Operates a social platform, in the European Union

Directive (EU) 2019/790, Arts. 17(1), 17(3), 17(4), 17(6) · Read the law's page

• This Directive is addressed to the Member States (Article 32), which had to bring into force the measures necessary to comply with it by 7 June 2021 (Article 29(1)), so a service meets these rules through national implementing laws.
• If you provide an online content-sharing service, meaning a service of which the main or one of the main purposes is to store and give the public access to a large amount of copyright-protected works or other protected subject matter uploaded by its users, which you organize and promote for profit-making purposes, obtain an authorization from the rightholders, for instance by concluding a licensing agreement, in order to communicate to the public or make available to the public the works or other subject matter, because giving the public access to what your users upload is itself an act of communication to the public or of making available to the public (Articles 2(6) and 17(1)). Not-for-profit online encyclopedias, not-for-profit educational and scientific repositories, open source software-developing and sharing platforms, providers of electronic communications services, online marketplaces, business-to-business cloud services and cloud services that allow users to upload content for their own use are not online content-sharing service providers (Article 2(6)).
• Do not rely on the limitation of liability in Article 14(1) of Directive 2000/31/EC, which Regulation (EU) 2022/2065 now carries in its Article 6, for the situations Article 17 covers; it does not apply to them, though it can still apply to you for purposes falling outside the scope of the Directive (Article 17(3)).
• If you have no authorization, you are liable for unauthorized acts of communication to the public, including making available to the public, of copyright-protected works and other subject matter, unless you demonstrate that you meet all of the conditions of Article 17(4); the first is that you made best efforts to obtain an authorization (Article 17(4)(a)).
• Demonstrate also that you made, in accordance with high industry standards of professional diligence, best efforts to ensure the unavailability of specific works and other subject matter for which the rightholders have provided you with the relevant and necessary information (Article 17(4)(b)).
• Demonstrate also, in any event, that you acted expeditiously, upon receiving a sufficiently substantiated notice from the rightholders, to disable access to, or to remove from your website, the notified works or other subject matter, and made best efforts to prevent their future uploads in accordance with point (b) of Article 17(4) (Article 17(4)(c)).
• If your service has been available to the public in the Union for less than three years and your annual turnover is below EUR 10 million, calculated in accordance with Commission Recommendation 2003/361/EC, the conditions in Article 17(4) are limited to best efforts to obtain an authorization and to acting expeditiously, upon receiving a sufficiently substantiated notice, to disable access to the notified works or other subject matter or to remove them from your website (Article 17(6)).
• If you are such a new service and your average number of monthly unique visitors, calculated on the basis of the previous calendar year, exceeds 5 million, also demonstrate that you made best efforts to prevent further uploads of the notified works and other subject matter for which the rightholders have provided relevant and necessary information (Article 17(6)).

Directive (EU) 2019/790, Arts. 17(8), 17(9) · Read the law's page

• This Directive is addressed to the Member States (Article 32), which had to bring into force the measures necessary to comply with it by 7 June 2021 (Article 29(1)), so a service meets these rules through national implementing laws.
• An online content-sharing service provider is a provider of an information society service of which the main or one of the main purposes is to store and give the public access to a large amount of copyright-protected works or other protected subject matter uploaded by its users, which it organizes and promotes for profit-making purposes. Not-for-profit online encyclopedias, not-for-profit educational and scientific repositories, open source software-developing and sharing platforms, providers of electronic communications services, online marketplaces, business-to-business cloud services and cloud services that allow users to upload content for their own use are not such providers (Article 2(6)).
• If you provide an online content-sharing service, give rightholders, at their request, adequate information on the functioning of your practices for the cooperation referred to in Article 17(4) and, where you have concluded licensing agreements with rightholders, information on the use of the content those agreements cover (Article 17(8)).
• Put in place an effective and expeditious complaint and redress mechanism available to your users in disputes over the disabling of access to, or the removal of, works or other subject matter they uploaded; process complaints without undue delay, and subject decisions to disable access to or remove uploaded content to human review (Article 17(9)).
• Inform your users in your terms and conditions that they can use works and other subject matter under exceptions or limitations to copyright and related rights provided for in Union law (Article 17(9)).
• Member States must ensure that out-of-court redress mechanisms are available for the settlement of disputes, and that users have access to a court or another relevant judicial authority to assert the use of an exception or limitation to copyright and related rights (Article 17(9)).

Regulation (EU) 2019/1020, Article 7(2) · Read the law's page

• It reaches you if you are an information society service provider (a provider of a service as defined in point (b) of Article 1(1) of Directive (EU) 2015/1535) and a product is or was offered for sale online through your services, as on an online marketplace: when a market surveillance authority asks you to, in a specific case, cooperate with it to facilitate any action to eliminate or, if that is not possible, to mitigate the risks the product presents.

Regulation (EU) 2021/784, Article 3 · Read the law's page

• If you are a hosting service provider offering services in the Union, a provider of services consisting of the storage of information provided by and at the request of a content provider, whatever your place of main establishment, and you disseminate information to the public, remove terrorist content or disable access to it in all Member States as soon as possible and in any event within one hour of receipt of a removal order issued by the competent authority of a Member State (Articles 1(2), 2(1) and 3(3)). Material disseminated to the public for educational, journalistic, artistic or research purposes, or for the purposes of preventing or countering terrorism, is not terrorist content (Article 1(3)).
• Without undue delay after you remove the terrorist content or disable access to it, inform the competent authority that issued the order, using the template set out in Annex II, and indicate the time of the removal or disabling (Article 3(6)).
• If you cannot comply with a removal order on grounds of force majeure or de facto impossibility not attributable to you, including for objectively justifiable technical or operational reasons, inform the competent authority that issued it of those grounds without undue delay, using the template set out in Annex III; the one-hour deadline starts to run once those grounds have ceased to exist (Article 3(7)).
• If you cannot comply with a removal order because it contains manifest errors or does not contain sufficient information for its execution, inform the competent authority that issued it without undue delay and request the necessary clarification, using the template set out in Annex III; the one-hour deadline starts to run once you have received the clarification (Article 3(8)).

Regulation (EU) 2021/784, Arts. 5-7, 10 · Read the law's page

• If you are a hosting service provider that the competent authority of the Member State of your main establishment (or where your legal representative resides or is established) has found, by a decision notified to you and based on objective factors such as two or more final removal orders in the previous 12 months, to be exposed to terrorist content, include provisions in your terms and conditions, where applicable, and apply them to address the misuse of your services for the dissemination to the public of terrorist content, in a diligent, proportionate and non-discriminatory manner (Articles 5(1) and 5(4)).
• Take specific measures to protect your services against the dissemination to the public of terrorist content; the choice of measures stays with you, and they must be effective in mitigating your exposure, targeted and proportionate, applied with full account of your users' rights and legitimate interests, and applied in a diligent and non-discriminatory manner (Articles 5(2) and 5(3)).
• Report to the competent authority on the specific measures you have taken and intend to take, within three months of receiving the decision and annually thereafter, until the authority decides on your request that you are no longer exposed to terrorist content (Articles 5(5) and 5(7)).
• If the competent authority finds that your specific measures do not comply with Article 5(2) and (3), take the necessary measures its decision requires; you may choose the type of specific measures (Article 5(6)).
• If you are a hosting service provider, preserve terrorist content you have removed, or access to which you have disabled, as a result of a removal order or of specific measures, together with the related data removed as a consequence, where they are necessary for administrative or judicial review proceedings, for complaint-handling under Article 10, or for the prevention, detection, investigation and prosecution of terrorist offences; keep them for six months from the removal or disabling, and for a further specified period on the request of the competent authority or a court only if and for as long as necessary for ongoing administrative or judicial review proceedings (Articles 6(1) and 6(2)).
• Keep the preserved terrorist content and related data under appropriate technical and organizational safeguards that ensure they are accessed and processed only for those purposes and that a high level of security of the personal data concerned is maintained, and review and update the safeguards where necessary (Article 6(3)).
• Set out clearly in your terms and conditions your policy for addressing the dissemination of terrorist content, including, where appropriate, a meaningful explanation of the functioning of specific measures and, where applicable, the use of automated tools (Article 7(1)).
• If you took action to address the dissemination of terrorist content, or were required to take action under the Regulation, in a calendar year, make a transparency report on those actions publicly available before 1 March of the following year, covering at least your measures to identify and remove or disable terrorist content and to address its reappearance, the number of items removed or disabled following removal orders or specific measures, the number and outcome of complaints and of review proceedings you brought, and the cases in which you were required to reinstate, or reinstated, content or access (Article 7(2) and (3)).
• Establish an effective and accessible mechanism that allows content providers whose content you removed, or access to which you disabled, as a result of specific measures under Article 5 to submit a complaint requesting the reinstatement of the content or of access (Article 10(1)).
• Examine every complaint expeditiously and reinstate the content or access without undue delay where the removal or disabling was unjustified; inform the complainant of the outcome within two weeks of receipt and give the reasons where you reject the complaint (Article 10(2)).

Regulation (EU) 2022/2065, Article 43 · Read the law's page

• If the Commission designates your online platform or online search engine as a very large online platform or very large online search engine under Article 33(4), the Commission charges you the annual supervisory fee below upon your designation (Article 43(1)).
• Pay the annual supervisory fee the Commission charges you for each service for which you have been designated, in the amount the Commission establishes by implementing act and under the detailed payment arrangements laid down in the delegated act on the methodology and procedures for the fees.

Regulation (EU) 2022/2065, Arts. 24(2), 24(3) · Read the law's page

• If you provide an online platform or an online search engine, publish for each of them, in a publicly available section of your online interface and at least once every six months, information on the average monthly active recipients of the service in the Union, calculated as an average over the past six months and in accordance with the methodology in the delegated acts referred to in Article 33(3) where those acts have been adopted. Article 24(2) sets 17 February 2023 as the date for the first publication.
• When the Digital Services Coordinator of establishment or the Commission asks, communicate to it without undue delay the information on average monthly active recipients, updated to the moment of the request, and provide any additional information it requires on the calculation, including explanations and substantiation of the data used. Do not include personal data in that information.
• If you provide an online platform and qualify as a micro or small enterprise as defined in Recommendation 2003/361/EC, Article 24(2) does not apply to you but Article 24(3) does, and the exclusion continues for 12 months after you lose that status unless you are a very large online platform. Article 19 speaks only of providers of online platforms, while Article 24(2) and (3) also name providers of online search engines.

Regulation (EU) 2022/2065, Arts. 33, 38, 39 · Read the law's page

• If the Commission designates your online platform or online search engine as a very large online platform or very large online search engine under Article 33(4), apply the obligations of the Section from four months after it notifies you of the decision. They cease to apply from four months after it notifies you that it has terminated the designation.
• If you use recommender systems, provide at least one option for each of them that is not based on profiling as defined in Article 4, point (4), of Regulation (EU) 2016/679, in addition to the requirements of Article 27.
• If you present advertisements on your online interfaces, compile and make publicly available in a specific section of your online interface a repository of advertisement information, through a searchable and reliable tool that allows multicriteria queries and through application programming interfaces. Keep each advertisement in it for the entire period during which you present the advertisement and until one year after you presented it for the last time.
• Keep the repository free of any personal data of the recipients of the service to whom the advertisement was or could have been presented, and make reasonable efforts to ensure that the information is accurate and complete.
• Include in the repository at least: the content of the advertisement, including the name of the product, service or brand and its subject matter; the person on whose behalf it is presented; the person who paid for it, if different; the period during which it was presented; whether it was intended for particular groups of recipients and, if so, the main parameters used to target or exclude them; the commercial communications identified under Article 26(2); and the total number of recipients reached and, where applicable, aggregate numbers by Member State for the targeted groups.
• Where you have removed or disabled access to a specific advertisement as allegedly illegal or incompatible with your terms and conditions, leave out of the repository the content of the advertisement, the person on whose behalf it is presented and the person who paid for it, and include instead the information in Article 17(3), points (a) to (e), or Article 9(2), point (a)(i), as applicable.

Regulation (EU) 2022/1925 · Read the law's page

• If you provide a core platform service and meet the thresholds in Article 3(2), notify the Commission without delay and in any event within 2 months after the thresholds are met, with the information identified in Article 3(2) for each core platform service that meets them (Article 3(3)).
• If the Commission designates you as a gatekeeper, comply with Articles 5, 6 and 7 for each core platform service listed in the designation decision within 6 months after it is listed, and ensure and demonstrate compliance with them (Article 3(10) and Article 8(1)).
• Do not combine or cross-use the personal data of end users across your core platform services or other services, or sign end users in to other services to combine it, unless the end user has been presented with the specific choice and has given consent within the meaning of Regulation (EU) 2016/679, and do not repeat a refused consent request for the same purpose more than once within one year (Article 5(2)).
• Do not prevent business users from offering the same products or services at different prices or conditions through other channels, and do not require end users or business users to use, offer or interoperate with your identification service, web browser engine or payment service (Article 5(3) and (7)).
• Allow and technically enable end users to easily un-install software applications on your operating system and to easily change the default settings of your operating system, virtual assistant and web browser, and allow and technically enable the installation and effective use of third-party software applications and software application stores that use or interoperate with your operating system (Article 6(3) and (4)).
• Do not treat your own services and products more favorably in ranking and related indexing and crawling than similar services or products of a third party, and apply transparent, fair and non-discriminatory conditions to the ranking (Article 6(5)).
• Give providers of services and of hardware, free of charge, effective interoperability with the same hardware and software features accessed or controlled via your operating system or virtual assistant that are available to your own services or hardware (Article 6(7)).
• Give end users effective portability of the data they provide or generate in using your core platform service, with free tools and continuous real-time access, and give business users, at their request and free of charge, effective, high-quality, continuous and real-time access to the data generated in the use of your core platform services (Article 6(9) and (10)).
• Apply fair, reasonable and non-discriminatory general conditions of access for business users to your software application stores, online search engines and online social networking services, and publish those conditions with an alternative dispute settlement mechanism (Article 6(12)).
• If you provide a number-independent interpersonal communications service listed in the designation decision, make its basic functionalities interoperable, on request and free of charge, with the services of another provider offering or intending to offer such services in the Union, preserve the level of security including end-to-end encryption, and publish a reference offer with the technical details and general terms and conditions (Article 7).
• Provide the Commission, within 6 months after designation and at least annually after that, with a report on the measures you have implemented to comply with Articles 5, 6 and 7, and publish a non-confidential summary of it (Article 11).
• Inform the Commission of any intended concentration where the merging entities or the target provide core platform services or other services in the digital sector or enable the collection of data, before the concentration is implemented, whether or not it is notifiable under merger rules (Article 14).
• Submit to the Commission, within 6 months after designation, an independently audited description of the techniques you apply for profiling of consumers, and publish an overview of it, updated at least annually (Article 15).

Regulation (EU) 2022/2065, Article 37, supplemented by Commission Delegated Regulation (EU) 2024/436 · Read the law's page

• If you are a Commission-designated very large online platform or very large online search engine, commission an independent audit, at your own expense and at least once a year, of your compliance with Chapter III's due diligence obligations, including the systemic-risk mitigation measures for generated and manipulated content, and with any codes of conduct or crisis protocols you have joined.
• Select an auditing organisation that is independent of you and free of conflicts of interest: it must not have supplied you or a legal person connected to you non-audit services related to the matters audited in the twelve months before the audit began, must have committed not to supply them in the twelve months after it is completed, must not have audited you for more than ten consecutive years, and must not be paid on a result-contingent basis.
• Cooperate with the auditing organisation: give it access to the data, premises, and personnel it needs, and do not hamper, unduly influence, or undermine the audit.
• Where the audit report is not positive, adopt an audit implementation report within one month of receiving the operational recommendations, describing the measures you took, or explaining why you did not and what you did instead (Article 37(6)).
• Transmit the audit report and the audit implementation report to your Digital Services Coordinator of establishment and the Commission without undue delay, and make them public, with confidential information removed where necessary, within three months of receiving the audit report.

Regulation (EU) 2022/2065, Arts. 34-36 · Read the law's page

• If the Commission designates your online platform or online search engine as a very large online platform or very large online search engine under Article 33(4), the duties below apply to you from four months after it notifies you of the decision (Article 33(6)).
• Diligently identify, analyse and assess any systemic risks in the Union stemming from the design or functioning of your service and its related systems, including algorithmic systems, or from the use made of your services. Carry out the assessment by the date from which the obligations apply to you, at least once every year thereafter, and in any event before deploying functionalities that are likely to have a critical impact on the risks identified.
• Make the assessment specific to your services and proportionate to the systemic risks, taking into consideration their severity and probability. Include the dissemination of illegal content through your services; any actual or foreseeable negative effects for the exercise of fundamental rights; any actual or foreseeable negative effects on civic discourse and electoral processes, and public security; and any actual or foreseeable negative effects in relation to gender-based violence, the protection of public health and minors and serious negative consequences to a person's physical and mental well-being.
• Take into account, in particular, whether and how the design of your recommender systems and any other relevant algorithmic system, your content moderation systems, your applicable terms and conditions and their enforcement, your systems for selecting and presenting advertisements, and your data related practices influence those risks. Also analyse whether and how intentional manipulation of your service, including inauthentic use or automated exploitation, and the amplification and potentially rapid and wide dissemination of illegal content and of information incompatible with your terms and conditions, influence them, taking into account specific regional or linguistic aspects.
• Preserve the supporting documents of each risk assessment for at least three years after it is performed and, upon request, communicate them to the Commission and to the Digital Services Coordinator of establishment.
• Put in place reasonable, proportionate and effective mitigation measures, tailored to the specific systemic risks identified under Article 34, with particular consideration to the impacts of such measures on fundamental rights. The measures may include adapting the design, features or functioning of your services, your terms and conditions and their enforcement, your content moderation processes, your algorithmic, recommender and advertising systems and your internal processes; cooperating with trusted flaggers and implementing the decisions of out-of-court dispute settlement bodies; cooperating with other providers through the codes of conduct and the crisis protocols; awareness-raising measures; and targeted measures to protect the rights of the child, including age verification and parental control tools.
• If the Commission adopts a crisis decision under Article 36 addressed to you, assess whether and to what extent the functioning and use of your services significantly contribute to the serious threat, identify and apply specific, effective and proportionate measures to prevent, eliminate or limit that contribution, and report to the Commission by the date or at the regular intervals the decision specifies.

Regulation (EU) 2022/2065, Arts. 40-42 · Read the law's page

• If the Commission designates your online platform or online search engine as a very large online platform or very large online search engine under Article 33(4), the duties below apply to you from four months after it notifies you of the decision (Article 33(6)).
• Give the Digital Services Coordinator of establishment or the Commission, at their reasoned request and within a reasonable period specified in the request, access to data that are necessary to monitor and assess your compliance with the Regulation. At the request of either, explain the design, logic, functioning and testing of your algorithmic systems, including your recommender systems.
• On a reasoned request from the Digital Services Coordinator of establishment, give vetted researchers access to data within a reasonable period specified in the request, for the sole purpose of research that contributes to the detection, identification and understanding of systemic risks in the Union under Article 34(1) and to the assessment of the adequacy, efficiency and impacts of your risk mitigation measures under Article 35. If you cannot give access because you do not have the data or because access would lead to significant vulnerabilities in the security of your service or the protection of confidential information, in particular trade secrets, ask the Digital Services Coordinator within 15 days of receiving the request to amend it, with proposals for alternative means of access.
• Facilitate and provide access to data under Article 40(1) and (4) through the appropriate interfaces specified in the request, including online databases or application programming interfaces.
• Give access without undue delay to data, including, where technically possible, real-time data, provided that the data is publicly accessible in your online interface, to researchers, including those affiliated to not for profit bodies, organisations and associations, who comply with the conditions in Article 40(8), points (b), (c), (d) and (e), and who use the data solely for research that contributes to the detection, identification and understanding of systemic risks in the Union under Article 34(1).
• Establish a compliance function that is independent from your operational functions and composed of one or more compliance officers, including a head of the compliance function, with sufficient authority, stature and resources and access to your management body. The head must be an independent senior manager with distinct responsibility for the compliance function, report directly to the management body and not be removed without its prior approval, and the management body must ensure that compliance officers have the professional qualifications, knowledge, experience and ability needed for their tasks.
• Give your compliance officers the tasks listed in Article 41(3): cooperating with the Digital Services Coordinator of establishment and the Commission; ensuring that all risks referred to in Article 34 are identified and properly reported on and that risk-mitigation measures are taken under Article 35; organising and supervising your activities relating to the independent audit under Article 37; informing and advising management and employees about relevant obligations; monitoring your compliance with the Regulation; and, where applicable, monitoring compliance with commitments made under the codes of conduct and the crisis protocols.
• Communicate the name and contact details of the head of the compliance function to the Digital Services Coordinator of establishment and to the Commission.
• Have your management body define, oversee and be accountable for governance arrangements that ensure the independence of the compliance function, including the division of responsibilities, the prevention of conflicts of interest and the sound management of the systemic risks identified under Article 34; approve and review, at least once a year, the strategies and policies for managing, monitoring and mitigating those risks; devote sufficient time to risk management decisions; and ensure that adequate resources are allocated to managing those risks.
• Publish the reports referred to in Article 15 at the latest by two months from the date from which the obligations apply to you under Article 33(6), second subparagraph, and thereafter at least every six months. Include in them the information on the average monthly recipients of the service for each Member State, in addition to the information in Article 24(2).
• If you are a very large online platform, specify in those reports, in addition to the information required by Articles 15 and 24(1): the human resources you dedicate to content moderation in respect of the service offered in the Union, broken down by each applicable official language of the Member States, including for compliance with Articles 16, 20 and 22; the qualifications and linguistic expertise of the persons carrying out those activities and the training and support given to them; and the indicators of accuracy and related information referred to in Article 15(1), point (e), broken down by each official language of the Member States. Publish the reports in at least one of the official languages of the Member States.
• Transmit to the Digital Services Coordinator of establishment and the Commission, without undue delay upon completion, and make publicly available at the latest three months after the receipt of each audit report under Article 37(4): a report setting out the results of the risk assessment under Article 34; the specific mitigation measures put in place under Article 35(1); the audit report; the audit implementation report under Article 37(6); and, where applicable, information about the consultations conducted in support of the risk assessments and the design of the risk mitigation measures.
• Where publication might result in the disclosure of confidential information of yours or of the recipients of the service, cause significant vulnerabilities for the security of your service, undermine public security or harm recipients, you may remove such information from the publicly available reports. In that case, transmit the complete reports to the Digital Services Coordinator of establishment and the Commission with a statement of the reasons for removing the information.

Regulation (EU) 2022/2065, Article 16 · Read the law's page

• Put a mechanism in place that allows any individual or entity to notify you of the presence on your service of specific items of information that they consider to be illegal content. Make it easy to access and user-friendly, and allow notices to be submitted exclusively by electronic means.
• Design the mechanism to enable and facilitate notices that contain all of the following: a sufficiently substantiated explanation of why the information is alleged to be illegal content; the exact electronic location of the information, such as the exact URL or URLs; the name and email address of the person submitting the notice, except for information considered to involve one of the offences in Articles 3 to 7 of Directive 2011/93/EU; and a statement confirming the notifier's bona fide belief that the notice is accurate and complete.
• Treat a notice that allows a diligent provider of hosting services to identify the illegality without a detailed legal examination as giving you actual knowledge or awareness of that item for the purposes of Article 6, and so remove or disable access to it expeditiously to keep the hosting exemption.
• Where the notice contains the notifier's electronic contact information, send a confirmation of receipt of the notice without undue delay.
• Notify the notifier without undue delay of your decision on the information the notice relates to, and give information on the possibilities for redress in respect of that decision.
• Process notices and take decisions on the information they relate to in a timely, diligent, non-arbitrary and objective manner. Where you use automated means for that processing or decision-making, include information on that use in the notification of your decision.

Regulation (EU) 2022/2065, Article 17 · Read the law's page

• Give each affected recipient of your service a clear and specific statement of reasons for any restriction you impose on the ground that the information they provided is illegal content or incompatible with your terms and conditions: a restriction of the visibility of specific items of information (removal, disabling access or demotion), a suspension, termination or other restriction of monetary payments, a suspension or termination of the service in whole or in part, or a suspension or termination of the recipient's account.
• The duty applies only where you know the recipient's relevant electronic contact details, applies at the latest from the date the restriction is imposed, and does not apply where the information is deceptive high-volume commercial content or the restriction follows an order under Article 9.
• State in each statement of reasons: whether the decision removes, disables access to, demotes or restricts the visibility of the information, or suspends or ends monetary payments or imposes another measure, with the territorial scope and duration where relevant; the facts and circumstances relied on, including whether the decision followed a notice under Article 16 or your own voluntary investigations and, where strictly necessary, the identity of the notifier; any use of automated means in taking the decision; the legal ground relied on and why the information is illegal, or the contractual ground and why the information is incompatible with it; and clear and user-friendly information on the possibilities for redress, including internal complaint handling, out-of-court dispute settlement and judicial redress.
• Write the statement so that it is clear and easily comprehensible and as precise and specific as reasonably possible, so that the recipient can effectively use the possibilities for redress.

Regulation (EU) 2022/2065, Article 18 · Read the law's page

• If you provide hosting services and become aware of any information giving rise to a suspicion that a criminal offence involving a threat to the life or safety of a person or persons has taken place, is taking place or is likely to take place, promptly inform the law enforcement or judicial authorities of the Member State or Member States concerned of your suspicion and provide all relevant information available.
• The Member State concerned is the one where the offence is suspected to have taken place, to be taking place or to be likely to take place, where the suspected offender resides or is located, or where the victim resides or is located.
• If you cannot identify the Member State concerned with reasonable certainty, inform the law enforcement authorities of the Member State in which you are established or where your legal representative resides or is established, or inform Europol, or both.

Regulation (EU) 2022/2065, Article 28 · Read the law's page

• Applies to providers of online platforms accessible to minors (including social media, marketplaces and app stores) operating in the EU, other than micro and small enterprises, which Article 19 excludes unless they are designated very large online platforms.
• Put in place appropriate and proportionate measures to ensure a high level of privacy, safety and security for minors on your service.
• Do not present advertisements based on profiling using a minor's personal data when you are aware with reasonable certainty that the recipient is a minor.
• You are not obliged to process additional personal data in order to assess whether a recipient of the service is a minor.

Regulation (EU) 2022/2065, Arts. 11-15 · Read the law's page

• Designate a single point of contact for Member States' authorities, the Commission and the Board, so that they can communicate with you directly and by electronic means, and make public the information needed to identify and reach it. Keep that information easily accessible and up to date, and state the official languages of the Member States that can be used to communicate with it, in addition to a language broadly understood by the largest possible number of Union citizens. They must include at least one official language of the Member State of your main establishment or of the place where your legal representative resides or is established.
• Designate a single point of contact for the recipients of your service that lets them communicate with you directly and rapidly, by electronic means and in a user-friendly manner. Let recipients choose the means of communication, which must not rely solely on automated tools, and make public the information they need to identify and reach it, easily accessible and kept up to date.
• If you have no establishment in the Union but offer services in the Union, designate in writing a legal or natural person as your legal representative in one of the Member States where you offer your services. Mandate the representative to be addressed, in addition to or instead of you, by the competent authorities, the Commission and the Board on all issues necessary for the receipt of, compliance with and enforcement of decisions under the Regulation, and give it the necessary powers and sufficient resources.
• If you have no establishment in the Union, notify the name, postal address, email address and telephone number of your legal representative to the Digital Services Coordinator of the Member State where it resides or is established, and keep that information publicly available, easily accessible, accurate and up to date. Designating a legal representative does not make you established in the Union.
• Include in your terms and conditions information on any restrictions you impose on the use of your service in respect of information provided by recipients, including the policies, procedures, measures and tools you use for content moderation (algorithmic decision-making and human review) and the rules of procedure of your internal complaint handling system. Set it out in clear, plain, intelligible, user-friendly and unambiguous language, and make it publicly available in an easily accessible and machine-readable format.
• Inform recipients of the service of any significant change to your terms and conditions.
• If your service is primarily directed at minors or predominantly used by them, explain the conditions for, and any restrictions on, the use of the service in a way that minors can understand.
• Apply and enforce the restrictions in your terms and conditions in a diligent, objective and proportionate manner, with due regard to the rights and legitimate interests of all parties involved, including the fundamental rights of the recipients of the service, such as the freedom of expression and the freedom and pluralism of the media.
• If you are a very large online platform or very large online search engine, give recipients a concise, easily accessible and machine-readable summary of your terms and conditions, including the available remedies and redress mechanisms, in clear and unambiguous language, and publish your terms and conditions in the official languages of all the Member States in which you offer your services.
• Publish, at least once a year, in a machine-readable format and in an easily accessible manner, clear and easily comprehensible reports on any content moderation you engaged in during the relevant period.
• Include in each report, as applicable: the orders received from Member States' authorities, including orders under Articles 9 and 10, by type of illegal content and issuing Member State, with the median time to inform the authority and give effect; if you provide hosting, the notices submitted under Article 16 by type of alleged illegal content, those from trusted flaggers, the action taken and whether it rested on the law or your terms and conditions, the notices processed by automated means and the median time to act; meaningful information on content moderation at your own initiative, including automated tools and the training and assistance given to moderators; the complaints received through your internal complaint-handling systems, the decisions taken, the median time to decide and the instances where decisions were reversed; and any use of automated means for content moderation, with its purposes, indicators of accuracy, possible rate of error and safeguards.
• You are not required to publish the reports in Article 15(1) if you qualify as a micro or small enterprise as defined in Recommendation 2003/361/EC and are not a very large online platform.

Regulation (EU) 2022/2065, Arts. 20-23, 24(1), 24(5) · Read the law's page

• If you provide an online platform and qualify as a micro or small enterprise as defined in Recommendation 2003/361/EC, Section 3 of Chapter III does not apply to you, except Article 24(3), and that exclusion continues for 12 months after you lose the status unless you are a very large online platform. If the Commission designates you a very large online platform, the Section applies to you whether or not you are a micro or small enterprise.
• Give recipients of your service, including individuals or entities that have submitted a notice, for at least six months after the decision, access to an effective internal complaint-handling system that lets them lodge complaints, electronically and free of charge, against your decision on a notice and against your decisions, taken on the ground that the information they provided is illegal content or incompatible with your terms and conditions, whether or not to remove, disable access to or restrict the visibility of the information, to suspend or terminate the service in whole or in part, to suspend or terminate their account, or to suspend, terminate or otherwise restrict their ability to monetise information. The six months run from the day the recipient is informed of the decision under Article 16(5) or Article 17.
• Make the complaint system easy to access and user-friendly, enable and facilitate sufficiently precise and adequately substantiated complaints, and handle complaints in a timely, non-discriminatory, diligent and non-arbitrary manner. Reverse your decision without undue delay where a complaint gives sufficient grounds to consider that your decision not to act on a notice is unfounded, that the information is not illegal and not incompatible with your terms and conditions, or that the complainant's conduct does not warrant the measure taken.
• Inform complainants without undue delay of your reasoned decision and of the possibility of out-of-court dispute settlement under Article 21 and other available possibilities for redress, and have those decisions taken under the supervision of appropriately qualified staff, not solely on the basis of automated means.
• Make information about the possibility of out-of-court dispute settlement easily accessible on your online interface, clear and user-friendly. Engage in good faith with the certified out-of-court dispute settlement body the recipient selects, though you may refuse to engage if a dispute has already been resolved concerning the same information and the same grounds of alleged illegality or incompatibility of content.
• If the out-of-court dispute settlement body decides the dispute in favour of the recipient, bear all the fees charged by the body and reimburse the recipient for any other reasonable expenses it paid in relation to the dispute settlement.
• Take the necessary technical and organisational measures to ensure that notices submitted by trusted flaggers, acting within their designated area of expertise, through your Article 16 mechanism are given priority and are processed and decided upon without undue delay.
• If you have information indicating that a trusted flagger has submitted a significant number of insufficiently precise, inaccurate or inadequately substantiated notices, communicate it to the Digital Services Coordinator that awarded the trusted flagger status, with the necessary explanations and supporting documents.
• After a prior warning, suspend for a reasonable period of time the provision of your services to recipients that frequently provide manifestly illegal content, and suspend for a reasonable period of time the processing of notices and complaints from individuals, entities or complainants that frequently submit manifestly unfounded ones.
• Decide on a suspension case by case, in a timely, diligent and objective manner, taking into account at least the absolute numbers of manifestly illegal items or manifestly unfounded notices or complaints in a given time frame, their relative proportion, the gravity of the misuse and, where it can be identified, the intention of the recipient, individual, entity or complainant. Set out your policy on this misuse in your terms and conditions in a clear and detailed manner, with examples of the facts and circumstances you take into account and the duration of the suspension.
• Include in your transparency reports under Article 15, in addition to the information Article 15 requires, the number of disputes submitted to out-of-court dispute settlement bodies, the outcomes, the median time needed to complete the procedures and the share of disputes where you implemented the body's decisions, and the number of suspensions imposed under Article 23, distinguishing suspensions for manifestly illegal content, for manifestly unfounded notices and for manifestly unfounded complaints.
• Submit to the Commission, without undue delay, your decisions and the statements of reasons referred to in Article 17(1) for inclusion in the Commission's publicly accessible machine-readable database, and make sure the information you submit contains no personal data.

Regulation (EU) 2022/2065, Arts. 25-27 · Read the law's page

• If you provide an online platform and qualify as a micro or small enterprise as defined in Recommendation 2003/361/EC, Articles 25 to 27 do not apply to you, and that exclusion continues for 12 months after you lose the status, unless you are a very large online platform. If the Commission designates you a very large online platform, they apply to you whether or not you are a micro or small enterprise.
• Do not design, organise or operate your online interfaces in a way that deceives or manipulates the recipients of your service or that otherwise materially distorts or impairs their ability to make free and informed decisions. The prohibition does not apply to practices covered by Directive 2005/29/EC or Regulation (EU) 2016/679.
• If you present advertisements on your online interfaces, ensure that for each specific advertisement presented to each individual recipient, the recipient can identify in a clear, concise and unambiguous manner and in real time: that the information is an advertisement, including through prominent markings; the natural or legal person on whose behalf it is presented; the person who paid for it, if different; and meaningful information, directly and easily accessible from the advertisement, about the main parameters used to determine the recipient to whom it is presented and, where applicable, how to change them.
• Give recipients a functionality to declare whether the content they provide is or contains commercial communications. When a recipient makes that declaration, ensure that other recipients can identify in a clear and unambiguous manner and in real time, including through prominent markings, that the content is or contains commercial communications as described in the declaration.
• Do not present advertisements to recipients of your service based on profiling as defined in Article 4, point (4), of Regulation (EU) 2016/679 using special categories of personal data referred to in Article 9(1) of that Regulation.
• If you use recommender systems, set out in your terms and conditions, in plain and intelligible language, the main parameters used in them and any options for recipients to modify or influence those parameters. Explain why certain information is suggested to the recipient, including at least the criteria most significant in determining it and the reasons for their relative importance.
• Where several options are available for a recommender system that determines the relative order of information presented to recipients, make available a functionality that allows the recipient to select and modify their preferred option at any time, directly and easily accessible from the specific section of your online interface where the information is being prioritised.

Regulation (EU) 2022/2065, Arts. 30-32 · Read the law's page

• If you provide an online platform allowing consumers to conclude distance contracts with traders and qualify as a micro or small enterprise as defined in Recommendation 2003/361/EC, Section 4 of Chapter III (Articles 29 to 32) does not apply to you, and that exclusion continues for 12 months after you lose the status unless you are a very large online platform. If the Commission designates you a very large online platform, the Section applies to you whether or not you are a micro or small enterprise.
• Ensure that traders can only use your platform to promote messages on or to offer products or services to consumers located in the Union if, before they use your services for those purposes, you have obtained, where applicable to the trader: its name, address, telephone number and email address; a copy of its identification document or other electronic identification as defined by Article 3 of Regulation (EU) No 910/2014; its payment account details; its trade register and registration number, where it is registered in a trade register or similar public register; and a self-certification committing to offer only products or services that comply with the applicable rules of Union law.
• Before allowing the trader to use your services, make best efforts to assess whether that information is reliable and complete, through any freely accessible official online database or online interface made available by a Member State or the Union, or through requests to the trader for supporting documents from reliable sources. For traders already using your services for those purposes on 17 February 2024, make best efforts to obtain the information within 12 months and suspend your services to any trader that has not provided all of it by then, until it has.
• If you obtain sufficient indications or have reason to believe that any of that information is inaccurate, incomplete or not up-to-date, request that the trader remedy the situation without delay or within the period set by Union and national law, and if the trader fails to correct or complete it, swiftly suspend your service to that trader in relation to the offering of products or services to consumers located in the Union until the request has been fully complied with.
• Store the information obtained in a secure manner for six months after the end of the contractual relationship with the trader, then delete it. Disclose it to third parties only where required by the applicable law, including orders under Article 10 and orders issued by Member States' competent authorities or the Commission for the performance of their tasks under the Regulation.
• Make the trader's name, address, telephone number and email address, trade register details and self-certification available on your online platform to recipients of the service in a clear, easily accessible and comprehensible manner, at least on the online interface where the information on the product or service is presented.
• Design and organise your online interface so that traders can comply with their obligations on pre-contractual information, compliance and product safety information under Union law, including by providing the name, address, telephone number and email address of the economic operator, the information needed to identify the products or services promoted or offered to consumers in the Union, any sign identifying the trader such as a trademark, symbol or logo, and, where applicable, the labelling and marking information required by Union rules on product safety and product compliance.
• Make best efforts to assess whether traders have provided that information before allowing them to offer products or services on your platform. After allowing them, make reasonable efforts to check randomly, in any official, freely accessible and machine-readable online database or online interface, whether the products or services offered have been identified as illegal.
• If you become aware, irrespective of the means used, that a trader has offered an illegal product or service to consumers located in the Union through your services, inform, insofar as you have their contact details, the consumers who purchased it through your services of the fact that it is illegal, the identity of the trader and any relevant means of redress. Limit this to purchases made within the six months preceding the moment you became aware of the illegality.
• If you do not have the contact details of all the consumers concerned, make publicly available and easily accessible on your online interface the information concerning the illegal product or service, the identity of the trader and any relevant means of redress.

Regulation (EU) 2022/2065, Arts. 4-10 · Read the law's page

• To keep the mere conduit exemption in Article 4, do not initiate the transmission, do not select its receiver, and do not select or modify the information transmitted. Automatic, intermediate and transient storage counts as part of the transmission only so far as it takes place for the sole purpose of carrying out the transmission and for no longer than is reasonably necessary for it.
• To keep the caching exemption in Article 5, do not modify the information, comply with the conditions on access to it and with industry-standard rules on updating it, and do not interfere with the lawful use of industry-standard technology to obtain data on its use. Act expeditiously to remove or disable access to what you have cached once you have actual knowledge that it has been removed from or disabled at the initial source, or that a judicial or administrative authority has ordered that.
• To keep the hosting exemption in Article 6, remove or disable access to illegal content expeditiously once you have actual knowledge of illegal activity or illegal content or, for a claim for damages, awareness of facts or circumstances from which it is apparent. The exemption does not apply where the recipient of the service acts under your authority or control.
• If you are an online platform that allows consumers to conclude distance contracts with traders, the hosting exemption does not apply to your liability under consumer protection law where you present the specific item of information or otherwise enable the specific transaction at issue in a way that would lead an average consumer to believe that the item, product or service is provided by you or by a recipient acting under your authority or control.
• You do not lose the exemptions in Articles 4, 5 and 6 solely because, in good faith and in a diligent manner, you carry out voluntary own-initiative investigations into illegal content, take other measures to detect, identify and remove it or disable access to it, or take the measures needed to comply with Union or national law, including this Regulation.
• You are not required to monitor the information you transmit or store, or actively to seek facts or circumstances indicating illegal activity: Article 8 bars imposing a general obligation to do so.
• On receiving an order to act against one or more specific items of illegal content, issued by the relevant national judicial or administrative authority on the basis of applicable Union or national law in compliance with Union law, inform the issuing authority, or any other authority the order specifies, without undue delay of any effect given to the order, specifying if and when effect was given. At the latest when effect is given or, where applicable, at the time the issuing authority provides in its order, inform the recipient of the service concerned of the order and its effect, including a statement of reasons, the possibilities for redress and the territorial scope of the order.
• On receiving an order to provide specific information about one or more specific individual recipients of the service, issued by the relevant national judicial or administrative authority on the basis of applicable Union or national law in compliance with Union law, inform the issuing authority, or any other authority the order specifies, without undue delay of its receipt and of the effect given to it, specifying if and when effect was given. At the latest when effect is given or, where applicable, at the time the issuing authority provides in its order, inform the recipient concerned of the order and its effect, including a statement of reasons and the possibilities for redress. Such an order can require only information you have already collected for the purposes of providing the service and that lies within your control.
• An order of a judicial or administrative authority can still require you, in accordance with a Member State's legal system, to terminate or prevent an infringement: Articles 4(3), 5(2) and 6(4) leave that possibility untouched.

Regulation (EU) No 910/2014, Article 5f(3) · Read the law's page

• This duty reaches you if you provide a very large online platform, that is, an online platform the Commission has designated as such under Article 33 of Regulation (EU) 2022/2065, and you require users to authenticate to access your online services (Art. 5f(3)).
• Accept and facilitate the use of European Digital Identity Wallets that are provided in accordance with the Regulation for that user authentication, only upon the voluntary request of the user (Art. 5f(3)).
• Limit the data you request through the wallet to the minimum data necessary for the specific online service for which authentication is requested (Art. 5f(3)).

Regulation (EU) 2024/1781, Article 35 · Read the law's page

• It reaches you if you provide an online marketplace, an intermediary service whose online interface allows customers to conclude distance contracts with economic operators for the sale of products covered by delegated acts adopted pursuant to Article 4: comply with Articles 11 and 30 of Regulation (EU) 2022/2065 for the purposes of the Regulation.
• At the request of a market surveillance authority and in specific cases, cooperate with it to facilitate any action taken to eliminate or, if that is not possible, to mitigate the non-compliance of a product that is or was offered for sale online through your services.
• If a market surveillance authority orders you, in accordance with Article 9 of Regulation (EU) 2022/2065, to act against one or more specific items of content referring to a product covered by a relevant delegated act that does not comply, including by removing them, act on the order. That content is illegal content within the meaning of Article 3, point (h), of that Regulation.
• Establish a single contact point for direct communication with Member States' market surveillance authorities in relation to compliance with the Regulation. It may be the same contact point as the one under Article 22(1) of Regulation (EU) 2023/988 or Article 11(1) of Regulation (EU) 2022/2065.

Directive (EU) 2022/2555, Art. 21 · Read the law's page

• Take technical, operational and organisational measures appropriate to the risk your network and information systems face, covering at minimum a risk analysis and information-system-security policy, incident handling, business continuity and crisis management, supply chain security, and security in the acquisition, development and maintenance of your systems.
• Maintain basic cyber hygiene practices and cybersecurity training, policies on cryptography and encryption where appropriate, human resources security and access control, and multi-factor authentication or continuous authentication solutions where appropriate.
• Have your management body approve these measures, oversee their implementation, and complete cybersecurity training.
• If you operate an online marketplace, online search engine or social networking services platform, are not established in the Union, and offer it within the Union, designate a representative in the Union, established in one of the Member States where you offer the service; you then fall under the jurisdiction of the Member State where the representative is established.
• This duty reaches your service where you operate an online marketplace, online search engine or social networking services platform under Annex II and you qualify as a medium-sized enterprise or larger under the EU size-cap rule (Commission Recommendation 2003/361/EC), or regardless of size where Article 2(2), points (b) to (e), applies, for example where you are the sole provider in a Member State of a service essential for the maintenance of critical societal or economic activities. It also reaches you where you are a public administration entity of central government, or a regional one that, following a risk-based assessment by the Member State, provides services whose disruption could have a significant impact on critical societal or economic activities (Annex I and Article 2(2), point (f)), unless your activities are in the areas of national security, public security, defence or law enforcement (Article 2(7)).

Directive (EU) 2022/2555, Art. 23 · Read the law's page

• Notify your CSIRT, or the competent authority where applicable, of any incident with a significant impact on the provision of your services: an early warning within 24 hours of becoming aware, an incident notification within 72 hours of becoming aware (24 hours if you are a trust service provider), an intermediate report on relevant status updates if your CSIRT or competent authority asks for one, and a final report no later than one month after the incident notification, or, for an incident still ongoing at that point, a progress report then and a final report within one month of its handling.
• Where appropriate, notify, without undue delay, the recipients of your services who a significant incident is likely to adversely affect, and communicate to recipients potentially affected by a significant cyber threat any measures or remedies they can take.
• Treat an incident as significant where it has caused or is capable of causing severe operational disruption or financial loss to your own operations, or considerable material or non-material damage to another person.
• Where you are one of the providers Commission Implementing Regulation (EU) 2024/2690 names, apply the significance criteria of its Articles 3 to 14 to decide which incidents to notify, which its recital 30 treats as exhaustive.
• This duty reaches your service where you operate an online marketplace, online search engine or social networking services platform under Annex II and you qualify as a medium-sized enterprise or larger under the EU size-cap rule, or regardless of size where Article 2(2), points (b) to (e), applies, for example where you are the sole provider in a Member State of a service essential for the maintenance of critical societal or economic activities. It also reaches you where you are a public administration entity of central government, or a regional one that, following a risk-based assessment by the Member State, provides services whose disruption could have a significant impact on critical societal or economic activities (Annex I and Article 2(2), point (f)), unless your activities are in the areas of national security, public security, defence or law enforcement (Article 2(7)).

Regulation (EU) 2024/2690, Art. 2 and Annex · Read the law's page

• This duty reaches you if you declare that you are an essential or important entity under Article 3 of Directive (EU) 2022/2555 and provide a service Article 1 names: a DNS service provider, TLD name registry, cloud computing service provider, data centre service provider, content delivery network provider, managed service provider, managed security service provider, provider of an online marketplace, online search engine or social networking services platform, or trust service provider. Under Article 2 of that Directive you are in scope if you are a medium-sized enterprise or larger, or, whatever your size, if you are a trust service provider, a TLD name registry or a DNS service provider, or if Article 2(2), points (b) to (e), applies to you.
• Ensure a level of security of your network and information systems appropriate to the risks posed when you implement the requirements, taking due account of your exposure to risks, your size, the likelihood of occurrence of incidents and their severity, including their societal and economic impact (Article 2(2)).
• Where the Annex applies a requirement where appropriate, where applicable or to the extent feasible and you consider it not appropriate, not applicable or not feasible for you to apply it, document your reasoning in a comprehensible manner (Article 2(2)).
• Maintain a policy on the security of network and information systems that your management bodies approve and review at least annually and when significant incidents or significant changes to operations or risks occur, and have at least one person report directly to your management bodies on network and information system security (Annex points 1.1.1(k), 1.1.2 and 1.2.3).
• Establish a risk management framework, perform and document risk assessments, and establish, implement and monitor a risk treatment plan, reviewing the assessment results and the plan at planned intervals and at least annually (points 2.1.1 and 2.1.4).
• Establish and implement an incident handling policy, monitor and log activity on your network and information systems to detect events that could be incidents, assess suspicious events to determine whether they are incidents, and assess the existence of recurring incidents under Article 4 on a quarterly basis (points 3.1.1, 3.2.1, 3.4.1 and 3.4.2(b)).
• Lay down procedures and use tools to monitor and log activities on your network and information systems, maintain, document and review the logs, and establish a list of the assets to be subject to logging based on your risk assessment. Where appropriate, include in the logs network traffic, changes to users and permissions, access to systems and applications, authentication events, privileged and administrator activity, access to or changes of critical configuration and backup files, security tool logs, use of system resources, physical access, use of network equipment, and the activation, stopping and pausing of logs, and environmental events. Review the logs regularly for unusual or unwanted trends and start a qualified response in a timely manner when an alarm is triggered. Maintain and back up the logs for a predefined period, protect them from unauthorized access or changes, and, to the extent feasible, synchronize the time sources of all systems and make your monitoring and logging systems redundant (points 3.2.1 and 3.2.3 to 3.2.6).
• Establish communication plans and procedures with your CSIRT or, where applicable, your competent authority for incident notification (point 3.5.3(a)).
• Lay down and maintain a business continuity and disaster recovery plan, carry out a business impact analysis, and maintain backup copies of data (points 4.1.1, 4.1.3 and 4.2.1).
• Establish a supply chain security policy that governs your relations with your direct suppliers and service providers, and ensure, where appropriate, that your contracts with them specify an obligation to notify you without undue delay of incidents that present a risk to the security of your network and information systems (points 5.1.1 and 5.1.4(d)).
• Before you develop a network and information system, including software, lay down rules for secure development and apply them to in-house and outsourced development (point 6.2.1).
• Apply security patches within a reasonable time after they become available and test them before applying them in production systems, unless you document and substantiate a decision that the disadvantages of applying a patch outweigh the cybersecurity benefits (points 6.6.1 and 6.6.2).
• Address without undue delay the vulnerabilities you identify as critical to your operations, and lay down a procedure for disclosing vulnerabilities in accordance with the applicable national coordinated vulnerability disclosure policy (points 6.10.2(c) and (e)).
• Ensure, where appropriate and in accordance with the classification of the asset to be accessed, that users are authenticated by multiple authentication factors or continuous authentication mechanisms (point 11.7.1).
• Establish a policy and procedures to assess whether your cybersecurity risk-management measures are effectively implemented and maintained (point 7.1), offer your employees an awareness raising programme and give those whose roles require security skills regular training (points 8.1.2 and 8.2.1), and apply the Annex's requirements on cryptography, human resources security, access control, asset management, and environmental and physical security (points 9 to 13).

Regulation (EU) 2024/2690, Arts. 3 to 14 · Read the law's page

• This duty reaches you if you declare that you are an essential or important entity under Article 3 of Directive (EU) 2022/2555 and provide a service Article 1 names: a DNS service provider, TLD name registry, cloud computing service provider, data centre service provider, content delivery network provider, managed service provider, managed security service provider, provider of an online marketplace, online search engine or social networking services platform, or trust service provider. Under Article 2 of that Directive you are in scope if you are a medium-sized enterprise or larger, or, whatever your size, if you are a trust service provider, a TLD name registry or a DNS service provider, or if Article 2(2), points (b) to (e), applies to you.
• Treat an incident as significant, and notify it under Article 23 of Directive (EU) 2022/2555, where it fulfils one or more of the criteria of Article 3(1): direct financial loss, caused or capable of being caused, that exceeds EUR 500,000 or 5 percent of your total annual turnover in the preceding financial year, whichever is lower; the exfiltration of your trade secrets; the death of a natural person or considerable damage to a natural person's health; a successful, suspectedly malicious and unauthorised access to your network and information systems that is capable of causing severe operational disruption; or the recurring-incident rule or a criterion for your class of entity.
• Apply the criteria that Articles 5 to 14 set for your class of entity: Article 5 for DNS service providers, Article 6 for TLD name registries, Article 7 for cloud computing service providers, Article 8 for data centre service providers, Article 9 for content delivery network providers, Article 10 for managed service providers and managed security service providers, Articles 11 to 13 for providers of online marketplaces, online search engines and social networking services platforms, and Article 14 for trust service providers.
• Treat incidents that are individually not significant as one significant incident where they occurred at least twice within 6 months, have the same apparent root cause, and collectively meet the financial loss criterion of Article 3(1), point (a) (Article 4).
• Treat yourself as aware of a significant incident, for the clock Article 23(4) of Directive (EU) 2022/2555 sets, when after your initial assessment you have a reasonable degree of certainty that a significant incident has occurred (recital 31).
• Do not treat scheduled interruptions of service or the planned consequences of scheduled maintenance operations carried out by or on your behalf as significant incidents (Article 3(2)).
• When you calculate the number of users impacted by an incident under Articles 7 and 9 to 14, consider the number of customers that have a contract with you granting access to your network and information systems or services, and the number of natural and legal persons associated with business customers that use them (Article 3(3)).

Regulation (EU) 2023/988, Article 22 · Read the law's page

• It reaches you if you provide an online marketplace, an intermediary service whose online interface lets consumers conclude distance contracts with traders for the sale of products: designate a single point of contact for direct electronic communication with Member States' market surveillance authorities on product safety issues, register with the Safety Gate Portal, and indicate your contact point there.
• Designate a single point of contact that lets consumers communicate directly and rapidly with you on product safety issues.
• Have internal processes for product safety in place so that you comply without undue delay with the Regulation's requirements, including mechanisms through which traders provide the manufacturer or responsible person information and their self-certification that they will offer only products that comply with the Regulation, with the identification information Article 30(1) of Regulation (EU) 2022/2065 requires where applicable.
• Take the necessary measures to receive and process an order from a market surveillance authority to remove content referring to an offer of a dangerous product from your online interface, to disable access to it or to display an explicit warning. Act without undue delay and in any event within two working days from receipt of the order, and tell the issuing authority by electronic means, using the contact details published in the Safety Gate Portal, what effect you gave it.
• Where an order so requires, remove, disable access to or warn on all identical content referring to an offer of the dangerous product for the period the order prescribes. The search is limited to the information the order identifies and needs no independent assessment of the content, provided the search and removal can be done proportionately by reliable automated tools.
• Take into account the regular information on dangerous products that market surveillance authorities notify through the Safety Gate Portal when you apply voluntary measures to detect, identify, remove or disable access to offers of dangerous products, using the Portal's interoperable interface where applicable. Tell the authority that notified you what action you took.
• For the purpose of compliance with Article 31(3) of Regulation (EU) 2022/2065 as regards product safety, use at least the Safety Gate Portal.
• Process each notice about a product safety issue that you receive under Article 16 of Regulation (EU) 2022/2065 without undue delay and in any event within three working days from receipt.
• Design and organize your online interface so that traders offering a product can provide, and consumers can see or easily reach on the product listing, for each product: the manufacturer's name, registered trade name or trade mark and its postal and electronic address; where the manufacturer is not established in the Union, the name, postal and electronic address of the responsible person; information identifying the product, including a picture, its type and any other product identifier; and any warning or safety information to be affixed on or to accompany the product, in a language consumers can easily understand.
• Suspend, for a reasonable period of time and after a prior warning, the provision of your services to traders that frequently offer products which do not comply with the Regulation.
• Notify directly and without undue delay all affected consumers that can be identified when a product they bought through your interface is subject to a safety recall or safety warning of which you have actual knowledge, and publish information on product safety recalls on your online interfaces.
• Cooperate with market surveillance authorities, traders and relevant economic operators on any action to eliminate or mitigate the risks of a product offered through your services: inform the relevant economic operator of a decision to remove or disable access to an offer of a dangerous product, cooperate in effective recalls without obstructing them, and cooperate on accidents notified to you.
• Immediately inform, through the Safety Business Gateway, the market surveillance authorities of the Member States where the product has been made available about dangerous products offered on your interfaces of which you have actual knowledge, giving the details of the risk, the quantity by Member State of products still circulating if available, and any corrective measure taken to your knowledge. Notify through the Safety Business Gateway, without undue delay, any accident you have been informed of that resulted in a serious risk or actual damage to a consumer's health or safety caused by a product made available on your marketplace, and inform the manufacturer.
• Cooperate with law enforcement agencies at Union and national level, including the European Anti-Fraud Office, through regular and structured exchange of information on offers you removed under Article 22. Allow market surveillance authorities access to your interfaces for their online tools to identify dangerous products, and respond to their data requests to help identify the supply chain of dangerous products where the information is not publicly available.
• Where you or online sellers have put in place technical obstacles to extracting data from your online interfaces, allow data scraping on a reasoned request of the market surveillance authorities, only for product safety purposes and on the identification parameters they provide.

Implementing Regulation (EU) 2024/2835 · Read the law's page

• Publish each transparency report you owe under Article 15, 24 or 42 of the Digital Services Act by filling in the quantitative and qualitative templates in Annex I, in their CSV or XLSX version, and publish one report for each service you offer (Article 1(1); Annex II, Part I). A report that omits one of the two templates, or parts of them, without a specific and objective reason is considered incomplete.
• Publish the filled-in templates as a CSV file that complies with RFC 4180 and uses UTF-8 encoding, reporting counting indicators as integers, percentage indicators as floating numbers in the interval from 0 to 1 and median times in hours (Annex II, Part I, point 4).
• Use the harmonized reporting periods in Article 2: if you are a provider of intermediary services, hosting services or online platforms, 1 January until 31 December; if you are a provider of a very large online platform or a very large online search engine, 1 January until 30 June and 1 July until 31 December. The transition period for aligning reporting timelines ends on 31 December 2025, and as of 1 January 2026 all providers follow these periods (Article 2(1) and (2); Annex II, Part I, point 3).
• Make each report publicly available at the latest two months after the end of its reporting period (Article 2(3)).
• Base your reports on the Annex I templates for content moderation from 1 July 2025 (Article 2(4)). If you are a provider of intermediary services, hosting services or online platforms, your first full annual cycle on the templates covers 1 January until 31 December 2026. If you are a provider of a very large online platform or a very large online search engine, your first cycle on the templates covers 1 July until 31 December 2025 (Annex II, Part I, point 3).
• Retain each transparency report for at least five years after its publication, and keep every published version publicly available throughout that period (Article 3). If you publish an updated version, mark it as an updated version of the earlier report, highlight the changes, describe the reasons and the methodology used to rectify the inaccuracies or errors, and state the date of the changes (Annex II, Part I, point 5).
• If you are a provider of a very large online platform, assess the linguistic expertise of your content moderators against the Common European Framework of Reference for Languages: sufficient linguistic expertise for content moderation is at least level B2 in the category Understanding (Annex II, Part I, point 6).
• You are not required to publish the Article 15(1) report if you are a micro or small enterprise and not a very large online platform (recital 2 records Article 15(2) of the Digital Services Act).

Regulation (EU) 2024/1083, Article 18 · Read the law's page

• If you provide a very large online platform, meaning an online platform the Commission has designated under Article 33(4) of the Digital Services Act, the duties below apply to you (Articles 2(10) and 18).
• Provide a functionality that lets recipients of your service declare that they are media service providers; that they comply with Article 6(1); that they are editorially independent from Member States, political parties, third countries and entities controlled or financed by third countries; that they are subject to regulatory requirements for the exercise of editorial responsibility and to oversight by a competent national regulatory authority or body, or adhere to a widely recognized and accepted co-regulatory or self-regulatory mechanism governing editorial standards; and that they do not provide content generated by artificial intelligence systems without human review or editorial control (Article 18(1)(a) to (e)).
• Let those recipients also provide their legal name and contact details, including an email address through which you can communicate quickly and directly with them, and the contact details of the relevant national regulatory authorities or bodies or representatives of the co-regulatory or self-regulatory mechanisms (Article 18(1)(f) and (g)).
• Where there is reasonable doubt about a media service provider's declaration that it is subject to regulatory oversight or adheres to a co-regulatory or self-regulatory mechanism, seek confirmation from the relevant national regulatory authority or body or the relevant mechanism (Article 18(1), second subparagraph).
• Make the declared information publicly available in an easily accessible manner on your online interface, except the legal name and contact details provided under Article 18(1), first subparagraph, point (f) (Article 18(2)).
• Acknowledge receipt of each declaration and give the media service provider your contact details, including an email address through which it can communicate directly and quickly with you. Indicate without undue delay whether you accept or reject the declaration (Article 18(3)).
• Before a decision to suspend your online intermediation services in relation to content provided by a media service provider that has submitted a declaration, or to restrict the visibility of that content, takes effect on the ground that the content is incompatible with your terms and conditions, communicate to that media service provider a statement of reasons as referred to in Article 4(1) of Regulation (EU) 2019/1150 and Article 17 of the Digital Services Act, and give it the opportunity to reply within 24 hours of receiving the statement. In a crisis as referred to in Article 36(2) of the Digital Services Act, allow a shorter timeframe that still gives it sufficient time to reply in a meaningful manner (Article 18(4)).
• Where, following or in the absence of a reply, you decide to suspend or restrict visibility, inform the media service provider concerned without undue delay (Article 18(4)).
• The statement of reasons and reply window in Article 18(4) do not apply where you suspend or restrict visibility in compliance with your obligations under Articles 28, 34 and 35 of the Digital Services Act and Article 28b of Directive 2010/13/EU or with your obligations relating to illegal content under Union law (Article 18(4), third subparagraph).
• Take all the necessary technical and organizational measures to ensure that complaints lodged by media service providers under Article 11 of Regulation (EU) 2019/1150 or Article 20 of the Digital Services Act are processed and decided upon with priority and without undue delay (Article 18(5)).
• If a media service provider that has submitted a declaration considers that you have repeatedly restricted or suspended, without sufficient grounds, the provision of your services in relation to its content, engage at its request in a meaningful and effective dialogue in good faith, within a reasonable timeframe, to find an amicable solution that ends unjustified restrictions or suspensions and avoids them in the future (Article 18(6)).
• Make publicly available each year detailed information on the number of restrictions and suspensions you imposed on the ground that the content of a declaring media service provider is incompatible with your terms and conditions and the grounds for them, including the specific clauses; the number of dialogues with media service providers; and the number of declarations you rejected or invalidated and the grounds for rejection or invalidation (Article 18(8)).

Regulation (EU) 2024/900, Article 15 · Read the law's page

• If you are a political advertising publisher, meaning a provider of political advertising service that publishes, delivers or disseminates political advertising through any medium, put in place the necessary mechanisms to enable natural or legal persons to notify you if a particular political advertisement that you have published does not comply with the Regulation (Articles 3(13) and 15(1)). An online intermediary service provided without consideration is not a political advertising service (Article 3(5)).
• Make those mechanisms free of charge, user-friendly and easy to access, including from the transparency notice, and, where technically possible, allow notifications to be made in electronic form (Article 15(2)).
• Take the necessary measures to enable and facilitate notifications that contain a substantiated explanation of why the notifier alleges that the political advertisement does not comply with the Regulation, information enabling the identification of the advertisement, and the name and email address of the notifier (Article 15(3)).
• Send the person who submitted a notification a confirmation of receipt without undue delay (Article 15(4)).
• If you are a very large online platform or a very large online search engine, examine and address the notifications you receive without undue delay in a diligent, non-arbitrary and objective manner, and inform the notifier without undue delay of the follow-up given (Article 15(5)).
• If you are not a very large online platform or a very large online search engine, without undue delay make best efforts to examine and address notifications in a diligent, non-arbitrary and objective manner, and inform the notifier, at least upon request, of the follow-up given; if you qualify as a micro-undertaking under Article 3(1) of Directive 2013/34/EU, make best efforts to ensure your compliance with this point (Article 15(6)).
• In the last month preceding an election or a referendum, process any notification you receive about a political advertisement linked to that election or referendum within 48 hours, provided the notification can be processed completely on the basis of the information included in it; if you qualify as a micro, small or medium-sized undertaking under Article 3(1), (2) and (3) of Directive 2013/34/EU, make best efforts to process such notifications without undue delay (Article 15(7)).
• Provide clear and user-friendly information on the possibilities for redress in respect of the political advertisement to which a notification relates and, where applicable, on the use of automated means for the processing of notifications (Article 15(8)).
• Without undue delay, inform the sponsors or providers of political advertising services concerned of any measures you take following notifications that affect the availability or the presentation of the political advertisement concerned (Article 15(9)).

Regulation (EU) 2024/900, Arts. 18-19 · Read the law's page

• If you are a controller and use targeting techniques or ad-delivery techniques that involve the processing of personal data in online political advertising, process the data only if you collected it from the data subject (Article 18(1)(a)).
• Process the data for those techniques only if the data subject has given explicit consent, within the meaning of Regulations (EU) 2016/679 and (EU) 2018/1725, to the processing of personal data separately for the purpose of political advertising (Article 18(1)(b)).
• Do not let those techniques involve profiling, as defined in Article 4, point 4, of Regulation (EU) 2016/679, using the special categories of personal data referred to in Article 9(1) of that Regulation (Article 18(1)(c)).
• Do not use targeting techniques or ad-delivery techniques in political advertising that involve the processing of the personal data of a data subject whom you know with reasonable certainty to be at least one year under the voting age established by national rules; you are not obliged to process additional personal data to assess whether the data subject is one year under the voting age (Article 18(2)).
• Article 18 does not apply to communications of a political party, foundation, association or other non-profit body to its members and former members, or to communications such as newsletters linked to its political activities, as long as they are solely based on subscription data and strictly limited to members, former members or subscribers, are based on personal data provided by them, and do not involve processing personal data to target or otherwise further select the recipients and the messages they receive (Article 18(3)).
• Do not ask a data subject to consent if he or she has already indicated by automated means that he or she does not consent to data processing for political advertising purposes, unless the request is justified by a substantial change of circumstances, and offer a data subject who does not consent an equivalent alternative for using the online service without receiving political advertising (Article 18(4)).
• Adopt, implement and make publicly available an internal policy describing clearly and in plain language how such techniques are used, and retain it for seven years from the last use of the techniques (Article 19(1)(a)).
• Keep records on the use of such techniques and the relevant mechanisms and parameters used (Article 19(1)(b)).
• Provide, together with the indication that the advertisement is political, the additional information that lets the individual understand the logic involved and the main parameters of the techniques used, including whether an artificial intelligence system has been used to target or deliver the advertisement and any additional analytical techniques, with the elements listed in Article 19(1)(c), points (i) to (vi): the specific groups of recipients targeted and the parameters used to determine them, the categories of personal data used, the targeting goals, mechanisms and logic including the inclusion and exclusion parameters and the reasons for choosing them, meaningful information on the use of artificial intelligence systems, the period of dissemination and the number of individuals reached, and a link to or clear indication of where the policy can be retrieved (Article 19(1)(c)).
• Prepare an internal annual risk assessment of the use of targeting techniques or ad-delivery techniques on fundamental rights and freedoms, and make its results publicly available (Article 19(1)(d)).
• Provide, together with the political advertisement unless it is included in the transparency notice required under Article 12(1), a reference to effective means to support individuals in exercising their rights under Regulations (EU) 2016/679 or (EU) 2018/1725, in particular their rights to amend personal data or withdraw consent, including a link to an interface for exercising those rights (Article 19(1)(e)).
• Where you are not the political advertising publisher, ensure that the information in Article 19(1), points (c) and (e), is communicated to the publisher in a timely and accurate manner, by a standardized automated process where technically possible (Article 19(2)); present the information in Article 19 in a format that is easily accessible and, where technically feasible, machine-readable, clearly visible and user-friendly, in plain language (Article 19(4)).
• If you provide political advertising services, transmit to the controllers, as necessary, the information they need to comply with Article 19(1) and (2) (Article 19(3)).

Delegated Regulation (EU) 2025/2050 · Read the law's page

• If the Commission has designated your online platform or online search engine as a very large online platform or very large online search engine under Article 33(4) of the Digital Services Act, you are a data provider and the duties below apply to you (Article 2(5)).
• Open an account on the DSA data access portal that the Commission hosts (Article 3(4)).
• Establish a dedicated point of contact to provide information and support on the data access process, and communicate it to the Commission as soon as possible (Article 6(1) and (2)).
• Make available and easily findable on your online interfaces the details of that point of contact, a link to the DSA data access portal, a DSA data catalogue describing the data assets that may be accessed for the purposes of Article 40(4) of the Digital Services Act together with their data structure and metadata, and suggested access modalities for the data in the catalogue that are adequate to the level of sensitivity of the different data assets (Article 6(4)).
• Keep the catalogue and the suggested access modalities regularly updated, in particular to reflect data related to your risk assessments under Article 34 and your audits under Article 37 of the Digital Services Act (Article 6(5)).
• Give vetted researchers access to the data requested by the date stated in the reasoned request, under the access modalities it sets, until the date on which it states that access ends (Article 10(1)).
• Notify the Digital Services Coordinator of establishment within three working days that access has been provided to the vetted researchers in accordance with the reasoned request, and within three working days that their access has been terminated (Article 15(1)).
• Give vetted researchers any additional information needed to access and understand the requested data, such as codebooks, changelogs and architectural documentation. Where providing it may result in a significant vulnerability of your services, notify the Digital Services Coordinator of establishment of that risk and, where possible, propose alternative information (Article 15(2)).
• Do not impose on vetted researchers data management requirements such as archiving, storage, refresh and deletion requirements, or limits on the use of standard analytical tools, that may hinder their research, unless the reasoned request explicitly mentions them. Where personal data are processed, impose no conditions on the processing of the shared personal data other than those the reasoned request specifies (Article 15(3) and (4)).
• If you request mediation after disagreeing with the decision of the Digital Services Coordinator of establishment on an amendment request, make the request in writing within five working days of the Coordinator's communication of that decision, and bear all costs of the mediation (Article 13(1) and (6)).

Regulation (EU) 2024/1028, Article 6 · Read the law's page

• It reaches you if you provide an online short-term rental platform, an online platform within the meaning of Article 3, point (i), of Regulation (EU) 2022/2065 that allows guests to conclude distance contracts with hosts for the provision of short-term accommodation rental services, and you offer services to hosts providing those services in the Union, wherever you are established: when a competent authority issues an order under Article 6(3) or (6) requesting you to remove, or to disable access to, a listing relating to a unit, do so without undue delay.
• When a competent authority issues an order under Article 6(4) requesting you to provide further information so that it can verify the authenticity and validity of a registration number, provide that information. If the order requests you to remove, or to disable access to, a listing relating to the unit, do so without undue delay.
• Where a registration procedure applies and national law enables a competent authority to order you to provide requested information and to remove listings concerning units offered without a registration number or with an invalid registration number, or in cases involving the misuse of a registration number, comply with that order.

Regulation (EU) 2024/1028, Arts. 7-8 · Read the law's page

• It reaches you if you provide an online short-term rental platform, an online platform within the meaning of Article 3, point (i), of Regulation (EU) 2022/2065 that allows guests to conclude distance contracts with hosts for the provision of short-term accommodation rental services, and you offer services to hosts providing those services in the Union, wherever you are established: design and organize your online interface so that hosts must self-declare whether the unit is located in an area where a registration procedure has been established or applies.
• Where a host declares that its unit is in such an area, design and organize your online interface so that users can identify the unit through a registration number. Ensure that the host has provided a registration number before you allow the offering of the services for that unit, and that the host displays the number clearly as part of its listing.
• On receiving a host's self-declaration, and before you allow the host to use your services, make best efforts, using the lists Member States make available under Article 13(1), point (a), to assess whether the self-declaration is complete, where the assessment can be carried out proportionately by automated tools.
• After you allow a host to offer the services, make reasonable efforts to check at random, on a regular basis, the hosts' declarations about whether a registration procedure exists and, where one does, the validity of the registration number provided, using the functionalities of the single digital entry points.
• Inform the competent authorities and the hosts, without undue delay, of the results of those random checks concerning incorrect declarations of hosts, the misuse of a registration number or invalid registration numbers.
• Inform hosts adequately of the applicability in a given area of registration procedures, taking into consideration the lists Member States make available under Article 13 and the information in Annex I to Regulation (EU) 2018/1724.

COM(2026) 681 final · Read the law's page

• A provider of an online social networking service or video-sharing platform service would have to stop a person below the age of 15 from creating an account or using one, where the service poses a risk to the privacy, safety or security of a minor below that age; the proposal defines that risk by listed features, such as live streaming to an indeterminate audience, contact with people outside a user's existing connections, or a recommender system based on profiling.
• A provider that lets a guardian set up a limited account for a minor above 13 and below 15 would have to keep the tools for guardians always activated, let the guardian set a daily time limit of no more than one hour, and let the guardian pre-approve new contacts and cap the number of contacts.
• Within six months after the Regulation applies, a provider would have to establish whether holders of existing accounts are below 15, and disable the accounts of those established to be below 15 or whose age cannot be established.
• A provider bound by the minimum age would have to verify age exclusively through an EU age verification solution using an EU proof of age attestation, provided by a third party and certified under the EU Age Verification Scheme.
• A provider of an online social networking service, video-sharing platform service, online game, AI companion, general conversational chatbot or software application store would have to ensure a high level of privacy, safety and security of minors and design its service by default to the Chapter III requirements, departing from them only after establishing through age assurance that the user is an adult.
• A provider of a software application store would have to put in place an age-rating system for each application it offers, and would have to stop minors from accessing or buying applications that are inappropriate for their age under that system.
• A provider of an operating system that has obtained a user's age signal would have to enable sharing of that signal with in-scope providers, after obtaining the user's consent, when they need it to comply.
• A provider of an AI companion or general conversational chatbot would have to put in place proportionate and effective measures to protect minors, including enabling access for minors below 13 only through the tools for guardians.
• A provider using age assurance would have to use a solution that does not identify, locate, track or profile the person, and would have to process no more personal data than strictly necessary to assess whether the age threshold is met.
• A provider of an online social networking service or video-sharing platform service that is a designated very large online platform would have to notify the Commission of a compliance plan within four months of its designation, or within 30 days after the Regulation applies if already designated, and have the plan audited by independent auditors at its own expense.
• A provider would have to refrain from any behaviour, contractual, commercial or technical, that undermines compliance, and from using behavioural techniques or interface design to do so.

Directive (EU) 2024/2853 · Read the law's page

• The Directive does not apply to free and open-source software that you develop or supply outside the course of a commercial activity (Art. 2(2)).
• If you develop or produce software, or have it developed under your name or trademark, and make it available in the course of a commercial activity, you answer as its manufacturer for damage it causes by a defect (Arts. 4(1), 4(10) and 8(1)(a)).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control; a defect caused by their absence, or by software, updates or upgrades within your control, is not excused because it arose after you placed the product on the market (Art. 11(2)(b) and (c)).
• Meet the product safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in deciding whether it is defective (Art. 7(2)(f)), and failing a mandatory product safety requirement that protects against the damage suffered presumes it defective (Art. 10(2)(b)).
• Account for what your product learns or acquires after release: the effect of any ability to continue to learn or acquire new features after it is placed on the market is weighed in deciding whether it is defective (Art. 7(2)(c)).
• Keep technical documentation you could produce if a court orders disclosure; failing to disclose presumes the product defective (Arts. 9(1), 10(2)(a)).
• If you are outside the EU, the importer or your authorized representative answers for the product in your place (Art. 8(1)(c)).
• If you substantially modify a product outside its manufacturer's control and then make it available on the market or put it into service, you are treated as its manufacturer (Art. 8(2)).
• Do not count on a contract term to limit or exclude your liability to an injured person; Article 15 bars it.
• Be able to show when you placed the product on the market or put it into service: you are not liable if you prove you did not, or that the defect probably did not exist at that time (Art. 11(1)(a) and (c)).

Regulation (EU) 2025/2509, Article 14 · Read the law's page

• This duty takes effect on 1 August 2030 (Article 59, which applies the Regulation from that date). It reaches you if you provide an online marketplace, as defined in Article 3, point (14), of Regulation (EU) 2023/988, on which toys are sold or promoted: treat information referring to an offer of toys that are not in conformity with the Regulation as illegal content for the purposes of Regulation (EU) 2022/2065, subject to the measures established in that Regulation.
• Comply with the requirements of Articles 30 to 32 of Regulation (EU) 2022/2065 and Article 22 of Regulation (EU) 2023/988 for toys. Compliance is enforced within the enforcement structures set out in those Regulations.
• Design and organize your online interface, for the purposes of Article 31(2), point (c), of Regulation (EU) 2022/2065 and in addition to the information Article 22(9) of Regulation (EU) 2023/988 requires, so that economic operators can provide the CE marking referred to in Article 18(1), any warning to be clearly visible to the consumer before purchase in accordance with Article 6(3), and the data carrier or weblink through which the digital product passport is accessible.
• Treat a toy that does not comply with the particular safety requirements, or that complies with them but poses a risk to the health and safety of children or other persons, as a dangerous product for the purposes of compliance with Article 22 of Regulation (EU) 2023/988.