Everyone Scoped the AI Act. Almost Nobody Scoped the Law That Was Already in Force.
The Digital Services Act has applied in full since February 2024, reaches US companies with no EU entity, and defines "hosting service" broadly enough to catch a project management tool. Its recommender-transparency article is the one that surprises AI teams.
The Name Is Doing Damage
"Digital Services Act" reads like something aimed at Meta, TikTok and Amazon, and the enforcement headlines have all involved very large online platforms. So US SaaS teams file it under other-people's-problem and move on to the AI Act.
The DSA is actually a layered regime. A small set of heavy duties applies only to very large platforms. Underneath that sits a base layer that applies to every intermediary service offered to people in the EU — and a hosting layer that applies to anything storing information at a user's request. That base layer is where ordinary software companies live, and it has been live since February 17, 2024.
Which Tier Are You In?
The obligations stack. Each tier inherits everything above it, so misclassifying yourself one step too low means missing every duty in between.
Intermediary service (everyone)
Mere conduit, caching or hosting of information provided by users. Base duties: a single point of contact for authorities and for recipients, a legal representative in the EU if you have no EU establishment, terms and conditions that describe your content restrictions and moderation practices in clear language, and cooperation with orders from Member State authorities.
Hosting service (you store user content)
Adds a notice-and-action mechanism that lets anyone flag allegedly illegal content, and a duty to give affected users a statement of reasons whenever you restrict, remove, demote, demonetise or suspend. This is the tier that catches file storage, ticketing, CRM notes, uploaded documents, and user-generated fields in ordinary B2B products.
Online platform (you disseminate to the public)
Hosting plus dissemination of stored information to the public at the user's request. Adds internal complaint handling, out-of-court dispute settlement, priority for trusted flaggers, measures against misuse, a ban on dark patterns in the interface, advertising transparency, a prohibition on targeting ads using sensitive data or to minors, and recommender system transparency. Micro and small enterprises are exempt from the platform-specific section, but not from the hosting and intermediary layers.
VLOP / VLOSE (45m+ EU users, Commission-designated)
Systemic risk assessment and mitigation, independent audits, a non-profiling recommender option, ad repositories, data access for vetted researchers, a compliance function, and direct European Commission supervision with a supervisory fee. If you are reading an article to work out whether the DSA applies to you, you are not here.
The line that decides your tier
Hosting becomes a platform when stored information is disseminated to the public at the recipient's request. A closed workspace where content is visible only to a customer's own team is not public dissemination. A public profile page, a shared review feed, an open template gallery, a community forum bolted onto your product, or a public marketplace listing is — and it can flip a B2B tool into the platform tier through a feature nobody flagged as legally significant.
Where AI Ranking Attaches
The DSA defines a recommender system functionally: a system that suggests, prioritises or determines the relative order of information presented to recipients. It does not require the system to be machine learning. Your hand-tuned relevance score qualifies. So does a vector search over customer content, an LLM re-ranker on a results page, and a "recommended for you" module driven by embeddings.
For online platforms, the duty is to set out in the terms and conditions, in plain and intelligible language, the main parameters used in those recommender systems and any options users have to modify or influence them. The failure mode is not refusing to disclose — it is disclosing at the wrong altitude.
- •“We use machine learning to personalise your experience”
- •A model card with feature weights and no user-facing meaning
- •Disclosure buried in a developer doc, not in the terms
- •“Proprietary algorithm” as the entire explanation
- •The named signals that matter most, ranked by influence
- •Whether the ordering depends on the individual user's behaviour
- •Whether paid placement participates, and how it is marked
- •The concrete controls: sort options, opt-outs, resets
The Statement of Reasons Is an Engineering Task
This is the hosting-tier obligation that teams consistently underestimate. Any time you restrict a user's content — removing it, disabling access, demoting it, demonetising it, suspending the account — you owe the affected user a clear, specific statement of reasons. It must say what was restricted, the legal ground or the contractual term relied on, the facts relied on, whether automated means were used in the detection or the decision, and how to contest it.
Read that list against how enforcement actually works in most products: a trust-and-safety classifier fires, a row is flagged, an internal tool hides the content, and the user gets a generic email or nothing at all. The gap is not a policy gap. It is missing structured data — you cannot generate a compliant statement of reasons if the system never recorded which rule matched, on what evidence, and whether a human confirmed it.
- Log the specific policy clause per enforcement action, not a coarse category
- Record whether detection was automated and whether a human reviewed before action
- Keep the evidence pointer so the notice can describe the facts, not just the verdict
- Build the appeal path as a real queue with outcomes, because platforms owe internal complaint handling
- Online platforms additionally submit statements of reasons to the Commission's public DSA transparency database
The EU Legal Representative
If you offer your service in the EU and have no establishment there, you must designate in writing a legal or natural person to act as your legal representative in one of the Member States where you offer services — and that representative can be held liable for non-compliance. This is a different appointment from a GDPR Article 27 representative, a different one again from the EU AI Act's authorized representative, and teams routinely assume one covers all three. It does not, though the same service provider may take all three roles.
A Practical Order of Operations
- Classify your tier honestly. List every surface where user-provided content is stored, and every surface where it becomes visible beyond the user's own organisation.
- Check the public-dissemination features nobody scoped. Shared links, public galleries, review widgets, community boards, embeds.
- Appoint the representative and publish the contact points. Cheap, mechanical, and the first thing an authority checks.
- Rewrite the terms. Content restrictions, moderation practices, and — if you are a platform — recommender parameters, in plain language.
- Ship notice-and-action. A real, findable route to report allegedly illegal content, with acknowledgement and a decision.
- Instrument enforcement logging. Rule matched, evidence, automated or human, outcome — the data behind every statement of reasons.
- Only then look at the AI Act overlap. Both can apply; the DSA duties are already in force and the ordering matters.
Frequently Asked Questions
We are a closed B2B SaaS tool. Are we really in scope?
You are almost certainly an intermediary and probably a hosting service, because you store information your customers provide. You are probably not an online platform, because content is not disseminated to the public. That means point of contact, EU legal representative, clear terms, notice-and-action and statements of reasons — and none of the platform-tier machinery. That is a days-to-weeks project, not a quarter.
Does the small-enterprise exemption get us out of it?
Partly. Micro and small enterprises are exempt from the online-platform-specific obligations, and the very large platform thresholds are far above you. The intermediary and hosting duties still apply. Treat the exemption as removing the heaviest section, not as removing the law.
We already did GDPR. How much transfers?
Less than you would hope. GDPR governs personal data; the DSA governs content and the intermediary role. Your GDPR representative appointment, records, and privacy notices do not answer notice-and-action, statements of reasons, terms transparency, or recommender disclosure. What does transfer is the discipline of having a documented processing map — the DSA needs the equivalent map for content.
Our search results are ranked by an LLM. Does that make us a recommender system?
If you are in the online-platform tier, yes — the definition covers any system determining the relative order of information presented, regardless of technique. The practical consequence is a terms section naming the main ranking signals and the user controls. The fact that a model produces the ordering does not excuse the disclosure; it makes it harder to write honestly, which is the actual work.
Who enforces this against a US company with no EU office?
The Digital Services Coordinator of the Member State where your legal representative is located, for non-VLOP providers; the European Commission for designated very large platforms. Penalties are set by Member States within a ceiling of up to 6% of worldwide annual turnover, with a lower ceiling for supplying incorrect, incomplete or misleading information.
In Force Beats Forthcoming
Compliance attention follows deadlines, and the AI Act had the loudest one. The DSA had its deadline in early 2024, absorbed a year of headlines about companies a thousand times your size, and then went quiet — which is precisely how a live obligation becomes invisible.
The cheapest hour you can spend this quarter is classifying your own tier. Most US SaaS companies land at hosting, owe four concrete things, and have shipped none of them.
This article is general information about a rapidly changing regulatory area, not legal advice. Tier classification is fact-specific and turns on product details — confirm your categorisation with EU counsel before relying on an exemption.