Reuses other publishers' content, in the European Union

Directive 96/9/EC, Arts. 7-10 · Read the law's page

• Do not extract or re-utilize the whole or a substantial part, evaluated qualitatively or quantitatively, of a database's contents without the maker's authorization, where the maker shows a substantial investment in obtaining, verifying, or presenting that content and is a national or habitual resident of a Member State, or a company or firm formed under a Member State's law with its registered office, central administration or principal place of business in the Community (Art. 11(1) and (2)). Under Art. 43 of Regulation (EU) 2023/2854 the right does not apply to data obtained from or generated by a connected product or related service within that Regulation's scope.
• Do not repeatedly and systematically extract or re-utilize insubstantial parts of a database's contents where doing so conflicts with the database's normal exploitation or unreasonably prejudices the maker's legitimate interests, even where no single extraction takes a substantial part.
• Where lawfully accessing a database the maker has made available to the public, extracting or re-utilizing insubstantial parts for any purpose does not need the maker's authorization, but stop short of conflicting with the database's normal exploitation or unreasonably prejudicing the maker's interests; where you are authorized to extract or re-utilize only part of the database, this applies only to that part (Art. 8(1)).
• Treat the sui generis right as expiring fifteen years from 1 January of the year following the database's completion or, where the database was made available to the public before that period expired, fifteen years from 1 January of the year following the date it was first made available to the public (Art. 10(1) and (2)), and expect a substantial new investment in its contents to start a new term for the resulting database (Art. 10(3)).

Directive 2001/29/EC of the European Parliament and of the Council of 22 May 2001, OJ L 167, 22.6.2001, pp. 10-19 · Read the law's page

• This Directive is addressed to member states, which implement it in national law; it harmonises the reproduction right (Art. 2) and the right of communication to the public (Art. 3), the baseline under which news snippets and cached copies are assessed.
• The temporary-copies exception (Art. 5(1)) is mandatory for member states, while the exception for reproduction by the press of published articles on current economic, political or religious topics where such use is not expressly reserved (Art. 5(3)(c)) and the quotation exception (Art. 5(3)(d)) are optional; each applies only in certain special cases that do not conflict with a normal exploitation of the work or unreasonably prejudice the legitimate interests of the rightholder (Art. 5(5)), so a news aggregator reproducing a short extract relies on the rightholder's authorisation or one of the listed exceptions.

Directive 2001/29/EC, Arts. 6-7 · Read the law's page

• Do not circumvent an effective technological measure, as Article 6(3) defines the term, where you know, or have reasonable grounds to know, that circumventing it is what you are doing (Art. 6(1)).
• Do not manufacture, import, distribute, sell, rent, advertise for sale or rental, or possess for commercial purposes a device, product or component, or provide a service, that is promoted for circumvention, has only a limited commercially significant purpose or use other than circumvention, or is primarily designed to enable or facilitate it (Art. 6(2)).
• Do not knowingly and without authority remove or alter electronic rights-management information, as Article 7(2) defines the term (Art. 7(1)(a)).
• Do not knowingly and without authority distribute, import for distribution, broadcast, communicate or make available to the public a work from which electronic rights-management information has been removed or altered without authority, if you know or have reasonable grounds to know that doing so induces, enables, facilitates or conceals an infringement (Art. 7(1)(b)).

Directive 2009/24/EC, OJ L 111, 5.5.2009, p. 16 · Read the law's page

• This Directive is addressed to the Member States, which implement it in national law, so an app meets these rules through that law (Art. 12).
• Treat a computer program as protected by copyright as a literary work, in the expression of the program in any form but not in the ideas and principles that underlie any element of it, including those that underlie its interfaces (Art. 1(1) and (2)).
• Get the rightholder's authorisation before permanently or temporarily reproducing a computer program, in part or in whole, including where loading, displaying, running, transmission or storage of it necessitates the reproduction (Art. 4(1)(a)).
• Get the rightholder's authorisation before translating, adapting, arranging or otherwise altering a computer program or reproducing the result, or before distributing the program or copies of it to the public, including by rental (Art. 4(1)(b) and (c)).
• After a first sale of a copy in the Community by the rightholder or with his consent, you need no further authorisation to distribute that copy within the Community, except to rent it (Art. 4(2)).
• A lawful acquirer may, in the absence of specific contractual provisions, do the acts in Art. 4(1)(a) and (b) without authorisation where they are necessary to use the program in accordance with its intended purpose, including for error correction (Art. 5(1)).
• A person with a right to use the program may make a back-up copy as far as necessary for that use, and a contract may not prevent it (Art. 5(2)).
• A person with a right to use a copy may observe, study or test the functioning of the program, to determine the ideas and principles underlying any element of it, while performing the acts of loading, displaying, running, transmitting or storing the program that he is entitled to do (Art. 5(3)).
• Decompile only as Art. 6 allows: reproduction of the code and translation of its form need no authorisation only where indispensable to obtain the information necessary for the interoperability of an independently created program, are done by a licensee or another person with a right to use a copy (or on their behalf), the information was not previously readily available to them, and the acts are confined to the parts of the original program necessary for interoperability (Art. 6(1)).
• Do not use information obtained under Art. 6(1) for goals other than the interoperability of the independently created program, give it to others except when necessary for that interoperability, or use it to develop, produce or market a program substantially similar in expression or for any other act that infringes copyright: Art. 6(1) does not permit those uses (Art. 6(2)).
• A contractual term contrary to Art. 6 or to Art. 5(2) or (3) is null and void (Art. 8).

Case C-5/08, judgment of 16 July 2009

• Treat an 11-word extract of a newspaper article as capable of infringing: the Court of Justice held that storing and printing it out during data capture can be a reproduction in part under Art. 2 of the InfoSoc Directive if the elements reproduced express their author's intellectual creation, a question for the national court.
• Obtain the rightholders' consent before running a media-monitoring process that prints out such extracts: the Court held that printing out the extract did not satisfy the transient-copy condition of Art. 5(1).

Case C-299/17, judgment of 12 September 2019

• This is a court's reading: the Court of Justice held that Germany's 2013 press publishers' right (sections 87f-87h of the German Copyright Act, UrhG) was a 'technical regulation' under Article 1(11) of Directive 98/34/EC, so its draft had to be notified to the European Commission.
• The right at issue barred only commercial search engine operators and similar commercial services from making newspapers or magazines available to the public, and excluded individual words and very short text excerpts.
• The Court recalled its settled case law that the inapplicability of a technical regulation that was not notified may be relied upon in proceedings between individuals.

Directive 2010/13/EU, as amended by Directive (EU) 2018/1808, Article 7b · Read the law's page

• This Directive is addressed to the Member States (Article 4 of Directive (EU) 2018/1808), which had to bring into force the measures necessary to comply with it by 19 September 2020 (Article 2(1) of that Directive), so an app meets these rules through national implementing laws.
• Do not overlay an audiovisual media service provided by a media service provider for commercial purposes, or modify it, without that provider's explicit consent: Member States must take appropriate and proportionate measures to ensure that such services are not overlaid for commercial purposes or modified without it (Article 7b).
• An audiovisual media service is either a service within Articles 56 and 57 of the Treaty on the Functioning of the European Union whose principal purpose, or that of a dissociable section of it, is devoted to providing programmes, under the editorial responsibility of a media service provider, to the general public in order to inform, entertain or educate by means of electronic communications networks within the meaning of point (a) of Article 2 of Directive 2002/21/EC, or an audiovisual commercial communication; a media service provider is the natural or legal person who has editorial responsibility for the choice of the audiovisual content and determines the manner in which it is organized (Article 1(1)(a) and (d)).
• The exceptions are set by national law: Member States must specify the regulatory details, including exceptions, notably in relation to safeguarding the legitimate interests of users while taking into account the legitimate interests of the media service providers that originally provided the audiovisual media services (Article 7b).

Case C-392/19, judgment of 9 March 2021

• Treat embedding by framing as a communication to the public under Art. 3(1) of the InfoSoc Directive where it circumvents measures the rightholder adopted or imposed against framing: the Court of Justice so held for a work the rightholder had made freely accessible, with authorisation, on another website.
• A rightholder cannot limit its consent to framing by means other than effective technological measures within the meaning of Art. 6 of the Directive, on the Court's reading.
• The case concerned thumbnail images of works shown on a digital library's website, not news text.

Directive (EU) 2019/790 of the European Parliament and of the Council of 17 April 2019, OJ L 130, 17.5.2019, pp. 92-119 · Read the law's page

• This Directive is addressed to the Member States (Art. 32), which had to bring into force the measures necessary to comply with it by 7 June 2021 (Art. 29(1)), so an app meets these rules through national implementing laws.
• If you are an information society service provider that reuses press publications online, such as a news aggregator or media monitoring service, expect to need a licence from the press publisher for uses within the reproduction and making-available rights that Art. 15(1) gives it, which are the rights in Art. 2 and Art. 3(2) of Directive 2001/29/EC.
• You need no press publisher's authorisation for acts of hyperlinking, for the use of individual words or very short extracts of a press publication, or for private or non-commercial uses by individual users (Art. 15(1)); the Directive does not define very short extracts, and recital 58 says the exclusion is to be interpreted so as not to affect the effectiveness of the rights.
• Before text and data mining works under the Art. 4 exception (for purposes beyond scientific research), confirm that you access them lawfully and that the rightholder has not expressly reserved the use in an appropriate manner, such as machine-readable means for content made publicly available online (Art. 4(1) and (3)); where no exception applies, an authorisation from the rightholder is required (recital 8).

Regulation (EU) 2022/2065, Article 43 · Read the law's page

• If the Commission designates your online platform or online search engine as a very large online platform or very large online search engine under Article 33(4), the Commission charges you the annual supervisory fee below upon your designation (Article 43(1)).
• Pay the annual supervisory fee the Commission charges you for each service for which you have been designated, in the amount the Commission establishes by implementing act and under the detailed payment arrangements laid down in the delegated act on the methodology and procedures for the fees.

Regulation (EU) 2022/2065, Arts. 24(2), 24(3) · Read the law's page

• If you provide an online platform or an online search engine, publish for each of them, in a publicly available section of your online interface and at least once every six months, information on the average monthly active recipients of the service in the Union, calculated as an average over the past six months and in accordance with the methodology in the delegated acts referred to in Article 33(3) where those acts have been adopted. Article 24(2) sets 17 February 2023 as the date for the first publication.
• When the Digital Services Coordinator of establishment or the Commission asks, communicate to it without undue delay the information on average monthly active recipients, updated to the moment of the request, and provide any additional information it requires on the calculation, including explanations and substantiation of the data used. Do not include personal data in that information.
• If you provide an online platform and qualify as a micro or small enterprise as defined in Recommendation 2003/361/EC, Article 24(2) does not apply to you but Article 24(3) does, and the exclusion continues for 12 months after you lose that status unless you are a very large online platform. Article 19 speaks only of providers of online platforms, while Article 24(2) and (3) also name providers of online search engines.

Regulation (EU) 2022/2065, Article 37, supplemented by Commission Delegated Regulation (EU) 2024/436 · Read the law's page

• If you are a Commission-designated very large online platform or very large online search engine, commission an independent audit, at your own expense and at least once a year, of your compliance with Chapter III's due diligence obligations, including the systemic-risk mitigation measures for generated and manipulated content, and with any codes of conduct or crisis protocols you have joined.
• Select an auditing organisation that is independent of you and free of conflicts of interest: it must not have supplied you or a legal person connected to you non-audit services related to the matters audited in the twelve months before the audit began, must have committed not to supply them in the twelve months after it is completed, must not have audited you for more than ten consecutive years, and must not be paid on a result-contingent basis.
• Cooperate with the auditing organisation: give it access to the data, premises, and personnel it needs, and do not hamper, unduly influence, or undermine the audit.
• Where the audit report is not positive, adopt an audit implementation report within one month of receiving the operational recommendations, describing the measures you took, or explaining why you did not and what you did instead (Article 37(6)).
• Transmit the audit report and the audit implementation report to your Digital Services Coordinator of establishment and the Commission without undue delay, and make them public, with confidential information removed where necessary, within three months of receiving the audit report.

Regulation (EU) 2022/2065, Arts. 34-36 · Read the law's page

• If the Commission designates your online platform or online search engine as a very large online platform or very large online search engine under Article 33(4), the duties below apply to you from four months after it notifies you of the decision (Article 33(6)).
• Diligently identify, analyse and assess any systemic risks in the Union stemming from the design or functioning of your service and its related systems, including algorithmic systems, or from the use made of your services. Carry out the assessment by the date from which the obligations apply to you, at least once every year thereafter, and in any event before deploying functionalities that are likely to have a critical impact on the risks identified.
• Make the assessment specific to your services and proportionate to the systemic risks, taking into consideration their severity and probability. Include the dissemination of illegal content through your services; any actual or foreseeable negative effects for the exercise of fundamental rights; any actual or foreseeable negative effects on civic discourse and electoral processes, and public security; and any actual or foreseeable negative effects in relation to gender-based violence, the protection of public health and minors and serious negative consequences to a person's physical and mental well-being.
• Take into account, in particular, whether and how the design of your recommender systems and any other relevant algorithmic system, your content moderation systems, your applicable terms and conditions and their enforcement, your systems for selecting and presenting advertisements, and your data related practices influence those risks. Also analyse whether and how intentional manipulation of your service, including inauthentic use or automated exploitation, and the amplification and potentially rapid and wide dissemination of illegal content and of information incompatible with your terms and conditions, influence them, taking into account specific regional or linguistic aspects.
• Preserve the supporting documents of each risk assessment for at least three years after it is performed and, upon request, communicate them to the Commission and to the Digital Services Coordinator of establishment.
• Put in place reasonable, proportionate and effective mitigation measures, tailored to the specific systemic risks identified under Article 34, with particular consideration to the impacts of such measures on fundamental rights. The measures may include adapting the design, features or functioning of your services, your terms and conditions and their enforcement, your content moderation processes, your algorithmic, recommender and advertising systems and your internal processes; cooperating with trusted flaggers and implementing the decisions of out-of-court dispute settlement bodies; cooperating with other providers through the codes of conduct and the crisis protocols; awareness-raising measures; and targeted measures to protect the rights of the child, including age verification and parental control tools.
• If the Commission adopts a crisis decision under Article 36 addressed to you, assess whether and to what extent the functioning and use of your services significantly contribute to the serious threat, identify and apply specific, effective and proportionate measures to prevent, eliminate or limit that contribution, and report to the Commission by the date or at the regular intervals the decision specifies.

Regulation (EU) 2022/2065, Arts. 40-42 · Read the law's page

• If the Commission designates your online platform or online search engine as a very large online platform or very large online search engine under Article 33(4), the duties below apply to you from four months after it notifies you of the decision (Article 33(6)).
• Give the Digital Services Coordinator of establishment or the Commission, at their reasoned request and within a reasonable period specified in the request, access to data that are necessary to monitor and assess your compliance with the Regulation. At the request of either, explain the design, logic, functioning and testing of your algorithmic systems, including your recommender systems.
• On a reasoned request from the Digital Services Coordinator of establishment, give vetted researchers access to data within a reasonable period specified in the request, for the sole purpose of research that contributes to the detection, identification and understanding of systemic risks in the Union under Article 34(1) and to the assessment of the adequacy, efficiency and impacts of your risk mitigation measures under Article 35. If you cannot give access because you do not have the data or because access would lead to significant vulnerabilities in the security of your service or the protection of confidential information, in particular trade secrets, ask the Digital Services Coordinator within 15 days of receiving the request to amend it, with proposals for alternative means of access.
• Facilitate and provide access to data under Article 40(1) and (4) through the appropriate interfaces specified in the request, including online databases or application programming interfaces.
• Give access without undue delay to data, including, where technically possible, real-time data, provided that the data is publicly accessible in your online interface, to researchers, including those affiliated to not for profit bodies, organisations and associations, who comply with the conditions in Article 40(8), points (b), (c), (d) and (e), and who use the data solely for research that contributes to the detection, identification and understanding of systemic risks in the Union under Article 34(1).
• Establish a compliance function that is independent from your operational functions and composed of one or more compliance officers, including a head of the compliance function, with sufficient authority, stature and resources and access to your management body. The head must be an independent senior manager with distinct responsibility for the compliance function, report directly to the management body and not be removed without its prior approval, and the management body must ensure that compliance officers have the professional qualifications, knowledge, experience and ability needed for their tasks.
• Give your compliance officers the tasks listed in Article 41(3): cooperating with the Digital Services Coordinator of establishment and the Commission; ensuring that all risks referred to in Article 34 are identified and properly reported on and that risk-mitigation measures are taken under Article 35; organising and supervising your activities relating to the independent audit under Article 37; informing and advising management and employees about relevant obligations; monitoring your compliance with the Regulation; and, where applicable, monitoring compliance with commitments made under the codes of conduct and the crisis protocols.
• Communicate the name and contact details of the head of the compliance function to the Digital Services Coordinator of establishment and to the Commission.
• Have your management body define, oversee and be accountable for governance arrangements that ensure the independence of the compliance function, including the division of responsibilities, the prevention of conflicts of interest and the sound management of the systemic risks identified under Article 34; approve and review, at least once a year, the strategies and policies for managing, monitoring and mitigating those risks; devote sufficient time to risk management decisions; and ensure that adequate resources are allocated to managing those risks.
• Publish the reports referred to in Article 15 at the latest by two months from the date from which the obligations apply to you under Article 33(6), second subparagraph, and thereafter at least every six months. Include in them the information on the average monthly recipients of the service for each Member State, in addition to the information in Article 24(2).
• If you are a very large online platform, specify in those reports, in addition to the information required by Articles 15 and 24(1): the human resources you dedicate to content moderation in respect of the service offered in the Union, broken down by each applicable official language of the Member States, including for compliance with Articles 16, 20 and 22; the qualifications and linguistic expertise of the persons carrying out those activities and the training and support given to them; and the indicators of accuracy and related information referred to in Article 15(1), point (e), broken down by each official language of the Member States. Publish the reports in at least one of the official languages of the Member States.
• Transmit to the Digital Services Coordinator of establishment and the Commission, without undue delay upon completion, and make publicly available at the latest three months after the receipt of each audit report under Article 37(4): a report setting out the results of the risk assessment under Article 34; the specific mitigation measures put in place under Article 35(1); the audit report; the audit implementation report under Article 37(6); and, where applicable, information about the consultations conducted in support of the risk assessments and the design of the risk mitigation measures.
• Where publication might result in the disclosure of confidential information of yours or of the recipients of the service, cause significant vulnerabilities for the security of your service, undermine public security or harm recipients, you may remove such information from the publicly available reports. In that case, transmit the complete reports to the Digital Services Coordinator of establishment and the Commission with a statement of the reasons for removing the information.

Regulation (EU) 2022/2065, Arts. 11-15 · Read the law's page

• Designate a single point of contact for Member States' authorities, the Commission and the Board, so that they can communicate with you directly and by electronic means, and make public the information needed to identify and reach it. Keep that information easily accessible and up to date, and state the official languages of the Member States that can be used to communicate with it, in addition to a language broadly understood by the largest possible number of Union citizens. They must include at least one official language of the Member State of your main establishment or of the place where your legal representative resides or is established.
• Designate a single point of contact for the recipients of your service that lets them communicate with you directly and rapidly, by electronic means and in a user-friendly manner. Let recipients choose the means of communication, which must not rely solely on automated tools, and make public the information they need to identify and reach it, easily accessible and kept up to date.
• If you have no establishment in the Union but offer services in the Union, designate in writing a legal or natural person as your legal representative in one of the Member States where you offer your services. Mandate the representative to be addressed, in addition to or instead of you, by the competent authorities, the Commission and the Board on all issues necessary for the receipt of, compliance with and enforcement of decisions under the Regulation, and give it the necessary powers and sufficient resources.
• If you have no establishment in the Union, notify the name, postal address, email address and telephone number of your legal representative to the Digital Services Coordinator of the Member State where it resides or is established, and keep that information publicly available, easily accessible, accurate and up to date. Designating a legal representative does not make you established in the Union.
• Include in your terms and conditions information on any restrictions you impose on the use of your service in respect of information provided by recipients, including the policies, procedures, measures and tools you use for content moderation (algorithmic decision-making and human review) and the rules of procedure of your internal complaint handling system. Set it out in clear, plain, intelligible, user-friendly and unambiguous language, and make it publicly available in an easily accessible and machine-readable format.
• Inform recipients of the service of any significant change to your terms and conditions.
• If your service is primarily directed at minors or predominantly used by them, explain the conditions for, and any restrictions on, the use of the service in a way that minors can understand.
• Apply and enforce the restrictions in your terms and conditions in a diligent, objective and proportionate manner, with due regard to the rights and legitimate interests of all parties involved, including the fundamental rights of the recipients of the service, such as the freedom of expression and the freedom and pluralism of the media.
• If you are a very large online platform or very large online search engine, give recipients a concise, easily accessible and machine-readable summary of your terms and conditions, including the available remedies and redress mechanisms, in clear and unambiguous language, and publish your terms and conditions in the official languages of all the Member States in which you offer your services.
• Publish, at least once a year, in a machine-readable format and in an easily accessible manner, clear and easily comprehensible reports on any content moderation you engaged in during the relevant period.
• Include in each report, as applicable: the orders received from Member States' authorities, including orders under Articles 9 and 10, by type of illegal content and issuing Member State, with the median time to inform the authority and give effect; if you provide hosting, the notices submitted under Article 16 by type of alleged illegal content, those from trusted flaggers, the action taken and whether it rested on the law or your terms and conditions, the notices processed by automated means and the median time to act; meaningful information on content moderation at your own initiative, including automated tools and the training and assistance given to moderators; the complaints received through your internal complaint-handling systems, the decisions taken, the median time to decide and the instances where decisions were reversed; and any use of automated means for content moderation, with its purposes, indicators of accuracy, possible rate of error and safeguards.
• You are not required to publish the reports in Article 15(1) if you qualify as a micro or small enterprise as defined in Recommendation 2003/361/EC and are not a very large online platform.

Implementing Regulation (EU) 2024/2835 · Read the law's page

• Publish each transparency report you owe under Article 15, 24 or 42 of the Digital Services Act by filling in the quantitative and qualitative templates in Annex I, in their CSV or XLSX version, and publish one report for each service you offer (Article 1(1); Annex II, Part I). A report that omits one of the two templates, or parts of them, without a specific and objective reason is considered incomplete.
• Publish the filled-in templates as a CSV file that complies with RFC 4180 and uses UTF-8 encoding, reporting counting indicators as integers, percentage indicators as floating numbers in the interval from 0 to 1 and median times in hours (Annex II, Part I, point 4).
• Use the harmonized reporting periods in Article 2: if you are a provider of intermediary services, hosting services or online platforms, 1 January until 31 December; if you are a provider of a very large online platform or a very large online search engine, 1 January until 30 June and 1 July until 31 December. The transition period for aligning reporting timelines ends on 31 December 2025, and as of 1 January 2026 all providers follow these periods (Article 2(1) and (2); Annex II, Part I, point 3).
• Make each report publicly available at the latest two months after the end of its reporting period (Article 2(3)).
• Base your reports on the Annex I templates for content moderation from 1 July 2025 (Article 2(4)). If you are a provider of intermediary services, hosting services or online platforms, your first full annual cycle on the templates covers 1 January until 31 December 2026. If you are a provider of a very large online platform or a very large online search engine, your first cycle on the templates covers 1 July until 31 December 2025 (Annex II, Part I, point 3).
• Retain each transparency report for at least five years after its publication, and keep every published version publicly available throughout that period (Article 3). If you publish an updated version, mark it as an updated version of the earlier report, highlight the changes, describe the reasons and the methodology used to rectify the inaccuracies or errors, and state the date of the changes (Annex II, Part I, point 5).
• If you are a provider of a very large online platform, assess the linguistic expertise of your content moderators against the Common European Framework of Reference for Languages: sufficient linguistic expertise for content moderation is at least level B2 in the category Understanding (Annex II, Part I, point 6).
• You are not required to publish the Article 15(1) report if you are a micro or small enterprise and not a very large online platform (recital 2 records Article 15(2) of the Digital Services Act).

Regulation (EU) 2023/2854, Art. 43 · Read the law's page

• This Regulation is binding in its entirety and directly applicable in all Member States, and applies from 12 September 2025 (Article 50).
• Treat data obtained from or generated by a connected product or related service within the scope of the Regulation, in particular in relation to Articles 4 and 5, as outside the sui generis right of Article 7 of Directive 96/9/EC, which does not apply to such data (Article 43).

Delegated Regulation (EU) 2025/2050 · Read the law's page

• If the Commission has designated your online platform or online search engine as a very large online platform or very large online search engine under Article 33(4) of the Digital Services Act, you are a data provider and the duties below apply to you (Article 2(5)).
• Open an account on the DSA data access portal that the Commission hosts (Article 3(4)).
• Establish a dedicated point of contact to provide information and support on the data access process, and communicate it to the Commission as soon as possible (Article 6(1) and (2)).
• Make available and easily findable on your online interfaces the details of that point of contact, a link to the DSA data access portal, a DSA data catalogue describing the data assets that may be accessed for the purposes of Article 40(4) of the Digital Services Act together with their data structure and metadata, and suggested access modalities for the data in the catalogue that are adequate to the level of sensitivity of the different data assets (Article 6(4)).
• Keep the catalogue and the suggested access modalities regularly updated, in particular to reflect data related to your risk assessments under Article 34 and your audits under Article 37 of the Digital Services Act (Article 6(5)).
• Give vetted researchers access to the data requested by the date stated in the reasoned request, under the access modalities it sets, until the date on which it states that access ends (Article 10(1)).
• Notify the Digital Services Coordinator of establishment within three working days that access has been provided to the vetted researchers in accordance with the reasoned request, and within three working days that their access has been terminated (Article 15(1)).
• Give vetted researchers any additional information needed to access and understand the requested data, such as codebooks, changelogs and architectural documentation. Where providing it may result in a significant vulnerability of your services, notify the Digital Services Coordinator of establishment of that risk and, where possible, propose alternative information (Article 15(2)).
• Do not impose on vetted researchers data management requirements such as archiving, storage, refresh and deletion requirements, or limits on the use of standard analytical tools, that may hinder their research, unless the reasoned request explicitly mentions them. Where personal data are processed, impose no conditions on the processing of the shared personal data other than those the reasoned request specifies (Article 15(3) and (4)).
• If you request mediation after disagreeing with the decision of the Digital Services Coordinator of establishment on an amendment request, make the request in writing within five working days of the Coordinator's communication of that decision, and bear all costs of the mediation (Article 13(1) and (6)).

Directive (EU) 2024/2853 · Read the law's page

• The Directive does not apply to free and open-source software that you develop or supply outside the course of a commercial activity (Art. 2(2)).
• If you develop or produce software, or have it developed under your name or trademark, and make it available in the course of a commercial activity, you answer as its manufacturer for damage it causes by a defect (Arts. 4(1), 4(10) and 8(1)(a)).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control; a defect caused by their absence, or by software, updates or upgrades within your control, is not excused because it arose after you placed the product on the market (Art. 11(2)(b) and (c)).
• Meet the product safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in deciding whether it is defective (Art. 7(2)(f)), and failing a mandatory product safety requirement that protects against the damage suffered presumes it defective (Art. 10(2)(b)).
• Account for what your product learns or acquires after release: the effect of any ability to continue to learn or acquire new features after it is placed on the market is weighed in deciding whether it is defective (Art. 7(2)(c)).
• Keep technical documentation you could produce if a court orders disclosure; failing to disclose presumes the product defective (Arts. 9(1), 10(2)(a)).
• If you are outside the EU, the importer or your authorized representative answers for the product in your place (Art. 8(1)(c)).
• If you substantially modify a product outside its manufacturer's control and then make it available on the market or put it into service, you are treated as its manufacturer (Art. 8(2)).
• Do not count on a contract term to limit or exclude your liability to an injured person; Article 15 bars it.
• Be able to show when you placed the product on the market or put it into service: you are not liable if you prove you did not, or that the defect probably did not exist at that time (Art. 11(1)(a) and (c)).