Digital Services Act: what it requires of your business, not only of the big platforms

Who the DSA applies to

The DSA applies to intermediary services offered to recipients established in the European Union, wherever the provider is based. The test is the type of service, not the size of the company or its turnover. A self-employed person running a forum falls within its scope just like a multinational.

What changes with size and function is the number of obligations. The regulation organises them into four cumulative tiers, so each category meets its own obligations plus all those of the tiers before it.

Most Spanish companies sit in the second or third tier without knowing it.

The obligations that reach every intermediary

Four duties apply to every provider, whatever its size. They are the most overlooked because they require diligence rather than technology, and for that very reason they are the first thing an authority checks.

Single point of contact and legal representative

Every provider must designate a single point of contact and publish it in an accessible way, so that both authorities and users can reach it. A generic form buried in the footer will not do.

If the company is outside the European Union but offers services within it, it must also appoint a legal representative in a Member State. That representative can be held liable for breaches of the regulation, which makes the appointment a decision with consequences that should not be taken lightly.

Terms and conditions and transparency reports

The terms of service must explain clearly any restriction imposed on users’ information, including content moderation policies and any algorithmic decision-making tools used. Vague wording is no longer enough.

On top of that comes a public annual report on moderation activity, with the number of orders received from authorities and of complaints handled. Micro and small enterprises are exempt from this report, which is the first significant exemption in the regulation.

What is added if you host third-party content

Hosting services take on the notice and action mechanism. Anyone must be able to report allegedly illegal content through a simple electronic channel, and the provider has to process that notice and decide in a diligent, non-arbitrary way.

When content is removed or restricted, the person affected must receive a statement of reasons explaining the decision and the available means of redress. And if a provider becomes aware of a suspected criminal offence threatening someone’s life or safety, it must inform the authorities.

What is added if you are an online platform

An online platform is a hosting service that also disseminates the information it stores to the public. Marketplaces, social networks and open forums fall into this category. The obligations increase considerably.

• An internal complaint-handling system, free of charge and available for at least six months
• Engagement with certified out-of-court dispute settlement bodies
• Priority handling of notices from trusted flaggers
• Measures against misuse of the service and against manifestly unfounded notices
• Advertising transparency, clearly identifying each advert and who pays for it
• A ban on deceptive interfaces and on advertising based on profiling with sensitive data or aimed at minors

This is where the most important exemption comes in. Micro and small enterprises are released from these online platform obligations, although they remain subject to those for intermediaries and hosting services. The exemption falls away if the company grows. If you run a marketplace, the detail on trader traceability is in our guide to e-commerce regulations in Spain.

Article 28 adds a specific duty for services accessible to minors: to put in place proportionate measures ensuring a high level of privacy, safety and security. What this requires today, and what may come with the European proposal and a future Spanish organic law, is covered in protecting minors in digital environments.

Why no one in Spain can fine you yet

Spain designated the National Markets and Competition Commission (CNMC) (in Spanish) as its Digital Services Coordinator in January 2024, but the CNMC currently has no power to impose penalties under the DSA. The rule that gave it those powers was repealed, and the attempt to restore them failed in the Spanish Parliament.

It is worth being clear about what this means. The regulation is directly applicable and your obligations have existed since February 2024. What is missing is the national enforcement arm, not the obligation. The European Commission keeps exclusive competence over very large platforms and has already opened proceedings against Spain.

It is the third case in a row of the same pattern. It is happening with the NIS2 Directive, which has not been transposed, and with the Cyber Resilience Act, whose royal decree designating the authorities is still being processed. A company that mistakes the absence of a supervisor for the absence of an obligation is building up documented breaches that someone will review once the supervisor exists.

What the designation of ChatGPT, Reddit and Roblox means

On 31 August 2026 the European Commission designated ChatGPT as a very large online search engine, and Reddit and Roblox as very large online platforms. All three reported more than 45 million average monthly users in the European Union. They have four months to comply, that is, until January 2027.

From then on they must assess and mitigate the systemic risks of their services relating to the spread of illegal content, minors, physical and mental well-being, fundamental rights, electoral processes and public security. An independent annual audit and opening their algorithmic systems to researchers are part of the package.

For your company the designation changes nothing directly. It does show where the Commission is looking, and that the 45 million threshold is also being applied to services that are not classic social networks.