Compliance audit under the Digital Services Act (DSA)

The services, contracting entities, place of establishment, recipients in the EU and information storage or dissemination functions are inventoried. A business’s own presentation website does not automatically become an online platform; a marketplace with third-party traders may fall within a category with additional obligations.

The exceptions and thresholds applicable to micro and small enterprises are checked, without treating them as a general exemption from the entire regulation. VLOP/VLOSE obligations are distinct from those of ordinary platforms.

• mere conduit, caching or hosting;
• online platform and marketplace;
• individual or business recipients;
• average monthly number of recipients in the EU;
• moderation, advertising and recommendation functions.

The terms must explain restrictions, policies, procedures and moderation tools in clear language, including algorithmic decision-making and human review where relevant. Changes must be managed and communicated in accordance with the applicable obligations.

Contact points for authorities and users must be accessible and monitored. The need for a legal representative in the EU is assessed for providers established outside the Union that offer services in the EU.

For the hosting services covered, the mechanism for notifying allegedly illegal content must be easily accessible and allow sufficiently precise and adequately substantiated notices. Decisions must be made diligently, objectively and promptly, in accordance with the applicable obligations.

When content or an account is restricted, the statement of reasons and avenues of redress must be assessed according to the service category. Online platforms may have obligations concerning a free internal complaint-handling system and out-of-court dispute settlement.

The audit may cover transparency reports, advertisements, recommender systems, dark patterns, protection of minors and trader traceability for marketplaces, to the extent that each obligation applies to the operator.

Logs, reasons for decisions, timings, access, retention and control owners are checked. The result is a prioritised register of non-compliance, with the legal basis, risk, action, responsible person and evidence of closure.