Short answer
The EU Digital Services Act (DSA) requires a designated very large online platform (VLOP) or very large online search engine (VLOSE) to assess risks created by its whole service—not simply to list controversial posts. At least annually, and before launching a feature likely to have a critical impact, it must examine how its design, algorithms, advertising, moderation, terms and possible manipulation create systemic risks in the European Union.
It must then adopt measures that are reasonable, proportionate, effective and tailored to the risks found. That can mean changing product design, giving users better controls, reducing algorithmic amplification, labelling manipulated media, improving local-language expertise or adjusting advertising. Removing content is only one possible tool.
Freedom of expression is part of both the risk assessment and the limit on mitigation. A provider should distinguish illegal content from lawful material that may contribute to a wider risk, choose measures that do not unnecessarily suppress lawful speech, explain restrictions, and provide effective complaint and redress routes. The DSA therefore does not create a general obligation to remove “misinformation”, nor does it authorise indiscriminate automated filtering.
Who has the systemic-risk duty?
The special regime applies to an online platform or search engine that the European Commission has designated under DSA Article 33. The threshold is 45 million average monthly active recipients in the EU, but crossing it is not enough on its own: the Commission adopts a designation decision. The duties then apply according to the four-month timetable in Article 33(6). The DSA has applied generally since 17 February 2024.
The Regulation covers services offered to people in the EU, regardless of provider location. “Text with EEA relevance” does not itself extend this EU conclusion to the EEA.
In Amazon EU v Commission, T-367/23, the General Court upheld Amazon Store's designation and rejected the claim that applying Articles 34–43 to large marketplaces was disproportionate. It confirms the regime's scope, not the correct mitigation for a particular risk.
What must the risk assessment examine?
Article 34 starts with the service architecture and its use:
“Providers of very large online platforms and of very large online search engines shall diligently identify, analyse and assess any systemic risks in the Union stemming from the design or functioning of their service and its related systems, including algorithmic systems, or from the use made of their services.” —
The assessment must be specific to the service and proportionate to the severity and probability of the risk. It is due at least once each year and before a functionality likely to have a critical impact is deployed. This makes pre-launch testing important; an annual compliance document cannot cure a major feature released without understanding its effects.
Four groups of risk must be covered:
- dissemination of illegal content;
- actual or foreseeable harm to specified fundamental rights, including expression and information, media freedom and pluralism, privacy, data protection, non-discrimination and children’s rights;
- harm to civic discourse, elections and public security; and
- harm involving public health, minors, physical or mental well-being, gender-based violence and related concerns.
The provider must test how algorithms, moderation, terms, advertising and data practices influence those risks. It must also consider manipulation, rapid amplification, and regional and linguistic differences.
This is wider than deciding whether individual content is illegal. Lawful but misleading material may contribute to a systemic risk through amplification or coordinated use. Yet that does not convert the material into “illegal content”: under DSA Article 3(h), illegality must come from applicable EU law or Member State law that complies with EU law.
What counts as proportionate mitigation?
The governing standard is deliberately functional rather than a fixed removal quota:
“Providers of very large online platforms and of very large online search engines shall put in place reasonable, proportionate and effective mitigation measures, tailored to the specific systemic risks identified pursuant to Article 34, with particular consideration to the impacts of such measures on fundamental rights.” —
A defensible approach links each measure to a documented risk and tests both effectiveness and side effects. The DSA’s examples allow a graduated response:
- Change the system before silencing speakers. Adjust interface design, recommendations, advertising incentives or virality features; add user controls or friction; and mark synthetic media.
- Target conduct and amplification precisely. Address coordinated inauthentic behaviour, bots or repeated manipulation rather than treating a disputed viewpoint as unlawful.
- Improve decisions. Add local-language and contextual expertise, train moderators, test error rates, and allocate resources to risks actually found.
- Use content restrictions on a clear basis. Identify whether action rests on law or published terms, and calibrate removal, demotion or other restrictions to the evidence and likely harm.
- Measure results and rights impacts. Reassess effectiveness, disproportionate effects and whether a less restrictive design would work.
The Commission’s non-binding 2024 election-risk guidelines illustrate this approach. They recommend meaningful feed choices, transparent methods for reducing prominence, fact-check labels, local expertise and third-party scrutiny. For legal but harmful generative content, they specifically call for attention to political expression, parody and satire. Those guidelines inform Article 35; they do not amend it or create a free-standing power to censor lawful speech.
Where does freedom of expression constrain the response?
Charter Article 11 protects the freedom to hold opinions and to receive and impart information, and requires respect for media freedom and pluralism. Article 52 supplies the legal test for restrictions:
“Any limitation on the exercise of the rights and freedoms recognised by this Charter must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others.” —
The Charter binds EU institutions and Member States when implementing EU law; not every private moderation decision is government censorship. The DSA nevertheless translates rights protection into provider duties. Article 14(4) requires diligent, objective and proportionate enforcement of terms with due regard to expression and media pluralism, while Article 35 requires rights impacts to shape mitigation.
The Court of Justice’s Grand Chamber judgment in Case C-401/19, Poland v Parliament and Council concerned copyright filtering under a different EU measure, not the DSA. Its Charter analysis nevertheless identifies a central danger of automated moderation:
“a filtering system which might not distinguish adequately between unlawful content and lawful content, with the result that its introduction could lead to the blocking of lawful communications, would be incompatible with the right to freedom of expression and information, guaranteed in Article 11 of the Charter” —
The judgment emphasises clear rules, minimum safeguards and a fair balance where automation interferes with rights. It is not a DSA judgment, but explains why providers should test false positives, avoid filters requiring unresolved legal judgments, and preserve lawful quotation, criticism and parody.
Process safeguards are part of mitigation
Rights protection cannot depend only on a model’s accuracy. The DSA creates procedural checks around restrictions:
- Article 8 prevents authorities from imposing a general monitoring or active fact-finding obligation.
- Article 14 requires clear terms and proportionate enforcement.
- Article 17 requires a clear, specific explanation for removal, demotion, account action or other covered restrictions, including the legal or contractual ground and available redress.
- Article 20 provides a free internal complaint route and requires complaint decisions to be supervised by qualified staff, not made solely by automated means.
- Article 21 preserves out-of-court settlement and access to courts.
- Articles 37 and 42 add independent audit and public reporting for VLOPs and VLOSEs.
Reversal rates, reason quality and complaints can reveal that mitigation is overbroad, biased in one language or ineffective against the behaviour causing harm.
What does enforcement practice show?
In a 5 August 2024 addressee-specific decision—not a final infringement finding—the Commission made TikTok's commitment to withdraw its Lite Rewards programme in the EU and avoid circumvention binding. The concerns involved pre-deployment assessment and feature design, showing that compliance can target a product mechanism rather than opinions.
A practical decision framework
Before approving a mitigation, a provider should be able to answer:
- What specific Article 34 risk, population, territory and language does the evidence identify?
- Is the target illegal content, a terms violation, coordinated behaviour, amplification, advertising or product design?
- What is the measure’s legal or contractual basis?
- Why should it work, and what less restrictive options were tested?
- How many lawful communications could be removed or demoted incorrectly?
- Are political speech, journalism, minority languages, parody and satire handled accurately?
- Will affected users receive reasons and meaningful human-supervised redress?
- What effectiveness, error, complaint and reversal evidence will trigger adjustment?
Conclusion
Very large platforms and search engines comply with the DSA by treating systemic risk as a product, governance and evidence problem—not as a licence to delete unpopular information. They must assess the service before critical changes and at least annually, connect each measure to a documented risk, and test whether it is effective and proportionate. Freedom of expression shapes both sides of that exercise: it is a right whose impairment is itself a systemic risk, and it limits the measures used to address other risks. Precise design changes, transparent rules, qualified review, reasons and redress are therefore not optional extras; they are central to lawful mitigation.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.