European UnionDigital Services Act, Article 37 (independent audit of very large online platforms and search engines)
Regulation (EU) 2022/2065, Article 37, supplemented by Commission Delegated Regulation (EU) 2024/436
In force since .
An AI governance rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location
- Obligation class
- Governance, Reporting
- Audit expectation
- periodic
- Who audits it
- Independent third party
- Where the report goes
- Filed with regulator, Published
What it requires
- If you are a Commission-designated very large online platform or very large online search engine, commission an independent audit, at your own expense and at least once a year, of your compliance with Chapter III's due diligence obligations, including the systemic-risk mitigation measures for generated and manipulated content, and with any codes of conduct or crisis protocols you have joined.NIST AI RMFMEASURE 1.3
- Select an auditing organisation that is independent of you and free of conflicts of interest: it must not have supplied you or a legal person connected to you non-audit services related to the matters audited in the twelve months before the audit began, must have committed not to supply them in the twelve months after it is completed, must not have audited you for more than ten consecutive years, and must not be paid on a result-contingent basis.NIST AI RMFMEASURE 1.3
- Cooperate with the auditing organisation: give it access to the data, premises, and personnel it needs, and do not hamper, unduly influence, or undermine the audit.NIST AI RMFMEASURE 1.3
- Where the audit report is not positive, adopt an audit implementation report within one month of receiving the operational recommendations, describing the measures you took, or explaining why you did not and what you did instead (Article 37(6)).NIST AI RMFMANAGE 1.3
- Transmit the audit report and the audit implementation report to your Digital Services Coordinator of establishment and the Commission without undue delay, and make them public, with confidential information removed where necessary, within three months of receiving the audit report.NIST AI RMFGOVERN 4.2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 4.2Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly.
- MEASURE 1.3Internal experts who did not serve as front-line developers for the system and/or independent assessors are involved in regular assessments and updates. Domain experts, users, AI actors external to the team that developed or deployed the AI system, and affected communities are consulted in support of assessments as necessary per organizational risk tolerance.
- MANAGE 1.3Responses to the AI risks deemed high priority, as identified by the MAP function, are developed, planned, and documented. Risk response options can include mitigating, transferring, avoiding, or accepting.
- NIST AI 600-1
- GAI-RISK-09Information Security
- MIT mitigations Draft
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.2.2-5AI-specific incident management and recovery plans that are created, tested and maintained.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Article 74(1): the Commission may fine a very large online platform or search engine up to 6% of its total worldwide annual turnover for a Section 5 systemic-risk infringement, which includes non-compliance with the Article 37 independent-audit duty, with no fixed sum stated. Article 52(3) sets the same 6% ceiling for a Member State's own civil penalty against a provider of intermediary services outside the Commission's exclusive jurisdiction.
- Rule
- Turnover pct only
- As of
- Currency
- EUR
- Turnover percentage cap
- 6
Who enforces it
Enforcement body
The European Commission, which holds exclusive power to supervise and enforce this obligation for a designated very large online platform or search engine. The Member State where a provider has its main establishment enforces the Regulation's other obligations for other providers of intermediary services through its Digital Services Coordinator and any other competent authority it designates under Article 49.
Enforcement record
Counts the Commission's own non-compliance decisions imposing a fine on a designated very large online platform under the Digital Services Act, from its 'Supervision of the designated very large online platforms and search engines under DSA' page, updated , which lists three such decisions in the twelve months to : X, EUR 120 million on , the Commission's first DSA non-compliance decision; Temu, EUR 200 million on ; and AliExpress, EUR 550 million on . The three decisions total EUR 870 million. The register lists each fine without naming the provision it enforces, so this is the Commission's Union-level Digital Services Act enforcement record as a whole, not specific to the audit obligation. The twelve months before carried none of the Commission's own DSA fines, so trend reads rising off the register's own dates.
- As of
- Trend
- Rising
- Currency
- EUR
- Source link
- https://digital-strategy.ec.europa.eu/en/policies/list-designated-vlops-and-vloses
- Fines per year
- 870,000,000
- Actions per year
- 3
- First enforcement date
Settledness
The Commission's page on DSA transparency says that in October 2023 it published a delegated act providing a framework to guide very large online platforms, very large online search engines and auditing organisations in preparing audit reports.
- As of
- Open questions
- Which entities are 'any legal person connected to that provider' for the independence test in Article 37(3), point (a), and does the 12-month bar on 'non-audit services related to the matters audited' reach an auditor's advisory work on a platform's AI systems?
What it makes you log
Who may demand the log
Auditor or notified body
What the log must hold
Decision basis, Human involvement
Logging duty
Article 37 requires a designated very large online platform or search engine to cooperate with its independent auditor, including by giving the auditor access to all relevant data. Commission Delegated Regulation (EU) 2024/436 spells out what that data includes for the systemic-risk mitigation measures: the provider's own reports on risk assessment and risk mitigation for the audited period, the supporting documents behind them, and past reports covering earlier periods. Article 37 never uses the word log, but the audit cannot happen unless the provider has already produced and kept these reports.
- Kind
- Implicit
- As of
- Provision
- Article 37(2) and (3), supplemented by Commission Delegated Regulation (EU) 2024/436, Article 14(3)
Why the legislator wanted it
- As of
- Quote
- providers of very large online platforms and of very large online search engines should be accountable, through independent auditing, for their compliance with the obligations laid down by this Regulation
- Source link
- https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng
- Source kind
- Recital
- Purpose
- accountability_demonstration
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32022r2065
What this law does
Article 37 requires a Commission-designated very large online platform or very large online search engine, one with 45,000,000 or more average monthly active recipients in the Union, to commission an independent audit, at its own expense and at least once a year, of its compliance with the whole of Chapter III's due diligence obligations, not only the AI-relevant systemic-risk mitigation measure for generated and manipulated content in Article 35(1)(k), and with any codes of conduct or crisis protocols it has undertaken.
Article 37 is not itself an AI-facing duty; it is the audit machinery that sits over a body of obligations that happens to include the AI-relevant ones.
The auditing organisation must be independent of the provider and free of conflicts of interest, must not have supplied non-audit services related to the matters audited to the provider or a legal person connected to it in the twelve months before the audit began, must have committed not to supply them in the twelve months after it is completed, must not have audited the same provider for more than ten consecutive years, and may not be paid on a result-contingent basis; Commission Delegated Regulation (EU) 2024/436 supplements Article 37 with procedural rules on selecting and cooperating with the auditor, scoping the audit period, and drawing up the audit report and audit implementation report on the Regulation's own templates.
The audit report must name the provider and the auditor, describe the elements audited and the methodology, summarise the findings, list third parties consulted, and reach an audit opinion of 'positive', 'positive with comments', or 'negative'; where the opinion is not positive, the provider must adopt, within one month, an audit implementation report describing the measures it took or its reasons for not taking them.
The provider must transmit both reports to its Digital Services Coordinator of establishment and the Commission without undue delay, and make them public, in a version stripped of confidential information where necessary, at the latest three months after receiving the audit report.
Article 37 sits, like Article 35, in Chapter III Section 5 (Articles 33 to 43), so Article 92's anticipated-application rule applies to it too: the obligation binds a designated very large online platform or search engine from four months after the Commission's notification of that designation, where that date precedes the Regulation's general application date of .
The Commission's first designations took effect on for platforms including Facebook, Instagram, TikTok, and X, so the audit duty began applying to that cohort from .
When LexLint raises it
When your app profile says your app reuses other publishers' content, generates content with AI, makes high-risk automated decisions, operates a social platform or serves under-18s.
Back to the example · Lint your app
Page updated .