European UnionDigital Services Act (DSA), Articles 34 to 36 (Risk assessment, mitigation of risks and crisis response mechanism)
Regulation (EU) 2022/2065, Arts. 34-36
In force since .
A transparency and process rule binding private bodies.
As of .
What it requires
- If the Commission designates your online platform or online search engine as a very large online platform or very large online search engine under Article 33(4), the duties below apply to you from four months after it notifies you of the decision (Article 33(6)).
- Diligently identify, analyse and assess any systemic risks in the Union stemming from the design or functioning of your service and its related systems, including algorithmic systems, or from the use made of your services. Carry out the assessment by the date from which the obligations apply to you, at least once every year thereafter, and in any event before deploying functionalities that are likely to have a critical impact on the risks identified.
- Make the assessment specific to your services and proportionate to the systemic risks, taking into consideration their severity and probability. Include the dissemination of illegal content through your services; any actual or foreseeable negative effects for the exercise of fundamental rights; any actual or foreseeable negative effects on civic discourse and electoral processes, and public security; and any actual or foreseeable negative effects in relation to gender-based violence, the protection of public health and minors and serious negative consequences to a person's physical and mental well-being.
- Take into account, in particular, whether and how the design of your recommender systems and any other relevant algorithmic system, your content moderation systems, your applicable terms and conditions and their enforcement, your systems for selecting and presenting advertisements, and your data related practices influence those risks. Also analyse whether and how intentional manipulation of your service, including inauthentic use or automated exploitation, and the amplification and potentially rapid and wide dissemination of illegal content and of information incompatible with your terms and conditions, influence them, taking into account specific regional or linguistic aspects.
- Preserve the supporting documents of each risk assessment for at least three years after it is performed and, upon request, communicate them to the Commission and to the Digital Services Coordinator of establishment.
- Put in place reasonable, proportionate and effective mitigation measures, tailored to the specific systemic risks identified under Article 34, with particular consideration to the impacts of such measures on fundamental rights. The measures may include adapting the design, features or functioning of your services, your terms and conditions and their enforcement, your content moderation processes, your algorithmic, recommender and advertising systems and your internal processes; cooperating with trusted flaggers and implementing the decisions of out-of-court dispute settlement bodies; cooperating with other providers through the codes of conduct and the crisis protocols; awareness-raising measures; and targeted measures to protect the rights of the child, including age verification and parental control tools.
- If the Commission adopts a crisis decision under Article 36 addressed to you, assess whether and to what extent the functioning and use of your services significantly contribute to the serious threat, identify and apply specific, effective and proportionate measures to prevent, eliminate or limit that contribution, and report to the Commission by the date or at the regular intervals the decision specifies.
If you get it wrong
Private right of actionYes
Penalty structure
Article 74(1) lets the Commission fine the provider of a very large online platform or very large online search engine, where it finds that the provider intentionally or negligently infringes the relevant provisions of the Regulation, up to 6 % of its total worldwide annual turnover in the preceding financial year. Article 74(2) caps the fine for supplying incorrect, incomplete or misleading information, failing to reply, failing to rectify information or refusing an inspection at 1 % of the total annual income or worldwide turnover in the preceding financial year.
- Rule
- Turnover pct only
- As of
- Turnover percentage cap
- 6
Who enforces it
Enforcement body
The European Commission, which has exclusive powers to supervise and enforce Section 5 of Chapter III (Article 56(2)).
What it reaches
Obligation class
DPIA, Governance, Reporting
Applicability criteria
- As of
- Combinator
- All of
- Criteria
- a number of average monthly active recipients of the service in the Union equal to or higher than 45 million
- designated as very large online platforms or very large online search engines pursuant to paragraph 4
What this law does
Article 92 applies the Regulation to a provider of a very large online platform or very large online search engine designated under Article 33(4) from four months after the notification of the designation, where that date is earlier than . The Commission's first designation decisions under Article 33(4) are dated , so for the providers designated then Articles 34 to 36 apply from .
Article 34 requires a provider of a very large online platform or very large online search engine to diligently identify, analyse and assess any systemic risks in the Union stemming from the design or functioning of its service and its related systems, including algorithmic systems, or from the use made of its services.
It must carry out the risk assessments by the date of application referred to in Article 33(6), second subparagraph, at least once every year thereafter, and in any event before deploying functionalities that are likely to have a critical impact on the risks identified.
The assessment must be specific to its services and proportionate to the systemic risks, and must include the dissemination of illegal content, negative effects for the exercise of fundamental rights, negative effects on civic discourse, electoral processes and public security, and negative effects in relation to gender-based violence, the protection of public health and minors and serious negative consequences to a person's physical and mental well-being.
It must take into account whether and how the design of its recommender systems and other algorithmic systems, its content moderation systems, its terms and conditions and their enforcement, its systems for selecting and presenting advertisements, and its data related practices influence those risks.
It must preserve the supporting documents of the risk assessments for at least three years after they are performed and, upon request, communicate them to the Commission and the Digital Services Coordinator of establishment. Article 35 requires such a provider to put in place reasonable, proportionate and effective mitigation measures, tailored to the specific systemic risks identified under Article 34, with particular consideration to the impacts of such measures on fundamental rights.
The measures the Article lists as possible include adapting the design, features or functioning of the service, its terms and conditions, its content moderation processes, its algorithmic, recommender and advertising systems and its internal processes, cooperating with trusted flaggers and implementing the decisions of out-of-court dispute settlement bodies, cooperating through codes of conduct and crisis protocols, awareness-raising measures, and targeted measures to protect the rights of the child.
Article 36 allows the Commission, acting upon a recommendation of the Board where a crisis occurs, to adopt a decision requiring one or more such providers to assess whether and how their services significantly contribute to a serious threat, to identify and apply specific, effective and proportionate measures to prevent, eliminate or limit that contribution, and to report to the Commission by the date or at the intervals the decision specifies.
A crisis is deemed to have occurred where extraordinary circumstances lead to a serious threat to public security or public health in the Union or in significant parts of it. The choice of the specific measures remains with the provider addressed by the decision.
When LexLint raises it
When your app profile says your app reuses other publishers' content, operates a social platform or serves under-18s.