What is the difference between DSA obligations for very large online platforms and smaller services?

Why the DSA treats very large platforms differently

The Digital Services Act does not apply a one-size-fits-all model. It distinguishes between very large online platforms and search engines, and smaller services, because scale changes the potential for systemic harm. As the service footprint grows, so does the expectation that providers understand how their design, recommender logic, moderation choices, and business model can affect large numbers of users.

For very large services, the legal test is not just whether an issue exists, but whether the platform’s size and reach can amplify it. That is why the regime is built around proportional obligations, heightened oversight, and more explicit scrutiny of systemic risk. Smaller services are still regulated, but the burden is lighter where the risk profile is materially lower.

This tiered structure is central to the DSA’s policy logic. It aims to avoid imposing the same compliance load on every intermediary while still requiring all services to understand their role, map their obligations, and operate within the rules that apply to their category.

What changes when a service becomes very large

Once a platform crosses the threshold for very large status, the compliance picture changes from general service obligations to a more intensive governance model. That typically means stronger expectations around risk assessment, transparency, mitigation, auditing, and accountability for how the service shapes information flows at scale.

In practice, the difference is less about a separate legal universe and more about an additional layer of duties attached to systemic significance. The European Commission has stronger supervisory interest in these services because the consequences of design choices, ranking systems, or content governance can extend well beyond a single user community.

For a platform team, this means the question is not only “are we compliant?” but “can we demonstrate that our controls are proportionate to the service’s reach and impact?” That is a different operational bar from a smaller service, where the main task is usually to meet the obligations that attach to its service type without the same systemic-risk apparatus.

What smaller services still need to get right

Smaller and medium-sized enterprises are not exempt from the DSA as a whole. They may be exempt from certain heavier requirements, but they still need to identify which duties apply to them and evidence that they have assessed scope correctly. That matters because compliance failures often come from assuming that “smaller” means “outside scope” rather than “subject to a narrower set of obligations.”

The practical distinction is therefore one of proportionality, not immunity. A smaller service should still maintain a clear mapping of its role in the ecosystem, its notice-and-action or reporting duties where relevant, and any operational controls needed to satisfy the obligations that do apply. A service can be below the VLOP or VLOSE threshold and still face meaningful regulatory consequences if it misclassifies itself or neglects its applicable duties.

For readers who want the security-side interpretation of the regime, NHIMG’s Digital Services Act Security Obligations Guide is the most direct way to connect the legal tiers to the operational controls that matter in practice.

How to assess the right obligation set in practice

The first step is to classify the service correctly, then separate the obligations that apply to all intermediaries from the additional obligations that attach to larger providers. That sequence matters because teams often overfocus on headline thresholds and underfocus on the day-to-day duties that remain in force regardless of size.

For legal and compliance owners, the most useful control question is whether the service can show a defensible scope analysis, a current obligations register, and evidence that the governance model matches the service category. If that evidence is weak, the organisation usually has a classification problem before it has a remediation problem.

For teams building or operating platform services, the safest pattern is to treat the DSA as a proportional obligations framework: document the category, identify the duties that flow from it, and then scale controls to the actual exposure rather than to the company’s internal headcount or brand size.

Practitioner Guidance: Prioritise classification evidence first, because most avoidable DSA mistakes start with a bad scoping decision rather than a failed control.

Practitioner takeaway: The core difference is not whether the law applies, but how much governance, assurance, and systemic-risk evidence the provider must be able to produce.

Related resources from NHI Mgmt Group

• How should very large online platforms prepare for independent audits under the DSA?
• Why does the Digital Services Act create operational risk for large online platforms?
• What is the difference between general content moderation and the DSA compliance model for very large platforms?
• Why do large OAuth platforms need different governance than smaller IAM systems?