DSA is no longer a “later” regulation. What should platform operators check before UKE asks about it?

The President signed an act creating a national system for enforcing the Digital Services Act – DSA in Poland. The easiest way to reduce this information in the media is to say that Poland will finally be able to punish online platforms.

From the point of view of entrepreneurs, however, another conclusion is much more important. DSA is not a new law. Its main part has been applicable in the European Union since February 17, 2024. However, the environment in which Polish entrepreneurs will have to demonstrate that they actually perform the obligations arising from it is changing.

A national regulator is being established with powers to receive user complaints, request information, conduct inspections and proceedings, and impose penalties.

This significantly changes the perspective. In recent years, DSA could be treated as another European regulatory act requiring implementation into company documentation. Now the question becomes much more important: in the event of a user complaint or a regulator inspection, will the entrepreneur be able to demonstrate how his procedures work in practice?

First we need to determine who we actually are. The first mistake would be to identify DSA only with the largest social media platforms. The regulation uses a much broader category of indirect service providers. It covers various business models, and the scope of responsibilities depends on, among others: on the type of service provided, the nature of the entrepreneur and its size. The entity providing the hosting service may have different responsibilities, an internet platform, a very large platform or an internet search engine. Therefore, the first element of the audit should not be to check whether there is a “DSA procedure” on the website. First, your business activity must be properly classified. It may seem obvious, but this qualification determines the answer to a much more important question: which obligations actually apply to a specific entrepreneur?

The content reporting procedure cannot be a dummy. One of the basic areas regulated by the DSA are mechanisms enabling the reporting of information considered illegal.

In practice, an entrepreneur should answer a few simple questions. Can a user actually easily report? Where does such a report go? Who analyzes them? According to what criteria is the decision made? How long does the reaction take? Can the company later recreate the entire process and demonstrate why a specific decision was made? The biggest regulatory mistake may be the belief that having a form means having a working mechanism. It doesn’t mean. A mechanism only exists when there is a process behind the form.

Content moderation requires justification. The platform operator is in a difficult position. On the one hand, it is expected to respond effectively to illegal content. On the other hand, its actions interfere with users’ rights. Therefore, it is not only important whether certain content has been deleted, the account has been restricted or access to information has been blocked. The way the decision is made and its justification are also important. The entrepreneur should therefore check whether his moderation process allows him to determine the basis on which a specific decision was made, what circumstances were taken into account and how the user was informed about it. This is especially important where moderation is partially automatic. An algorithm can support the process. However, it does not release the company from responsibility for the way it is organized.

You also need to be prepared for a user who disagrees. DSA does not end the relationship with the user when a moderation decision is made. Platforms subject to the relevant obligations must provide mechanisms to challenge certain decisions. This means that you need to look at the process from the other side. Not only: “how quickly do we remove content?”, but also: “what do we do when a user claims that we removed it unfairly?” Who handles the complaint? Does the person or team reviewing the appeal have access to the information needed to actually review the earlier decision? Is the appeal actually considered or does it merely automatically confirm the original result? And again – is there any documentation left after this?

The regulations are no longer a document that no one reads. For many years, website regulations were treated primarily as a contractual instrument. DSA significantly increases its regulatory importance. The rules regarding limiting the information provided by users should be described in an understandable and transparent manner. This also applies to the tools, procedures, moderation measures used and, to the extent appropriate, algorithmic decision-making and human control. Therefore, updating the regulations should not consist in adding several DSA provisions to the existing document. Regulations should reflect how the company actually operates. The discrepancy between documentation and practice is often a bigger problem than the imperfection of the document itself.

Advertising and recommendation systems also need to be checked. DSA also interferes with the way advertisements are presented and the functioning of recommendation systems. The user should be able to recognize that he is dealing with an advertisement, know on whose behalf it is presented, and obtain information enabling him to understand the basic parameters of its targeting. In the case of platforms using recommendation systems, the transparency of the basic parameters determining why the user sees certain content is important.

This is an area where compliance is no longer the domain of lawyers alone. Cooperation between the legal department, marketing, IT, product owners and people responsible for monetization of the platform is needed. A lawyer can write the correct clause. It will not repair a poorly designed product.

The marketplace should also look at its sellers. Special obligations apply to platforms enabling consumers to conclude contracts with entrepreneurs. The problem here is no longer solely the content posted by the user. The traceability of the entrepreneur using the platform and the way of designing the interface enabling him to offer products or services are also important. For the marketplace operator, this means the need to take a second look at seller onboarding. What information do we collect? Do we verify them? Can we associate a specific seller with an offer? What happens if, after starting cooperation, information appears that undermines the credibility of the data provided? This is no longer just a problem of the marketplace-seller relationship. It becomes part of the regulatory responsibility of the platform itself.

The most important thing may not be the document, but the evidence. Entering the Polish system of real supervision over DSA changes one more thing. An entrepreneur should start looking at compliance not only from the perspective of the obligation, but also the possibility of proving its fulfillment.

We may have a moderation procedure. But do we know when it was used? We can train employees. But can we demonstrate who was trained and when? We can declare a specific response time to notifications. But does the IT system allow you to check the actual service time? We may have an appeals procedure. But can we show how many appeals were accepted and how many were rejected and for what reasons? In regulated business, the difference between “we do this” and “we can demonstrate that we do this” is fundamental.

Not every platform needs a revolution. This does not mean that every entrepreneur running an online business should now start a multi-month compliance project. On the contrary. The first step should be a relatively short review. How does our service qualify under DSA? Which responsibilities actually apply to us? Which have already been implemented? Where is the discrepancy between the regulations, procedure and product performance? Do we leave evidence to demonstrate the correctness of our actions?

Only the answers to these questions will show whether more serious changes are needed. In many enterprises, you will probably find that a significant part of the required processes already exist. The problem may be rather to organize, complete and document them.

The regulator appears at the end of the process. Preparation should take place in advance. The signed act does not make the DSA suddenly come into force. It causes something else. A more complete institutional mechanism for its enforcement is finally being created in Poland. The President of UKE will be able to consider user complaints, request information, conduct inspections and proceedings, and apply measures provided for by law. In specific areas, competences will also be exercised by the President of the Office of Competition and Consumer Protection and the Chairman of the National Broadcasting Council.

For entrepreneurs, this is a good time not to wait for the regulator’s first question. Compliance is carried out cheapest when you can still easily check the process, improve the regulations, change the form, adapt the IT system and train people. It is much more expensive to do this when the starting point is a user complaint, a request for information or initiated proceedings.

Therefore, I would treat the signing of the Polish act institutionally implementing DSA primarily as a signal to the management boards of enterprises running online platforms: don’t just ask whether you have implemented DSA. Ask if tomorrow, when the regulator asks you to show how you have implemented them, you will be able to actually show it to him.

Author: Jarosław Chałas, Managing Partner, Legal Advisor at the Chałas i Wspólnicy Law Firm