Digital Services Act Security Obligations Guide: Risk Assessments, Audits and Platform Duties

The Digital Services Act turns platform abuse, scams and manipulation into a regulated risk that security teams must assess, evidence and defend in front of an auditor. Regulation (EU) 2022/2065 is usually read as a content moderation law, but much of what it demands lands on security and fraud teams: detecting inauthentic and automated accounts, protecting notice and complaint systems from abuse, reporting threats to life to the police, and producing evidence that survives an annual independent audit. This guide explains who is covered, which obligations have a security component, where the law stands in October 2026, how it is enforced, and what it means for bots, AI agents and the machine identities that run platform operations. It is written for security, trust and safety, and GRC practitioners at online platforms, marketplaces, hosting providers and search engines that serve users in the EU.

Key takeaways

• Obligations stack by tier. Every intermediary service has baseline duties; hosting adds notice and action and criminal offence reporting; online platforms add complaints, trusted flaggers and dark pattern rules; very large services add systemic risk assessment and independent audit.
• Automated exploitation is named in the law. Article 34 requires very large services to analyse intentional manipulation of the service, including inauthentic use and automated exploitation, which is bot and fake account defence by another name.
• The audit is reasonable assurance, every year. Delegated Regulation (EU) 2024/436 sets the methodology, and a non-positive opinion triggers an implementation report within one month.
• Enforcement is now real. The Commission fined X EUR 120 million in December 2025 and Temu EUR 200 million in 2026, and opened proceedings against Booking.com over phishing and fraudulent listings in October 2026.
• Your own automation is in scope. Recommender systems, moderation classifiers and AI support agents are part of the "design and functioning" the risk assessment must cover, so their identities, permissions and logs become audit evidence.

Scope: who and what is covered

The DSA applies to providers of intermediary services offered to recipients in the EU, wherever the provider is established. Obligations are cumulative: each tier carries the duties of the tiers below it. Micro and small enterprises are exempt from most of the additional online platform duties (recital 57 and Article 19), unless designated as very large.

The 45 million threshold equals roughly 10 per cent of the Union population and is calculated as a six-month average (recital 76). Providers must publish user numbers at least every six months, and a designated service has four months from designation to comply with the very large tier. The Commission keeps the designation list on its DSA pages; on 31 August 2026 it designated ChatGPT as a very large online search engine and Reddit and Roblox as very large online platforms, according to the Commission's VLOP page.

The DSA sits alongside, not instead of, other EU law. Personal data processing in notice handling, account verification and age assurance remains subject to the GDPR (see the GDPR Compliance Guide for Security Teams), and many online marketplaces, search engines and social networks are also in scope of NIS2 for their own cyber security risk management (see the NIS2 Directive Guide).

Key obligations

The DSA does not contain an equivalent of NIS2's technical security article. Its security content sits inside process obligations that attackers target or that only security tooling can satisfy.

Duties for all hosting services and platforms

• Notice and action (Article 16): an easy, electronic way for anyone to report illegal content. These intake channels attract floods of automated or fraudulent notices, so rate limiting, abuse detection and integrity of the queue are part of making the mechanism work.
• Criminal offence notification (Article 18): a hosting provider that becomes aware of information giving rise to a suspicion of a criminal offence involving a threat to the life or safety of a person must promptly inform the law enforcement or judicial authorities of the Member State concerned. If that state cannot be identified with reasonable certainty, it may inform the authorities where it is established or where its legal representative is, or Europol. Recital 56 lists the content, the time of publication with time zone, the reason for the suspicion and information to locate the recipient as useful elements.
• Measures against misuse (Article 23): platforms must suspend, after warning, accounts that frequently provide manifestly illegal content, and suspend the processing of notices from those who frequently submit manifestly unfounded ones. Repeat-abuser detection is a security analytics problem.
• Dark patterns (Article 25): interfaces must not deceive or manipulate users. The X decision showed how this reaches security: the Commission found the paid blue checkmark deceptive because it increased exposure to scams, including impersonation fraud.
• Trader traceability (Article 30): marketplaces must collect and make reasonable efforts to verify trader information before allowing traders onto the platform.

Additional duties for very large services

• Systemic risk assessment (Article 34): at least once a year, and before deploying functionalities likely to have a critical impact on the risks. Four categories: illegal content; negative effects on fundamental rights, including privacy and data protection; negative effects on civic discourse, elections and public security; and negative effects on gender-based violence, public health, minors and well-being. Providers must consider recommender and other algorithmic systems, content moderation systems, terms and their enforcement, advertising systems and data-related practices, and must analyse intentional manipulation including inauthentic use or automated exploitation. Supporting documents are kept for at least three years.
• Mitigation (Article 35): eleven listed measures, including adapting design and interfaces, testing and adapting algorithmic systems, reinforcing internal processes, testing and supervision for detecting systemic risks, targeted child protection such as age verification, and marking generated or manipulated content that realistically resembles real people or events.
• Independent audit (Article 37): at least once a year, at the provider's expense, covering all Chapter III obligations and commitments under codes of conduct (Articles 45 and 46) and crisis protocols (Article 48).
• Data access (Article 40): data must be provided to the Commission and Digital Services Coordinators to monitor compliance, and to vetted researchers studying systemic risks. Terms that blocked independent collection of public data were part of the X decision under Article 40(12).
• Compliance function (Article 41): an independent function with sufficient authority and resources, whose head reports directly to the management body (recital 99).

The audit in detail

Delegated Regulation (EU) 2024/436, adopted on 20 October 2023 and published on 2 February 2024, sets the rules for these audits. The auditor works to a reasonable level of assurance, defined in the recitals as a high but not absolute level of confidence, and must start with an audit risk analysis covering inherent, control and detection risk for each audited obligation. Annex I and Annex II give mandatory templates for the audit report and the audit implementation report.

Timeline and current status

Status checked on 25 October 2026 against the Commission's DSA pages and the consolidated text.

The Commission keeps adding designations, delegated acts, guidelines and codes of conduct, so check its DSA pages before relying on any list here.

Enforcement and penalties

Enforcement is split. Each Member State appoints a Digital Services Coordinator that supervises providers established in its territory, and users complain to the coordinator in their own Member State. The Commission has primary responsibility for the additional obligations of very large services, with powers to request information, inspect, adopt interim measures and accept commitments.

The decisions so far show where regulators look. X was fined for a deceptive verification design that fed impersonation scams, for an advertising repository that did not allow effective scrutiny under Article 39, and for blocking researcher access under Article 40(12), and has appealed to the General Court. The Temu decision concerned its risk assessment of illegal products, including how recommender systems and influencer promotion could amplify them. The Booking.com proceedings concern whether it diligently assessed and mitigated risks from fraudulent listings and phishing. The pattern: fraud and impersonation enabled by platform design are now a systemic risk question.

What it means for AI agents and non-human identities

Three DSA themes involve machine identities directly.

• Hostile automation: "automated exploitation" and "inauthentic use" in Article 34 cover bot networks, fake account farms, automated notice flooding and scripted scams. Evidence for the risk assessment includes account creation velocity, bot detection precision, takedown times for coordinated inauthentic behaviour and the controls on API access. Abusive automation often runs through platform APIs, OAuth clients and developer keys. See the Account Takeover Prevention Guide.
• Your own AI agents: moderation classifiers, recommender systems and AI support assistants are part of the service's design and functioning. If an assistant can change account recovery details, its failure becomes a user safety and fraud risk. The Meta AI Instagram account takeover showed this in 2026: an AI support assistant sent password reset links to attacker-supplied email addresses for 20,225 people, while accounts with two-factor authentication were protected. Agents that touch credentials need deterministic verification outside the model, least privilege and full logging. See the AI-Driven Account Takeover Guide.
• Service accounts behind compliance systems: the pipelines that feed transparency reports, the advertising repository and researcher data access run on service accounts and API keys. If those identities are over-privileged, the data access obligation becomes a data leakage risk; if they are unmonitored, audit evidence can be altered without trace. Inventory them, scope them to read-only where possible and log their use. See the NHI Security Platform Buyer's Guide for capability areas.

Compliance steps

1. Classify each service. Decide per service whether it is mere conduit, caching, hosting, an online platform or a candidate for very large status, record the reasoning and the user count method, and refresh every six months.
2. Map obligations to owners. Build a register that ties each article to a control owner, a system and evidence; give the security team explicit ownership of Article 18 referrals, abuse of notice and complaint channels, and automated exploitation analysis.
3. Harden the regulated workflows. Apply rate limits, bot detection, authentication and integrity logging to notice intake, complaint handling, trusted flagger portals and law enforcement request channels. Verify that requests claiming to come from authorities are authentic before acting.
4. Run the systemic risk assessment as a security exercise as well. Include threat intelligence on fraud and influence operations, red team results against recommender and moderation systems, and abuse of AI features. Reassess before any functionality with likely critical impact goes live.
5. Test mitigations, then keep testing. For each Article 35 measure define a metric and a test, run it in a pilot market or shadow mode first, keep a rollback switch for ranking or moderation changes, and record outcomes for the auditor.
6. Prepare audit evidence continuously. Keep complete populations with timestamps, control descriptions in the auditor's language, and three years of risk assessment records. Run a dry-run audit against Delegated Regulation 2024/436 before the first real one.
7. Close findings on time. Plan for the one-month implementation report: pre-assign owners for each likely finding area and track remediation in the same system as security findings.

Small versus large providers: a small hosting provider can meet its duties with a documented notice form, an Article 18 runbook and an annual transparency report. A very large service needs a standing compliance function, a risk assessment programme with its own data pipelines and an audit-ready control library, which in practice means joining up trust and safety, security, fraud and GRC tooling.

Detection and measurement

• Median time from valid notice to action, split by content category and by automated versus human decision.
• Share of new accounts flagged as automated or inauthentic and the false positive rate on appeal.
• Article 18 referrals: count, and time from awareness to notification of authorities.
• Abusive notice rate: proportion of notices found manifestly unfounded and the number of submitters suspended under Article 23.
• Audit findings: number of "positive with comments" and "negative" conclusions year on year, and percentage closed within the committed timeframe.
• Privileged automation coverage: share of service accounts and AI agents with an owner, scoped permissions and logging.

Common failure patterns

• Treating the DSA as a legal team project: the risk assessment then omits fraud, bots and account takeover, which is exactly where the Commission has acted.
• Design-only mitigations: measures documented but never tested, which an auditor working to reasonable assurance will not accept.
• Incomplete populations: notices and complaints split across tools, so no one can prove every case was handled.
• Unverified authority requests: orders and data requests acted on without checking the sender, inviting fraudulent emergency data requests.
• AI support agents with recovery powers: letting a language model decide ownership before changing credentials, as in the Meta case above.

Framework mapping

Practitioner checklist

• Confirm each EU-facing service's DSA tier and record the user count method.
• Assign a security owner for Article 18 referrals with a 24/7 route to authorities and Europol.
• Protect notice, complaint and authority request channels against automation, spoofing and flooding.
• Add automated exploitation, fraud and account takeover scenarios to the Article 34 risk assessment.
• Test every Article 35 mitigation with a defined metric, pilot and rollback plan.
• Inventory AI agents and service accounts that support moderation, recovery and data access, and scope their permissions.
• Keep three years of risk assessment evidence and complete case populations for audit sampling.
• Check auditor independence against the 12-month non-audit services rule before engagement.
• Pre-plan the one-month audit implementation report process.

Standards and references

• EUR-Lex: Regulation (EU) 2022/2065 (Digital Services Act)
• Springlex: Commission Delegated Regulation (EU) 2024/436 on audits of very large online platforms and search engines (consolidated text)
• European Commission: The Digital Services Act
• European Commission: Supervision of the designated very large online platforms and search engines under the DSA
• Springlex: DSA Article 37, Independent audit (consolidated text)
• Springlex: DSA Article 34, Risk assessment (consolidated text)
• eucrim: EU Fines X EUR 120 Million in First DSA Non-Compliance Decision
• Slaughter and May: European Commission fines Temu EUR 200 million under the DSA

Related NHI Mgmt Group resources: GDPR Compliance Guide for Security Teams · NIS2 Directive Guide · EU AI Act Compliance Guide · Global Privacy Regulatory Map. This guide summarises the security-relevant obligations of the EU Digital Services Act and is not legal advice.