EU Digital Services Act

Providers of intermediary services not established in the Union but offering services there must designate in writing a legal or natural person as their legal representative in one of the Member States where they offer services, mandated to be addressed in addition to or instead of the provider by Member State authorities, the Commission and the Board on all issues necessary for the receipt of, compliance with and enforcement of decisions under the Regulation; the representative can be held liable for non-compliance. Providers must notify the name, postal address, email address and telephone number of the representative to the Digital Services Coordinator of the Member State where the representative resides or is established, and ensure the information is publicly available, easily accessible, accurate and kept up to date. Providers must also designate under Art. 11 a single point of contact for electronic communication with authorities and publish the related information, and under Art. 12 a point of contact for direct communication with recipients of the service.

Applies when

Chinese companies operating hosting or platform services in the EU. Note that the legal representative (Art. 13), the authority contact point (Art. 11) and the recipient contact point (Art. 12) are three distinct requirements and cannot be collapsed into one shared mailbox.

Applies from: 2024-02-17

Evidence to retain

• · Written mandate appointing the legal representative
• · Notification filed with the Digital Services Coordinator
• · Screenshots of the published legal representative and both contact points
• · Response-time and handling records for the contact points

Estimated first-time effort: 3–10 person-days (estimate, not a commitment)

Providers of intermediary services must set out in their terms and conditions any restrictions imposed on the use of their service in respect of information provided by recipients, including any policies, procedures, measures and tools used for content moderation, covering algorithmic decision-making and human review, as well as the rules of procedure of their internal complaint handling system. This must be in clear, plain, intelligible, user-friendly and unambiguous language and be publicly available in an easily accessible and machine-readable format. Recipients must be informed of significant changes. Where a service is primarily directed at minors or predominantly used by them, the conditions and restrictions must be explained in a way minors can understand. Providers must act in a diligent, objective and proportionate manner when applying and enforcing those restrictions, with due regard to the rights and legitimate interests of all parties involved, including fundamental rights such as freedom of expression and media freedom and pluralism under the Charter.

Applies when

Chinese companies operating AI content platforms or communities in the EU. The practical point is that AI safety filtering and automated bans are algorithmic content moderation: the decision logic, appeal route and human review arrangements must appear in the terms and cannot remain an undisclosed internal policy.

Applies from: 2024-02-17

Evidence to retain

• · Terms and conditions text including the content moderation section and the machine-readable version
• · Description of algorithmic moderation policies and the human review process
• · Records of notifying recipients of significant changes
• · Minor-friendly simplified version where applicable

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

Providers of hosting services must put in place mechanisms allowing any individual or entity to notify them of the presence on their service of specific items of information that the notifier considers to be illegal content. The mechanisms must be easy to access and user-friendly, allow submission exclusively by electronic means, and facilitate the submission of sufficiently precise and adequately substantiated notices, for which the provider must take the measures necessary to enable notices to contain all the elements listed in Art. 16(2).

Applies when

Chinese companies hosting user-generated content in the EU, including AI-generated content published publicly. For generative products the typical trigger is a public gallery or community where users can publish generated images, video or text.

Applies from: 2024-02-17

Evidence to retain

• · Product implementation and accessibility evidence for the notice-and-action entry point
• · Notice handling SOP and turnaround statistics
• · Sample statements of reasons for decisions taken

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

Providers of online platforms using recommender systems must set out in their terms and conditions, in plain and intelligible language, the main parameters used in those systems and any options available to recipients to modify or influence them. The main parameters must explain why certain information is suggested and must include at least the criteria most significant in determining what is suggested and the reasons for their relative importance. Where several options are available for recommender systems determining the relative order of information, the provider must also make available a functionality allowing the recipient to select and modify their preferred option at any time, directly and easily accessible from the specific section of the online interface where the information is being prioritised.

Applies when

Chinese companies operating AI content platforms with personalised recommendation in the EU. The direction is similar to the opt-out requirement in China’s Provisions on the Administration of Algorithmic Recommendations, but the wording differs and domestic copy cannot simply be reused.

Applies from: 2024-02-17

Evidence to retain

• · Text describing the main recommender parameters within the terms and conditions
• · Screenshots of the parameter-adjustment functionality and its access path
• · Internal reconciliation showing the description matches the actual ranking logic

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

Providers of online platforms presenting advertisements on their online interfaces must ensure that, for each advertisement presented to each individual recipient, the recipient can identify in a clear, concise, unambiguous manner and in real time: that the information is an advertisement, including through prominent markings; the natural or legal person on whose behalf it is presented; the person who paid for it where different; and meaningful information, directly and easily accessible from the advertisement, about the main parameters used to determine the recipient to whom it is presented and, where applicable, how to change them. Providers must also give recipients a functionality to declare whether the content they provide is or contains commercial communications. In addition, providers of online platforms accessible to minors must put in place appropriate and proportionate measures to ensure a high level of privacy, safety and security of minors on their service, and must not present advertisements based on profiling as defined in GDPR Art. 4(4) to minors.

Applies when

Chinese companies operating AI platforms in the EU with advertising monetisation or third-party promotion. Where the product is accessible to minors — and it is accessible unless an effective age gate exists — profiling-based advertising must be switched off as a whole, not only for accounts known to be minors.

Applies from: 2024-02-17

Evidence to retain

• · Interface screenshots of ad markings and targeting-parameter disclosure
• · Process description for collecting and displaying advertiser and payer information
• · Inventory of minor-protection measures and description of the age assurance mechanism
• · Technical evidence that profiling-based advertising is disabled for minors

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

Providers of intermediary services must publish, at least once a year and in a machine-readable and easily accessible format, clear and easily comprehensible reports on their content moderation, covering among other things the number of orders received from Member State authorities categorised by type of illegal content and issuing Member State, as listed in Art. 15. Providers of online platforms must add the Art. 24(1) information: the number of disputes submitted to out-of-court dispute settlement bodies, their outcomes, the median time to complete them and the share of disputes where the platform implemented the body’s decision, and the number of suspensions under Art. 23 distinguishing manifestly illegal content, manifestly unfounded notices and manifestly unfounded complaints. Providers of online platforms and online search engines must also publish, at least every six months, in a publicly available section of their online interface, the average monthly active recipients of the service in the Union calculated over the past six months.

Applies when

Chinese companies operating hosting or platform services in the EU. Publishing monthly active recipients also has a strategic implication: platforms reaching the EU threshold of 45 million average monthly active recipients can be designated as very large online platforms, triggering the heavier Arts. 34 and 35 systemic risk assessment and mitigation duties and independent audits.

Deadline: Transparency reports at least annually; monthly active recipients published at least every six months.

Applies from: 2024-02-17

Evidence to retain

• · Annual content moderation transparency report in machine-readable form, with the published link
• · Methodology for calculating monthly active recipients and the half-yearly publication records
• · Auditable retention of the metric definitions and underlying data

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

Providers of very large online platforms and very large online search engines must diligently identify, analyse and assess any systemic risks in the Union stemming from the design or functioning of their service and its related systems, including algorithmic systems, or from the use made of their services. The assessment must be carried out by the date of application referred to in the second subparagraph of Art. 33(6), at least annually thereafter, and in any event before deploying functionalities likely to have a critical impact on the identified risks. It must cover the dissemination of illegal content; actual or foreseeable negative effects on fundamental rights; negative effects on civic discourse, electoral processes and public security; and risks relating to gender-based violence, public health, the protection of minors and serious negative consequences for a person’s physical and mental well-being. It must take particular account of how the design of recommender systems and other algorithmic systems, content moderation systems, terms and conditions and their enforcement, advertising selection and presentation systems, and the provider’s data-related practices influence those risks, and must analyse whether and how the risks are influenced by intentional manipulation, including inauthentic use or automated exploitation, and by amplification and rapid wide dissemination of illegal content and content incompatible with the terms. Supporting documents must be preserved for at least three years after the assessment and communicated on request to the Commission and the Digital Services Coordinator of establishment. Art. 35 then requires reasonable, proportionate and effective mitigation measures, expressly including testing and adapting the provider’s algorithmic systems, including recommender systems.

Applies when

Applies only to entities designated by the Commission as very large online platforms or very large online search engines. For Chinese companies this is a scale-triggered duty: it does not apply below the designation threshold, but growth planning should treat that threshold as a defined compliance inflection point and prepare the auditability of algorithmic systems in advance.

Deadline: First assessment by the date of application in the second subparagraph of Art. 33(6), then at least annually, with a further assessment before deploying critical new functionalities.

Applies from: 2024-02-17

Evidence to retain

• · Annual systemic risk assessment report including the analysis of algorithmic systems
• · Pre-launch risk impact assessments for new functionalities
• · Inventory of mitigation measures and records of testing and adapting algorithmic systems
• · Three-year retention arrangement for the assessment supporting documents

Estimated first-time effort: 40–120 person-days (estimate, not a commitment)