The EU Digital Services Act (DSA) sets clear, tiered requirements for online services operating in the EU, with core duties for all and lighter obligations for startups and SMEs. Identifying your service type and company size is crucial to comply with the law and avoid penalties.
The EU Digital Services Act (DSA) is a comprehensive regulation that introduces harmonised rules for digital intermediary services across the European Union, applying proportionately based on the service's role and company size. If you operate an online service or platform—even as a startup with few employees—you will likely face obligations under the DSA, but the scope and strictness depend on your business model and classification. This guide explains what the DSA is, who must comply, and how startups and SMEs can fulfil their duties efficiently.
- The DSA sets EU-wide rules for intermediary services, online platforms, hosting, and marketplaces.
- Core rights and duties apply to nearly all services, but exemptions exist for micro and small enterprises.
- Penalties for non-compliance can reach up to 6% of global turnover.[1]
- Support and guidance tools are in place to help SMEs manage compliance.
What is the EU Digital Services Act?
The Digital Services Act (DSA) is Regulation (EU) 2022/2065, creating a single legal framework for digital intermediary services throughout the European Union. It aims to ensure a safer and more open digital environment by setting out clear rules for online intermediaries, including hosting providers, online platforms, and marketplaces, as well as very large online platforms and search engines (VLOPs and VLOSEs) [3]. The DSA came into force in October 2022, with most obligations for standard platforms starting 17 February 2024. It replaces differing national laws with uniform standards, benefiting both consumers and businesses operating in the EU [1].
Which online services and startups are in scope?
The DSA covers a wide range of digital intermediary services, from simple internet access and caching to hosting and complex online platforms. If your startup provides access to user-generated content, hosts third-party material, or operates a digital marketplace or app platform, the DSA likely applies. The rules also cover businesses outside the EU if they offer services within the Union and have a substantial connection to Europe [3]. The size and nature of your service—whether you are a micro, small, or larger enterprise—determine which duties you must fulfil.
How to identify your service category: conduit, caching, hosting, or online platform
Accurate categorisation is the first step in DSA compliance. ‘Mere conduit’ services transmit information (such as ISPs) without modifying it. ‘Caching’ involves temporary storage to improve performance, while ‘hosting’ means storing user content and data. ‘Online platforms’ go further, typically involving user interaction and dissemination of third-party content to the public, such as social media or marketplaces. Very large platforms and search engines (VLOPs and VLOSEs) are subject to additional demands, due to their reach and impact [3].
Which DSA duties apply to every intermediary service?
All intermediary services must comply with certain fundamental requirements: clear contact details on their website, transparency about their terms and restrictions, and cooperation with EU authorities. Crucially, hosting services must implement a notice-and-action mechanism for users to flag illegal content, and must act expeditiously on valid notices [1]. These core rights and duties form the baseline, regardless of company size, to foster a safer digital ecosystem for EU users.
Additional duties for hosting services, platforms, and marketplaces
Hosting providers, online platforms, and digital marketplaces have extra responsibilities. They need to explain content moderation decisions, provide accessible complaint mechanisms, and make it easy to report suspected illegal content. Platforms must offer information about advertisements, disclose why content or accounts are removed, and ban exploitative practices such as targeted ads to children or certain dark patterns [1]. Online marketplaces are further required to verify trader identities and support traceability. VLOPs and VLOSEs must also implement risk-assessment measures, publish transparency reports, and cooperate with crisis mechanisms as needed [3].
What micro and small businesses are exempt from—and what still applies
The DSA uses a tiered, proportionate approach to obligations. Micro and small enterprises benefit from lighter duties for many requirements, especially those relating to transparency reporting and crisis response [1]. However, these businesses are not exempt from all obligations: the core requirements around user information, effective notice-and-action channels, and cooperation with authorities still apply. The EU supports SMEs by providing tailored guidance, due-diligence tools, and ongoing evaluation of the DSA’s impact on smaller firms [5].
DSA compliance checklist for startups
Startups should start by accurately categorising their role under the DSA, documenting borderlines between conduit, caching, hosting, and platform. Prepare plain-language terms and conditions, publish mandatory contact details, set up simple channels for users to report illegal content, and ensure decisions about content removal are justified and communicated. Even exempted firms should be ready to cooperate with Digital Services Coordinators and document processes for all content-related actions. Where in doubt, leverage EU guidance and consult specialists to avoid accidental non-compliance or missed obligations [1].
Enforcement, penalties, and who supervises compliance
The DSA’s provisions are jointly enforced by national Digital Services Coordinators and the European Commission. Non-compliance can result in fines of up to 6% of a company’s global turnover, along with interim restrictions in urgent cases.[1] Enforcement is risk-based and proportionate, with regulators offering a degree of support and flexibility, especially for SMEs. Each EU country has designated authorities to coordinate supervision, and cross-border issues trigger collaboration across EU regulators.
Common DSA compliance mistakes
Early evidence shows two main pain points for startups: accurately determining which DSA tier their company belongs to, and securing the necessary resources to maintain compliance—even when duties are lighter for SMEs [1]. Misclassifying a service or neglecting processes like notice-and-action can expose even small firms to enforcement risks. Use the EU guidance, document your compliance steps, and update processes as more tools become available.
Typical Problems
Startups and SMEs often find it difficult to classify themselves, especially when user metrics fall between categories or their platforms mix several service types. Even with tailored guidance, resource limitations make sustained compliance a challenge. This can lead to delays in implementing basic procedures or gaps in user communication [5].
Recent Developments
Since 17 February 2024, all regular online platforms—apart from explicitly exempted micro and small enterprises—must comply with the DSA. The European Commission is actively developing further guidance and monitoring the law’s impact on SMEs, aiming to maintain a balance between safety, transparency, and digital growth [3].
Conclusion
The EU Digital Services Act introduces new certainty, rights, and responsibilities for digital startups and SMEs engaging with European users. By identifying your service category, understanding what exemptions apply, and building scalable processes for transparency and notice handling, your business can comply smoothly while remaining competitive. The evolving landscape will continue to produce new guidance, so revisit the requirements regularly to adapt as necessary. The DSA’s goals—promoting digital security and trust—are shared by all players, big and small.
Quellen
[1] Digital Services Act: Questions and Answers | European Commission (European Commission)
[3] Digital Services Act | EUR‑Lex summary (EUR-Lex)
[5] Study on EU instruments (impact on SMEs) (European Commission)
