The EU Digital Services Act and Generative AI

The Digital Services Act (DSA) creates due-diligence duties for intermediary services, with additional obligations for online platforms and the strictest systemic-risk duties for designated very large online platforms and search engines (VLOPs and VLOSEs). It does not generally ban generative AI or decide whether a piece of content is lawful. Instead, it sets processes and safeguards for services that host, distribute, recommend, or search for content. Other law determines what content is illegal. Generative AI may affect a service’s risks in several ways: users may upload synthetic material, platform tools may generate or transform content, and recommender systems may amplify content regardless of its origin. Under DSA Articles 34 and 35, VLOPs and VLOSEs assess systemic risks arising from the design, functioning, and use of their services and take reasonable, proportionate measures tailored to identified risks. Relevant concerns include dissemination of illegal content, negative effects on fundamental rights, civic discourse, electoral processes, public health, and minors. The AI Act addresses different actors and system categories. Where a general-purpose AI model with systemic risk is integrated into a VLOP or VLOSE, both laws may be relevant, but their risk frameworks are distinct. The AI Act considers model-level risks and provider duties; DSA assessment considers service-level risks connected to reach, design, operation, and use. One cannot assume that satisfying one framework resolves every obligation under the other. For a platform adding an AI image generator or chatbot, the first steps are to determine its DSA service category and whether it has a VLOP/VLOSE designation, then map how the feature changes content distribution and user exposure. The platform should examine relevant risk evidence and consider proportionate mitigations such as interface, moderation, recommender, or internal-process changes. Whether a particular measure is required depends on the identified risks and law. The DSA and AI Act should be read alongside data protection, consumer, copyright, and other applicable rules.