European UnionDigital Services Act, Article 35(1)(k) (systemic risk mitigation, synthetic media marking)
Regulation (EU) 2022/2065, Article 35(1)(k)
In force since .
An AI transparency rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location
- Obligation class
- Content labelling, Governance, DPIA
- Audit expectation
- none
What it requires
- This is one listed risk-mitigation measure for a Commission-designated very large online platform or search engine, not a freestanding labeling mandate on every provider
- Where it applies, ensure generated or manipulated content that would falsely appear authentic is distinguishable by prominent markings when presented on the platformNIST AI RMFMEASURE 2.8
- Offer an easy-to-use function for flagging that contentNIST AI RMFMEASURE 3.3
These lines are LexLint's reading of the law's text. Also read by: European Commission (guidance, recorded ).
In the frameworks
- NIST AI RMF
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
- MEASURE 3.3Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Article 74(1): the Commission may fine a very large online platform or search engine up to 6% of its total worldwide annual turnover for a Section 5 systemic-risk infringement, with no fixed sum stated. Article 52(3) sets the same 6% ceiling for a Member State's own civil penalty against a provider of intermediary services outside the Commission's exclusive jurisdiction.
- Rule
- Turnover pct only
- As of
- Currency
- EUR
- Turnover percentage cap
- 6
Who enforces it
Enforcement body
The European Commission, which holds exclusive power to supervise and enforce this obligation for a designated very large online platform or search engine. The Member State where a provider has its main establishment enforces the Regulation's other obligations for other providers of intermediary services through its Digital Services Coordinator and any other competent authority it designates under Article 49.
Enforcement record
Counts the Commission's own non-compliance decisions imposing a fine on a designated very large online platform under the Digital Services Act, from its 'Supervision of the designated very large online platforms and search engines under DSA' page, updated , which lists three such decisions in the twelve months to : X, EUR 120 million on , the Commission's first DSA non-compliance decision; Temu, EUR 200 million on ; and AliExpress, EUR 550 million on . The three decisions total EUR 870 million. No decision to date breaks a fine down by the specific measure within Article 35(1)'s illustrative list, so this is the Commission's Union-level Digital Services Act enforcement record as a whole, not specific to the synthetic-media-marking measure in point (k) alone. The twelve months before carried none of the Commission's own DSA fines, so trend reads rising off the register's own dates.
- As of
- Trend
- Rising
- Currency
- EUR
- Source link
- https://digital-strategy.ec.europa.eu/en/policies/list-designated-vlops-and-vloses
- Fines per year
- 870,000,000
- Actions per year
- 3
- First enforcement date
Settledness
The Commission guidelines on the mitigation of systemic risks for electoral processes (Communication C/2024/3014, ) recommend this marking measure in paragraph 40, point (b), and are written for electoral processes.
- As of
- Guidance link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52024XC03014
- Guidance body
- European Commission
- Open questions
- Does the Commission expect a provider of a very large online platform or search engine to apply the Article 35(1)(k) markings to deepfakes that carry no electoral risk, when the Commission guidelines that recommend the marking measure are written for the mitigation of systemic risks for electoral processes?
- Does the guidelines' addition of content that depicts 'events as real that did not happen or misrepresent them' widen the Article 35(1)(k) marking measure beyond an item of information that 'appreciably resembles existing persons, objects, places or other entities or events'?
What it makes you log
Logging duty
Point (k) is one of the listed systemic-risk mitigation measures a designated very large online platform or search engine may adopt: mark generated or manipulated content that would falsely appear authentic, and offer a function letting recipients flag it. It states no duty to create, keep, or later produce a record of the marking or of a flag.
- Kind
- None
- As of
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32022r2065
What this law does
As one of the listed, non-exhaustive systemic-risk mitigation measures a designated very large online platform or search engine may adopt, the provider should ensure that generated or manipulated content resembling real persons, objects, places, or events, and that would falsely appear authentic, is distinguishable through prominent markings when presented on the platform, alongside an easy-to-use flagging function.
This is materially narrower than AI Act Article 50: it binds only Commission-designated very large online platforms (VLOPs) and very large online search engines (VLOSEs) as a risk-mitigation option, not every provider or publisher as a freestanding labeling mandate.
Article 92 provides that this Regulation applies to a provider of a very large online platform or search engine designated under Article 33(4) from four months after the Commission's notification of that designation, where the notification date is earlier than , the Regulation's general application date.
The Commission's first designation decisions under Article 33(4) took effect on for platforms including Facebook, Instagram, TikTok, and X, so this Article's obligations began applying to that cohort from , four months later.
When LexLint raises it
When your app profile says your app generates content with AI.
Back to the example · Lint your app
Page updated .