EU digital regulation · Analysis
What implementing the Digital Services Act actually requires
Read from outside the European Union
The obligations are the easy part. Any legislature can copy them. What the Digital Services Act presupposes is an enforcement apparatus — a regulator with real powers, a way to pay for supervision, courts able to review it, and civil society organisations able to take up the roles the text assigns them. The European Union’s own experience since February 2024 shows how much of that has to be built, and how easily it is not.
Fatima Ghilassene, avocate at the Lille Bar — 8 September 2026
The text transposes; the threshold does not
The DSA stacks four tiers of duties. All intermediary services owe transparency reporting (Art. 15). Hosting services owe notice and action. Online platforms owe an internal complaint-handling system (Art. 20), out-of-court dispute settlement (Art. 21), trusted flaggers (Art. 22) and their own reporting (Art. 24). Above them sit very large online platforms and search engines, designated at 45 million average monthly active users in the Union (Art. 33), which must assess systemic risks (Art. 34), mitigate them (Art. 35), open their data to scrutiny (Art. 40) and report on all of it (Art. 42).
Reproducing that architecture is a drafting exercise. Setting the top threshold is not. Forty-five million is close to ten per cent of the Union’s population — a proportion, not a number, and one chosen for a market of some 450 million people. Transposed literally into a country of forty million, it designates nobody. Transposed proportionally, it may designate every significant service at once and create a supervisory load no new authority can carry in its first years. The threshold is the first real policy decision, and it is usually treated as a technical detail.
Designating a regulator is easy. Empowering it is not.
Every Member State had to designate a Digital Services Coordinator, give it the powers listed in Article 51, and lay down rules on penalties, by 17 February 2024. On 7 May 2025 the Commission referred five of them to the Court of Justice. Poland had neither designated nor empowered a coordinator. Czechia, Cyprus, Spain and Portugal had designated one without entrusting it with the necessary powers. All five had failed to adopt rules on penalties.
That is fifteen months after the deadline, inside the jurisdiction that wrote the instrument, among States that voted for it. The lesson for a legislature building its own framework on this model is precise: naming an authority in a statute costs nothing and proves nothing. What matters is whether the same statute gives that authority powers of investigation, on-site inspection, interim measures and sanction — and whether the penalty regime is in the law rather than deferred to a later text that is never adopted.
Supervision has to be paid for, and the payment mechanism can fail
The DSA funds the Commission’s supervision of the largest services through an annual fee charged to the designated providers themselves, capped at 0.05 % of worldwide annual net income for the preceding financial year (Art. 43). The principle is attractive to any regulator: those supervised pay for the supervision, and the budget scales with the size of the problem.
It is also fragile. On 10 September 2025 the General Court annulled the Commission’s decisions setting the 2023 fee for Facebook, Instagram and TikTok (T-55/24 and T-58/24). The reason was not the fee itself but the instrument: the methodology for counting average monthly active users was an essential element of the scheme and had to be adopted by delegated act, not by an implementing decision. The Court provisionally maintained the effects of the annulled decisions, for no more than twelve months from the date the judgments become final, so that the Commission can adopt the methodology properly.
Two things follow. A levy on the supervised is workable, but it must rest on an instrument robust enough to survive judicial review, and the parameter that determines who pays and how much belongs in the higher-ranking text. And a jurisdiction whose courts cannot annul the regulator’s act does not have a simpler version of this problem. It has a different one.
Part of the enforcement is delegated to bodies that must already exist
Three provisions of the DSA transfer real work to actors outside the state. Trusted flaggers, whose notices platforms must treat with priority, are certified by the Digital Services Coordinator (Art. 22). Out-of-court dispute settlement bodies, which decide disputes over content decisions, are certified by the same authority (Art. 21). Vetted researchers may obtain access to platform data (Art. 40).
None of this is self-executing. The delegated act organising researcher access was adopted on 2 July 2025 — setting up a data access portal and a vetting procedure run by the coordinators — and the first researchers could be vetted from October 2025. That is more than a year after the DSA became fully applicable, and close to three years after it entered into force.
For a country whose civil society organisations are few, under-funded or concentrated in one city, these articles are not a transparency mechanism. They are an industrial policy for civil society, and they take years. Adopting them without funding the organisations that are supposed to use them produces provisions that are formally in force and practically empty.
What does not travel, and what must be provided for
The DSA allocates supervision between the Member State in which a provider is established and the Commission, which holds exclusive competence over the largest services for the obligations that concern them (Art. 56). That allocation is specific to the Union. It rests on mutual recognition, on a common court, and on the assumption that a decision taken in one State is effective in the twenty-six others. It cannot be transposed as it stands.
It does not need to be. A country acting alone can organise the same function differently — a single authority, a division of labour between a sector regulator and a competition or consumer body, a specialised chamber within an existing one. Who supervises is an institutional choice, and each jurisdiction can make it from the bodies it already has. Nothing in the substance of the obligations depends on reproducing the European split.
One provision, however, has to be there, and it is the one without which the rest is unenforceable: the obligation for a service with no establishment on the territory to designate a legal representative there, with an address at which it can be served and a person who can be held to account (the DSA does this at Art. 13). Without it, the obligations exist and no one can be reached. With it, the ordinary machinery of notification, investigation and sanction becomes available against a provider located anywhere.
What enforcement looks like once it works
On 20 July 2026 the Commission fined AliExpress €550 million for failing to assess diligently, and to mitigate effectively, the risk of dissemination of illegal, unsafe and counterfeit products — counterfeit clothing, unsafe toys, dangerous cosmetics. It is the largest DSA decision to date, and it came two and a half years after the regulation became fully applicable.
That is the realistic pace. A legislature that builds a comparable regime and expects visible results in the first eighteen months will spend that period explaining why nothing has happened. The counterpart is that when a decision does come, it is built on the platform’s own risk assessments and audit reports — documents the regulation obliged the platform to produce. The transparency obligations are not decoration; they are what makes the sanction provable.
The opposite reading, which is also defensible
Everything above argues that the DSA is expensive to implement. The contrary view deserves to be stated, because it is held by serious people and because it bears directly on what a country with limited capacity should do.
On that reading, the transparency and procedural obligations — statements of reasons, complaint handling, reporting, publication of ranking and advertising parameters — can be adopted on their own and still change behaviour, because they shift the burden of explanation onto the platform and give courts and consumers something to work with, without requiring a supervisory apparatus at all. Systemic risk assessment, which is the costly part, could be left aside or deferred. The objection to that approach is that obligations without a supervisor become disclosure that nobody reads. The objection to the objection is that disclosure nobody reads is still admissible evidence.
Which of the two is right depends on something a comparative study cannot supply: whether the courts of the country concerned are usable, quickly, by the people the rules are meant to protect.
Six questions before building on this model
- Which authority supervises, and does the statute give it powers of investigation, inspection, interim measures and sanction — or only a mandate?
- Are the penalties in the primary legislation, or deferred to an instrument that may never be adopted?
- Who funds supervision, and does the instrument setting the levy rank high enough to survive review?
- At what size does a service become subject to the heaviest duties, and what does that threshold designate in this market?
- Which organisations could act as trusted flaggers or dispute settlement bodies on the first day, and who funds them?
- Does the law require a service with no local establishment to designate a representative on the territory, at an address where it can be served and with a person who can be held to account?
All sources cited here were verified on 8 September 2026 against primary sources: the text of Regulation (EU) 2022/2065, the Commission’s decisions and press releases, and the judgments of the General Court. Legal positions evolve; anyone relying on this note for a legislative or advisory purpose should check each reference again.
Read: is the European model stable?