Understanding the EU Digital Services Act: Impact, Obligations, and Audits for Online Platforms

The DSA and AI Act will overlap on a few provisions, especially on enabling transparency of recommendation systems. While procedural modalities are yet to be clearly outlined, both legislations are envisaged to complement each other in achieving user safety, platform accountability and AI trust objectives. This is visible in the following ways:

• The recitals of the AI Act highlight that adherence to the legislation should facilitate VLOPs in fulfilling their broader obligations concerning risk assessment and risk mitigation as stated in Article 34 and 35 of the DSA.
• The AI Act’s recitals also imply that the authorities assigned under the DSA should serve as enforcement entities responsible for implementing the provisions related to AI recommender systems outlined in the AI Act.

While both legislations are geared towards safeguarding users and increasing platform accountability, the DSA addresses these objectives from a societal lens, slightly different from the OSB’s approach of focusing on individual harms. The OSB divides services into different categories depending on their size and deemed risk, as opposed to the DSA’s focus on ‘online platforms’, which include social media platforms, search engines, online marketplaces and hosting services, among others. Further, while the DSA treats all kinds of illegal content equally, the OSB contains different obligations for different types of illegal content. Finally, the DSA will be enforced by the EU Commission and Digital Services Coordinators – government entities – while the OSB will be enforced by Ofcom, the UK’s independent communications regulator.

It is difficult to anticipate whether the list of VLOPs and VLOSEs will be expanded (or shortened) soon, with companies like Zalando already suing the European Commission over their inclusion in the list.

Independent auditing requirements under Article 37 of the DSA only apply to VLOPs and VLOSEs, whereas audit provisions mentioned in the AI Act apply to providers and deployers of High Risk AI Systems (HRAIS) spanning across sectors (biometrics, critical infrastructure, HRTech, Insurance, etc) as mentioned in Annex III of the legislation. This key difference aside, DSA Audits will focus on providing third-party assurance on several online safety platform requirements (provided in Chapter III of the DSA), while AI Act audits will focus on providing third-party assurance on Quality Management Systems established by HRAIS providers and deployers.

Under the EU AI Act, Generative AI tools will be subject to strict transparency obligations, with providers of such applications required to inform users when a piece of content is machine-generated, deploy adequate training and design safeguards, as well as publicly disclose a summary of copyrighted materials used to develop their models. This is part of an entirely new article (28b) which was introduced in the European Parliament’s May 2023 iteration of the AI Act.

However, the current iteration of the DSA does not cover generative AI yet, creating what academics call a ‘dangerous regulatory gap'. However, it seems like the European Commission has taken note of this discrepancy by including generative models in its recent draft rules on auditing algorithms under the DSA. Ultimately, it will be interesting to see whether these regulations will complement each other to create a comprehensive governance regime that is able to keep pace with the rapidity of generative AI.