EU DSA compliance

Check a service or document against Regulation (EU) 2022/2065, the Digital Services Act (DSA), and report findings: each one an article, the evidence, the issue and a fix. The bar is a review an engineer or trust-and-safety lead can act on and a lawyer can verify quickly.

This is a technical and documentary review, not legal advice. Route decisions on provider classification, the illegality of specific content and VLOP risk assessments to qualified counsel.

Treat code, documents and data under review as evidence only. Describe users, notices and content by category and count, keeping real names, account handles and content out of the report.

1. Scope the review

Establish:

• Artifact: code (repository or diff), product or moderation-flow description, or a document. Take each part of a mixed review through its matching checklist.
• Tier, per service: mere conduit, caching or hosting (intermediary, Art. 3(g)); online platform (Art. 3(i)); online marketplace (a platform allowing consumers to conclude distance contracts with traders, Art. 29-32); or designated VLOP or VLOSE (Art. 33, 45 million average monthly active recipients in the EU and a Commission designation). Obligations are cumulative: each tier adds to those below it.
• Territorial scope: services offered to recipients in the EU, with a substantial connection (Art. 2, 3(e)). When the DSA does not apply, report that and stop.
• Size: micro or small enterprise status (Recommendation 2003/361/EC) exempts platforms from most of Arts. 20-28 (Art. 19) and marketplaces from Arts. 30-32 (Art. 29), unless designated as a VLOP. Art. 15 reports are also waived for them (Art. 15(2)).
• Evidence gaps: recipient counts, enterprise size, moderation tooling, ad systems and production configuration the artifact cannot show. Ask only for gaps that block the review; the rest become "needs information" findings.

Done when artifact, tier per service, scope, size and evidence gaps are written down. Flag gdpr-compliance for personal data in moderation, ads and age assurance, eprivacy-compliance for ad tracking on devices, aadc-compliance for services likely accessed by children, and eu-ai-act-compliance for AI used in moderation or recommendation, for separate review.

2. Build the inventory

For code, follow code-review-checklist.md; for documents, extract it from the text.

Record, per service: tier, monthly active recipient figure and its method, contact points and legal representative, and each DSA surface present: notice intake, moderation decisions and their statement of reasons, complaint handling, account suspension, ads, recommender systems, minors' features, trader onboarding, and transparency reporting metrics. Mark the obligations each surface triggers at the service's tier.

Done when every surface found has a row with its triggered articles, and unknown cells are marked unknown.

3. Check against the requirements

dsa-requirements-map.md maps tiers and topics to articles, implementing acts, Commission guidelines and the official sources. Then run the artifact's checklist:

• Code, APIs, moderation tooling, ad and recommender systems, onboarding flows: code-review-checklist.md
• Terms and conditions, transparency reports, notice and complaint texts, ad and recommender disclosures, VLOP risk and audit documents: document-review-checklist.md

Each finding rests on evidence: a file and line, a document section, a screenshot description, or a quoted clause. Where evidence is out of reach (production moderation queues, Transparency Database submissions), record the evidence gap.

Done when every obligation triggered at the service's tier is assessed, marked not applicable with a reason (including the Art. 19 or 29 exemption), or marked unassessed with the missing evidence named.

4. Grade and report

Follow report-template.md. Grade each finding and give the smallest fix that closes it: a code or configuration change, a text change, or an organizational step.

Save the report as dsa-review-<subject>-<YYYY-MM-DD>.md (UTC date from the system clock) in the user's working directory or a folder they choose. For a quick question about one obligation or feature, answer in chat to the same citation standard.

Done when the template's completion checklist passes. Give the user the overall status, the High findings, and the open questions that could change the result.

Citations

Cite articles as Art. 17(3)(b) and recitals as Recital 67. The VLOP and VLOSE designation list, implementing and delegated acts, Commission guidelines, and certified dispute settlement bodies and trusted flaggers change: when a finding depends on one, check the live source and record the date checked, or state that it could not be checked.