EU Digital Services Act

EU Regulation 2022/2065 - intermediary liability, transparency, risk assessment for VLOPs/VLOSEs.


Short name	DSA
Region	Europe
Country or scope	European Union
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers DSA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for DSA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for DSA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`EU-DSA-34` Systemic Risk Assessment Basis	Very large platforms must diligently assess systemic risks stemming from the design and functioning of their services, which requires an inventory of the software components those services are built from (Regulation (EU) 2022/2065 Art. 34)	Scan
`EU-DSA-35` Risk Mitigation Through Maintained Software	Providers must put in place reasonable and proportionate mitigation measures, including adapting and testing their systems, which requires knowing the versions of deployed components so weaknesses can be remediated (Regulation (EU) 2022/2065 Art. 35)	Scan
`EU-DSA-35-INTEG` Integrity of Platform Systems	Mitigation of systemic risks includes safeguarding the integrity of the platform's systems against manipulation, supported by integrity hashes for the software supply chain (Regulation (EU) 2022/2065 Art. 35)	Scan
`EU-DSA-37` Independent Audit Evidence	Very large platforms are subject to annual independent audits of their compliance, which requires auditable machine-readable records bearing a document identity and creation timestamp (Regulation (EU) 2022/2065 Art. 37)	Scan
`EU-DSA-15` Machine-Readable Transparency	The DSA requires transparency reports to be published in machine-readable formats, and technical compliance documentation should equally use a standard machine-readable SBOM format (Regulation (EU) 2022/2065 Art. 15 and Art. 42)	Scan
`EU-DSA-41` Compliance Function Accountability	Very large platforms must establish an independent compliance function, and accountability for technical artefacts requires that the tool or organisation producing them is recorded (Regulation (EU) 2022/2065 Art. 41)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`DSA-Art11`	Single Points of Contact
`DSA-Art12`	Legal Representatives
`DSA-Art13`	Intermediary Service Provider Transparency Reports
`DSA-Art14`	Terms and Conditions
`DSA-Art15`	Transparency Reporting Obligations for Hosting
`DSA-Art16`	Notice-and-Action Mechanisms
`DSA-Art25`	Online Interfaces: Prohibition of Dark Patterns
`DSA-Art27`	Recommender System Transparency
`DSA-Art28`	Online Protection of Minors
`DSA-Art33`	Risk Assessment: Very Large Online Platforms
`DSA-Art34`	Risk Mitigation Measures
`DSA-Art37`	Independent Audit for VLOPs

Policy templates

Written for DSA:

DSA Transparency Reporting Procedure

And 22 from the standard set, adapted to DSA.