The Digital Services Act for smaller platforms and marketplaces: the obligations that apply below the big-tech tier

Who the DSA covers

Regulation (EU) 2022/2065, the Digital Services Act, sets rules for intermediary services offered to users in the EU, wherever the provider is established. It uses layered categories. Mere conduit and caching services, such as network and some infrastructure providers, have the lightest duties. Hosting services, which store information provided by users, have more. Online platforms, which store and disseminate information to the public at users’ request, have more again, and online marketplaces that let consumers conclude contracts with traders have additional duties.

Very large online platforms and search engines with more than 45 million monthly active users in the EU carry the heaviest obligations and are supervised by the European Commission. Most businesses are far below that threshold, but can still be hosting services or online platforms under the DSA.

Examples include a B2C marketplace connecting independent sellers with consumers, a job board where employers post vacancies, a review site, a community forum, a booking platform listing third-party accommodation, or a software product where users publish content to others.

Obligations for all intermediary services

Every intermediary service must designate a single point of contact for authorities and one for users, publish how they can be reached, and, if established outside the EU, appoint a legal representative in a member state.

Terms and conditions must include information on any restrictions imposed on users’ content, including content moderation policies, procedures, measures and tools, such as algorithmic decision-making and human review, in clear and unambiguous language. Providers must also act on orders from authorities against illegal content and to provide information.

Transparency reporting on content moderation applies to intermediary services generally, but micro and small enterprises are exempt unless they are very large online platforms.

Hosting services: notice and action

Hosting services must provide easy-to-access, user-friendly electronic mechanisms that allow anyone to notify them of content they consider illegal. Notices should allow the submission of a sufficiently precise explanation, the exact location of the content, the notifier’s name and email address in most cases, and a statement of good faith.

Providers must process notices in a timely, diligent, non-arbitrary and objective manner, confirm receipt where contact details are provided and inform the notifier of their decision. When content is removed, disabled, demoted or accounts are restricted, the provider must give the affected user a clear and specific statement of reasons.

Online platforms

Online platforms have additional duties, but micro and small enterprises are exempt from most platform-specific obligations in Section 3 of the DSA, unless they have been designated as very large platforms. Medium and larger platforms, and those that grow beyond small enterprise size, need to plan for them.

Internal complaints

A free internal system for users to complain about moderation decisions for at least six months after a decision.

Out-of-court dispute settlement

Information about certified dispute settlement bodies users can turn to.

Trusted flaggers

Priority processing of notices from trusted flaggers designated by national coordinators.

No deceptive design

Interfaces must not deceive or manipulate users or materially impair their ability to make free and informed decisions.

Advertising transparency

Users must be able to see that content is an advertisement, on whose behalf it is shown and the main parameters used to target them.

Recommender systems

Terms must explain the main parameters of recommender systems and any options to modify them.

Protection of minors

Appropriate measures for privacy, safety and security of minors, and no profiling-based advertising where the platform is aware with reasonable certainty that the user is a minor.

Online marketplaces

Marketplaces that allow consumers to conclude distance contracts with traders must ensure trader traceability. Before allowing traders to offer products, the marketplace must obtain information such as the trader’s name and contact details, identification document, payment account details, registration in a trade register where applicable and a self-certification committing to offer only products that comply with EU law, and must make reasonable efforts to assess whether that information is reliable.

Marketplaces must also design their interfaces so traders can comply with pre-contractual information, compliance and product safety information obligations, and they must make reasonable efforts to inform consumers who bought illegal products they become aware of. These duties interact with product safety rules such as the General Product Safety Regulation.

Enforcement

Each member state designates a Digital Services Coordinator responsible for supervising providers established in its territory, apart from very large platforms supervised by the Commission. Penalties for failing to comply can reach up to 6% of annual worldwide turnover, set by member states within the DSA’s limits.

For smaller providers, the practical risk often comes from complaints by users, competitors or authorities after a moderation dispute or illegal product, rather than proactive audits.

Building compliance into the product

Many DSA obligations are product features: a notice form linked to each piece of content, moderation tooling that records decisions and generates statements of reasons, trader onboarding with document collection and verification, ad labels and targeting explanations, and settings for recommender systems.

Designing them into the platform early is much cheaper than retrofitting them after launch. Record keeping is essential throughout, because providers must be able to explain decisions to users, dispute bodies and authorities. This article is a general overview and not legal advice.

Where this sits in what we do

This article covers one decision inside a wider engagement. The solution page sets out how that engagement runs, what it includes and what it costs to find out.

• Custom Business Platform — A platform built around how your business actually runs — customer portal, internal tooling, database and the automation between them.
• The EU AI Act: what actually applies from 2 August 2026
• Belgium's B2B e-invoicing mandate: the January 2026 big bang
• Domains for European markets: country domains, .eu and one site with local folders
• Donation pages for associations and nonprofits: removing the friction between intent and gift
• All insight articles