EU Digital Services Act (DSA) — AI Transparency Obligations: AI Compliance Requirements
The EU Digital Services Act (Regulation 2022/2065) has been in force for all online platforms since February 17, 2024. For businesses operating online platforms that serve EU users, Article 27 requires disclosure of the main parameters used in recommender systems (algorithmic ranking, personalization). Article 38 prohibits profiling of minors for advertising. Article 26 requires transparency about AI-targeted advertising. Very Large Online Platforms (45M+ monthly EU active users) have additional obligations.
Summary of publicly-available regulatory text as of 2026-08-22. Verify against current official sources before relying on this for compliance decisions. Not legal advice.
Key Facts
February 17, 2024
6% of global annual turnover (individual infringements); 1% for providing incorrect information to European Commission; periodic penalty payments up to 5% of average daily turnover
What Your Business Must Do
4 compliance requirements identified. Critical requirements carry the highest risk of enforcement action.
Systemic Risk Assessment (VLOPs Only — 45M+ EU Users)
CriticalVery Large Online Platforms must conduct annual systemic risk assessments of their AI recommendation, moderation, and advertising systems. Assessments must cover: dissemination of illegal content, fundamental rights risks, electoral integrity risks, and public health/safety risks from algorithmic amplification. Results submitted to European Commission.
Deadline: February 17, 2025
DSA Art. 34-36Recommender System Transparency (Article 27)
High PriorityIf your online platform uses recommender systems (algorithms that rank, prioritize, or personalize content for EU users), you must provide at least one option that is not based on profiling, and clearly disclose the main parameters used in recommendations. Post this information in an easily accessible, plain-language notice on your platform.
Deadline: February 17, 2024
DSA Art. 27No Profiling-Based Advertising for Minors (Article 38)
High PriorityDo not present targeted advertising based on profiling to users you know are under 18 years old. If your platform is accessed by minors, implement age verification or profiling-free advertising for all users who might be minors.
Deadline: February 17, 2024
DSA Art. 28(2)AI Advertising Transparency (Article 26)
Medium PriorityFor each AI-targeted advertisement shown to EU users: identify it clearly as an advertisement, identify who paid for it, and (for targeted ads) explain the main reasons the specific user was targeted. This applies to all online advertising including AI-optimized ad delivery.
Deadline: February 17, 2024
DSA Art. 26Who Does This Apply To?
DSA applies to "online platforms" and "online search engines" offering services to EU recipients. Coverage tiers: (1) ALL online platforms: basic transparency obligations (Arts. 26-27 advertising and recommender disclosure); (2) Very Large Online Platforms (VLOPs) with 45M+ monthly EU active users: systemic risk assessments, algorithmic audits, real-time ad library, researcher data access; (3) Very Large Online Search Engines (VLOSEs): same obligations as VLOPs. Key exclusion: B2B services (platforms where recipients are only businesses, not consumers) have lighter obligations. Horizontal regulation — applies across all sectors.
Recent Enforcement Actions
Against: X (Twitter)
Following formal DSA proceedings opened 2023-12-18, the European Commission fined X €120 million — the first-ever DSA penalty — for: (1) deceptive design of the "blue checkmark" verified-account system; (2) lack of transparency of its advertising repository; (3) failure to provide researchers adequate access to public platform data. X designated a VLOP (45M+ EU users). X has launched a legal challenge (first judicial challenge to a DSA fine), pending as of this cycle.
SourceAgainst: TikTok
Irish DPC fined TikTok €345M under GDPR (decision adopted 2023-09-01) for children's-data violations in 2020: public-by-default platform settings, an ineffective "Family Pairing" feature, dark-pattern design, and inadequate age verification. This is a GDPR children's-data matter, NOT a DSA recommender-system/advertising-transparency action.
SourceAgainst: TikTok
Irish DPC fined TikTok €530M (€45M for GDPR Art. 13(1)(f) transparency failures + €485M for GDPR Art. 46(1) unlawful transfers) for transferring EEA user data to China without demonstrating an essentially equivalent level of protection. TikTok ordered to bring processing into compliance within 6 months or suspend China transfers; TikTok is appealing.
SourceRecent Regulatory Guidance
EU DSA — Transparency-reporting templates (Implementing Reg. (EU) 2024/2835) + Art. 27 recommender duty
On 4 Nov 2024 the Commission adopted Implementing Regulation (EU) 2024/2835, harmonising the DSA transparency-REPORTING templates (a quantitative and a qualitative content-moderation template in Annexes I–II), applicable from the 2025 reporting period. Separately, DSA Art. 27 requires platforms to set out, in their terms and in plain language, the MAIN PARAMETERS of each recommender system and any options to modify/influence them; the Commission has not issued a fixed "recommender disclosure template", so Art. 27 is met by clear plain-language parameter disclosure rather than a prescribed form.
SourceKey Case Law & Precedent
European Commission v. Meta (DSA child-protection + addictive-design proceedings)
European Commission Formal Proceedings · 2024Commission opened formal DSA proceedings against Meta (Facebook + Instagram) in May 2024 over child-protection obligations (Arts. 28, 34, 35) and researcher data access. The Commission issued preliminary (non-final) findings: self-declaration-based age verification is inadequate — children can bypass it by simply entering a false birth date, with no verification system catching it (adopted 2026-04-29), and "addictive design" features (infinite scroll, autoplay, push notifications, highly personalised recommenders) breach DSA obligations because Meta did not adequately assess their physical/mental-wellbeing risk to minors and vulnerable adults (adopted 2026-07-10). TikTok and Meta were also preliminarily found in breach of the researcher-data-access duty.
Outcome: PRELIMINARY FINDINGS ONLY as of this cycle — no final decision or fine issued. If confirmed, Meta faces a fine of up to 6% of global annual turnover under Art. 74(1) — reported as potentially exceeding ~€11bn/$12bn based on Meta's 2025 revenue (~$201bn).
Case referenceQuarterly Enforcement Digest
Q4 2025 - Q3 2026: DSA enforcement now includes a concluded, fined case, not just open investigations. 2025-12-05: Commission issued the first-ever DSA fine, €120M against X, for deceptive verified-account design, non-transparent ad repository, and blocked researcher data access — X is judicially challenging it, the first such challenge to any DSA penalty. Meta remains under open proceedings with two 2026 preliminary (non-final) findings: inadequate self-declaration age verification (May 2026) and "addictive design" infinite-scroll/autoplay/push-notification practices (July 2026), each carrying up to 6% global-turnover exposure if confirmed. Separately (GDPR, not DSA): TikTok carries two large Irish DPC fines — €345M (2023, children's-data settings) and €530M (2025-05-02, unlawful China data transfers, under appeal). Key practical action for non-VLOP platforms: publish recommender system disclosure page, ensure AI ad targeting identifies targeting reasons to EU users, audit for minor profiling. For VLOPs: treat the X fine as proof algorithmic-transparency and researcher-access duties are now actively enforced with real penalties, not just open investigations.
Digest covers enforcement actions, guidance, and regulatory developments. Last verified: 2026-08-22.
Industry Playbooks covering EU Digital Services Act (DSA) — AI Transparency Obligations
These industry playbooks include jurisdiction-specific checklist items and guidance for EU Digital Services Act (DSA) — AI Transparency Obligations.
Frequently Asked Questions
Does EU Digital Services Act (DSA) — AI Transparency Obligations apply to my business?
The EU Digital Services Act (Regulation 2022/2065) has been in force for all online platforms since February 17, 2024. For businesses operating online platforms that serve EU users, Article 27 requires disclosure of the main parameters used in… Use Aegis Firma's free scanner to get a personalized assessment in under 5 minutes.
What is the penalty for non-compliance?
The maximum penalty under EU Digital Services Act (DSA) — AI Transparency Obligations is: 6% of global annual turnover (individual infringements); 1% for providing incorrect information to European Commission; periodic penalty payments up to 5% of average daily turnover. Fines are typically scaled by company size, severity of violation, and whether violations were willful or accidental.
How do I comply with EU Digital Services Act (DSA) — AI Transparency Obligations?
The 4 requirements above cover the core obligations. The fastest path to compliance is: (1) conduct an AI risk assessment, (2) document your AI systems, (3) implement transparency disclosures where required. Aegis Firma generates all required documents automatically.
Official Source
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2065Last updated: 2026-08-22 — verify at source before relying on this information.
Don't leave compliance to chance
Aegis Firma scans your AI tools, tells you exactly which regulations apply, and generates all required documents — in 30 minutes.
Start your free compliance scan