- Home
- Suite features
- Systemic risk assessment (DSA)
Systemic risk assessment for very large platforms, Articles 34 to 38
A DSA systemic risk assessment is the annual review that very large online platforms and search engines (VLOPs and VLOSEs) owe under Article 34 of the EU Digital Services Act (DSA) once the Commission designates them. The suite's VLOP Cockpit structures it: four rated categories, an Article 35 checklist, a submissions log. It records your draft; it does not assess it.
- Art. 34(1)(a)–(d) rating
- Art. 35 mitigation checklist
- Art. 24 · 39 · 42 log
- Art. 34(2) risk factors · not modelled
- Art. 37 audit · not performed
What does a DSA systemic risk assessment have to cover?
Article 34(1) requires designated providers to identify, analyse and assess any systemic risks in the Union stemming from the design, functioning and use of their service, weighed by severity and probability. The assessment must include at least four named categories; the suite's rating cards shorten two of them.
| Art. 34(1) | What the Regulation names | Label in the suite |
|---|---|---|
| (a) | Dissemination of illegal content through the service | Illegal content |
| (b) | Actual or foreseeable negative effects on fundamental rights, among them dignity, private life, data protection, expression and media pluralism, non-discrimination, children's rights, consumer protection | Fundamental rights |
| (c) | Such effects on civic discourse and electoral processes, and public security | Civic discourse + electoral processes (public security not named) |
| (d) | Such effects in relation to gender-based violence, the protection of public health and minors, and serious negative consequences to physical and mental well-being | Public health + minors (gender-based violence and well-being not named) |
Article 34(2) adds factors to examine 'in particular', from recommender systems and content moderation to advertising, data practices and intentional manipulation. Duties below the VLOP layer are sorted on the DSA compliance tool page.
The 45 million figure alone designates nobody. The VLOP obligations — Section 5 of Chapter III, Articles 33 to 43 — apply from four months after the Commission notifies its designation decision (Art. 33(1), (4), (6) DSA). The cockpit says so and links the Commission's list of designated VLOPs and VLOSEs.
From the first click to a rated category
Open /suite/#dsa. Sub-sections cannot be deep-linked; step 4 names the sidebar items.
- Confirm the legal notice. Once per browser; the DSA quick check stays closed until you accept it.
- Choose the DSA card. The four-step quick check follows: EU users and establishment, service type, VLOP threshold, features. Closing it sends you to Home.
- Answer as a platform or search engine above the threshold. Pick 'Online platform' or 'Online search engine', then '45 million or more'. That answer alone marks the seeded service 'Designated VLOP/VLOSE by EU Commission (Art. 33 DSA)'; the quick check cannot see a designation decision.
- Open 'VLOP Cockpit' in the DSA sidebar. Five cards (Art. 34 to 38) and the designation note; indented below, 'Risk Assessment (Art. 34)', 'Mitigation (Art. 35)', 'Trusted Flagger (Art. 22 DSA)', 'Repository (Art. 24/39)' and, for four sector archetypes, 'Template Preview'.
What the VLOP Cockpit records, and on which article
| Capability | Legal basis (DSA) | Output |
|---|---|---|
| VLOP risk assessment | Art. 34(1)(a)–(d) | Severity Low to Critical and a justification per category; JSON download |
| Mitigation checklist | Art. 35(1) | Twelve templates with an 'Applied' box, plus your own measures |
| Trusted-flagger view | Art. 22 DSA | Status pill and a static five-step intake diagram |
| Repository log | Art. 17, 24(5), 39, 42 | Local entries marked Open / Submitted / Confirmed |
Twelve templates, tied to risks
Each shows the categories it addresses. Eight are DSA risk mitigation measures of the kind Article 35(1) lists, such as recommender tuning and minor protection; four name separate duties (Articles 24, 37, 40, 41). Design, terms and conditions and deepfake labelling (Art. 35(1)(a), (b), (k)) have no template; add them as custom measures.
The cockpit's button 'Export DSA VLOP compliance report as DOCX' needs the deep-analysis engine, which is not in the browser edition (what that edition exports): after a client-data form it stops with 'Deep-analysis engine not connected'.
The German-language Template Preview flags its assumptions; the full template needs a separate mandate with the law firm Theo Funk, and the Article 34 assessment stays the provider's own duty. The tour 'VLOP risk convergence' in cross-regulation mapping sets Art. 34/35 DSA beside Art. 9 AI Act (Annex III from 2 December 2027, Annex I from 2 August 2028, Regulation (EU) 2026/1744).
A hypothetical US social network, rated once
Assume a US company with no EU establishment runs a designated short-video network: uploads, a recommender feed, targeted ads, minors among the recipients. Company and ratings are invented.
- Quick check. The answers seed one social-network service with the tier chip 'VLOP (Art. 33-43)'. With no EU establishment, 'Art. 13 EU Representation' opens too; its mail button goes to the law firm, while the appointed Article 13 role is offered by Regingada UG (section 6).
- Risk Assessment. The trust-and-safety lead rates illegal content High, fundamental rights Medium, civic discourse High (two elections ahead), public health + minors Critical; the (d) justification adds gender-based violence and well-being.
- Mitigation. She ticks algorithm tuning, minor-protection features and election-period protocols.
- Export. 'Export risk report (L8)' saves ratings and justifications only, so the ticked measures go to outside counsel in a covering note, with the auditor's question: reasonable, proportionate, effective (Article 35(1))?
A marketplace at designation scale is walked through in the fictional EuroMarktplatz model case.
The limits, stated plainly
- Below the VLOP/VLOSE tier, the cockpit and its four sub-sections show 'VLOP obligations not currently applicable'; the Template Preview stays hidden. That label is not the law: Article 17 DSA (statements of reasons to users whose content is restricted) binds every hosting service, Articles 22 (trusted flaggers) and 24(5) (filing those statements with the Commission) every online platform except micro and small enterprises (Art. 19); 'Obligations' and 'Transparency & Repository' list them.
- No methodology: no probability scale, no Article 34(2) factor analysis, no evidence upload.
- The mitigation list has no owner, date, rationale or effectiveness field, although Article 35(1) asks for effective measures.
- The trusted-flagger view (notices from bodies a national regulator recognises) is a stub: its track-record counter stays at 0 and there is no notice queue.
- Articles 36 to 38 are information cards: no crisis workflow, audit file or recommender check.
- One record per browser, not per service: a provider's VLOP and VLOSE share a single Article 34 file.
- Entries stay in this browser's localStorage; no account, no server copy. Only the Article 34 record exports; clearing site data or deleting your profile erases everything. Details in the Trust Center.
Frequently asked questions
What are the four systemic risk categories in DSA Article 34?
At least four (Article 34(1)(a) to (d)): (a) dissemination of illegal content, plus actual or foreseeable negative effects (b) on fundamental rights, (c) on civic discourse, electoral processes and public security, and (d) in relation to gender-based violence, the protection of public health and minors, and serious negative consequences to physical and mental well-being. The suite shortens (c) and (d); note what they omit in the justification.
How often must a VLOP carry out a systemic risk assessment?
At least once a year (Article 34(1)): first by the date the VLOP duties apply, four months after the Commission notifies the designation (Article 33(6)), and again before deploying any functionality likely to have a critical impact on the identified risks. Supporting documents are kept for at least three years (Article 34(3)).
What is the 45 million user threshold, and does crossing it make you a VLOP?
It counts average monthly active recipients of the service in the Union, a figure providers publish at least every six months (Article 24(2)). Crossing it does not by itself make you a VLOP: the Commission's decision under Article 33(4) designates, and the duties apply four months after notification (Article 33(6)). The quick check cannot see that decision; check the Commission's list.
What does the DSA independent audit under Article 37 cover?
Compliance with all Chapter III due-diligence obligations and with commitments under codes of conduct and crisis protocols, audited at least once a year at the provider's expense by an independent organisation (Article 37(1), (3)). The opinion is positive, positive with comments or negative; a report that is not positive calls for an audit implementation report within one month (Article 37(4), (6)).
What must a VLOP publish about its risk assessment?
The results of the risk assessment, the mitigation measures, the audit report, the audit implementation report and, where applicable, information on consultations, at the latest three months after each audit report (Article 42(4)). Confidential or security-sensitive passages may be removed if the complete versions go, with reasons, to the Commission and the Digital Services Coordinator of establishment, the national DSA regulator (Article 42(5)).
Can the suite submit statements of reasons to the DSA Transparency Database?
No. 'Repository (Art. 24/39)' is a local log of entries you mark Open, Submitted or Confirmed by hand. Nothing leaves your browser: it neither feeds the Commission's database nor builds the DSA ad repository (Article 39). The Article 24(5) submission duty binds every online platform that is not a micro or small enterprise (Article 19), not only VLOPs.
Severity is a judgement, not a field
In a DSA systemic risk assessment, the suite holds the rating; it cannot say whether a risk is systemic, whether High survives the evidence, whether a mitigation meets Article 35(1), or what Article 42(5) lets you remove from the public reports. The law firm Theo Funk, an independent practice, can assess those questions under a separate mandate; Regingada UG is owned by Theo Funk, a German attorney (Rechtsanwalt). The Article 37 audit belongs to an organisation meeting Article 37(3), not to software.
For a provider without an EU establishment, Regingada UG (haftungsbeschränkt) can act as appointed DSA legal representative under Article 13; VLOP designation does not replace that duty. The role gives no legal advice.