CSAM generation; Art 50(2) grace period ends · in 36 daysEU CSAM Interim RegulationLets providers of number-independent interpersonal communications services, such as messaging and email, voluntarily scan for and report online child sexual abuse despite ePrivacy confidentiality rules, under strict conditions. It replaces Regulation (EU) 2021/1232, which expired on 2026-04-03. The permanent CSA Regulation proposed in 2022 is still not adopted.Next: Feb 1, 2028 Commission implementation report · in 15 monthsEU Consumer Credit Directive 2 (CCD2)Replaces the 2008 Consumer Credit Directive and extends it to buy-now-pay-later and small loans. Creditworthiness assessments must use relevant, accurate data and may not use special category data or social media data. Where the assessment involves automated processing, consumers get a right to human intervention and an explanation.Next: Nov 20 National rules apply · in 24 days
Questions about Digital Services Act
- What are the Digital Services Act compliance deadlines?
- Nov 16, 2022: DSA enters into force. Feb 17, 2023: Platforms publish EU user numbers. Apr 25, 2023: First VLOP/VLOSE designations. Feb 17, 2024: DSA applies to all intermediary services. Jul 1, 2025: DSA transparency report templates mandatory. Oct 29, 2025: DSA delegated act on researcher data access in force. Nov 17, 2025: DSA review report on VLOP scope and interplay. Jan 1, 2026: DSA first harmonised transparency reporting cycle. Aug 31, 2026: ChatGPT designated as VLOSE; Reddit and Roblox as VLOPs. Feb 18, 2027: DSA SME impact report.
- When does Digital Services Act take effect?
- Digital Services Act took effect on Nov 16, 2022. The next milestone is Feb 18, 2027: DSA SME impact report.
- Who does Digital Services Act apply to?
- Intermediary services offered to EU recipients (mere conduit, caching, hosting, online platforms, marketplaces, search engines). VLOP/VLOSE tier: 45 million or more average monthly active EU recipients, designated by the Commission. Micro and small enterprises are exempt from some platform duties.
- What are the penalties under Digital Services Act?
- Up to 6% of annual worldwide turnover for failure to comply. Up to 1% for incorrect, incomplete or misleading information or failure to submit to inspection. Periodic penalty payments up to 5% of average daily worldwide turnover (Arts 52, 74).