Designated VLOPs and VLOSEs must meet full DSA obligations by 1 January 2027

1 January 2027

By 1 January 2027, designated Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) must comply with enhanced obligations under the Digital Services Act (DSA). This deadline requires these entities, including platforms like ChatGPT, Reddit, and Roblox, to have implemented robust systemic risk assessments and mitigation strategies.

These designated VLOPs and VLOSEs, identified by the European Commission based on user numbers, must proactively identify and address a broad spectrum of systemic risks. This includes risks related to the dissemination of illegal content, fundamental rights, public health, and civic discourse. Organisations must establish internal compliance functions, conduct independent audits of their risk management frameworks, and provide transparency reports on content moderation decisions and algorithmic systems.

Demonstrable evidence of compliance will require comprehensive documentation of risk assessments, the specific mitigation measures implemented, and the results of independent audits. Data protection officers (DPOs) and privacy counsel should ensure that these new obligations are integrated into existing governance structures, particularly concerning data processing activities and user rights. The work involves a significant uplift in transparency requirements and accountability for platform design choices.

Controllers must be prepared to engage with the European Commission and national Digital Services Coordinators, providing access to data and methodologies used in risk assessments. This proactive engagement is crucial for demonstrating adherence to the DSA's stringent requirements and avoiding potential enforcement actions.

Digital Services Act (DSA) sets 1 January 2027 as the point of effect, and the preparation it requires sits with teams who are measured on other work, which is why this date slips rather than the obligation being misread.