EU DIGITAL SERVICES ACT

OLYMPUS opened an institutional file on a statute. A law has no Big Five and no Dark Triad, and the unit does not invent them; what a law has is a text, an enforcement arm, and a funding structure. The Digital Services Act is catalogued here as the rulebook — the first statute in a Western democracy to convert content moderation from a platform’s private practice into a legal obligation with fines attached. The finding is the shape of the machinery, not the intent of its drafters: a framework whose stated categories (illegal content, systemic risk) are bounded by due process on paper, and whose observed history is a one-directional expansion of what the machinery reaches. The numbers in the front matter are reach, entrenchment, and durability — a regulation outlives every commissioner who signs it.

Institutional Archetype

THE RULEBOOK — The archetype is the statute that makes the private practice mandatory. The DSA does not run a platform, does not employ a moderator, and does not remove a single post itself. It obliges the platforms to do the removing — on legal deadlines, under systemic-risk assessments, with priority lanes for designated flaggers — and attaches fines of up to six percent of global annual turnover to the obligation. That is the structural power: not authorship of any single takedown, but authorship of the incentive landscape inside which every takedown decision on a large platform is now made. A platform facing a six-percent fine does not litigate borderline cases. It removes them. The over-removal is not written anywhere in the text; it is what the text’s incentives produce.

Mandate & Origin

The DSA was proposed by the European Commission in December 2020 under the von der Leyen Commission’s digital portfolio — Executive Vice-President Margrethe Vestager and Internal Market Commissioner Thierry Breton, who publicly fronted its enforcement — and adopted as Regulation (EU) 2022/2065 on 19 October 2022. Obligations for Very Large Online Platforms (VLOPs, 45 million+ EU users) began in late 2023; the full regulation became applicable to all intermediaries on 17 February 2024. The architecture, from the statute’s own text:

• Systemic risk (Articles 34–35): VLOPs must assess and mitigate risks including the spread of illegal content and “negative effects on civic discourse and electoral processes” and public health — the assessment is annual, and the mitigation is audited.
• Trusted flaggers (Article 22): entities designated by national Digital Services Coordinators whose illegal-content notices platforms must treat “with priority.” The Commission publishes the roster in a public database; the platforms retain formal responsibility for the removal decision.
• Enforcement: the Commission itself directly supervises VLOPs — a supranational regulator holding the fine authority over the world’s largest speech venues — with national DSCs covering everything smaller.
• Fines: up to six percent of global annual turnover.

The articles, in their own words. The two removal channels are different instruments. Article 9 concerns an “order to act against one or more specific items of illegal content, issued by the relevant national judicial or administrative authorities,” and Article 10 an order “to provide specific information about one or more specific individual recipients of the service” from the same kind of authority; both need a legal basis in Union or national law, and the Article 9 order must carry “a statement of reasons explaining why the information is illegal content.” Article 22(1) is the priority lane: “Providers of online platforms shall take the necessary technical and organisational measures to ensure that notices submitted by trusted flaggers, acting within their designated area of expertise, through the mechanisms referred to in Article 16, are given priority and are processed and decided upon without undue delay,” and under Article 22(2) the status “shall be awarded, upon application by any entity, by the Digital Services Coordinator of the Member State in which the applicant is established.” Article 34(1) tells very large platforms to “diligently identify, analyse and assess any systemic risks in the Union stemming from the design or functioning of their service,” and lists four, among them “(a) the dissemination of illegal content through their services” and “(c) any actual or foreseeable negative effects on civic discourse and electoral processes, and public security.” Article 35(1) requires “reasonable, proportionate and effective mitigation measures, tailored to the specific systemic risks identified pursuant to Article 34, with particular consideration to the impacts of such measures on fundamental rights.” Article 36 gives the Commission a crisis power, where “a crisis shall be deemed to have occurred where extraordinary circumstances lead to a serious threat to public security or public health in the Union or in significant parts of it,” and requires that the actions it orders be “limited to a period not exceeding three months.” Article 37(1) puts the platforms “at their own expense and at least once a year” under “independent audits.” Article 40(12) obliges them to “give access without undue delay to data” that is “publicly accessible in their online interface” to eligible researchers. The money is in two places: Article 52(3) fixes the national ceiling at “6 % of the annual worldwide turnover of the provider of intermediary services concerned in the preceding financial year,” with “1 %” for incorrect or missing information, and Article 74(1) lets the Commission impose “fines not exceeding 6 % of its total worldwide annual turnover in the preceding financial year where it finds that the provider, intentionally or negligently” infringes the Regulation (Regulation (EU) 2022/2065, consolidated text on EUR-Lex). The statute therefore does two separate things that coverage tends to run together: it lets national authorities order the removal of specific items on a stated legal basis, and it makes the large platforms assess and mitigate “systemic risk” on their own judgment under audit, with the Commission as the body that decides afterwards whether they did it diligently.

Funding & Backers

The enforcement is funded by the enforced — the detail the coverage rarely leads with. Under Article 43, VLOPs and VLOSEs pay the Commission an annual supervisory fee, capped at 0.05 percent of worldwide annual net income, to fund their own supervision. The platforms pay for the regulator that fines them.

Who lobbied the statute into being is a contested ledger. The Foundation for Freedom Online — a project of former State Department official Mike Benz, and a partisan participant in this fight — documents 23 US-government-funded organizations that it says lobbied for the DSA and now help enforce it. That is FFO’s accounting, attributed as such; the Commission’s own accounting is that the DSA answered years of platform scandals and member-state fragmentation. Both accounts are on the record. What is not contested is that the flagging layer is substantially government-funded: Germany’s first designated trusted flagger, the REspect! reporting office, receives roughly 95 percent of its funding from the federal “Demokratie Leben” programme — a figure put on the parliamentary record in a written question to the Commission. A government-funded NGO, designated by a government agency, whose reports receive priority treatment from platforms under a government statute.

The fee, in the Commission’s own accounts. Article 43(5)(c) sets the limit: the fee charged to a provider “does not, in any case, exceed 0,05 % of its worldwide annual net income in the preceding financial year,” and Article 43(2) says the overall amount “shall cover the estimated costs that the Commission incurs in relation to its supervisory tasks.” The Commission’s staff working document of 29 June 2026 prices the next year. It estimates “270 FTEs for the year 2027,” human-resources expenditure of EUR 40,378,708 and other operating expenditure of EUR 18,152,322, a “Total amount of supervisory fee for 2027 without the surplus incurred in 2025” of EUR 58,531,030, a 2025 surplus of EUR 15,653,141 “due to the recruitment of staff that occurred later in the year than foreseen,” and “Total assigned revenues” of EUR 42,877,889. The same document lists “External experts” at EUR 3,485,000, “compliance monitoring contracts, including large contracts on specific risks across different designated online platforms and search engines,” and “the cost of staff working in the Delegation of the European Union to the United States” among the items the fee pays for, and counts “23 online platforms and two online search engines” designated at that date (Commission staff working document SWD(2026) 178 final, via the Council register; Commission: fee overview for 2026). The fee has been tested in court once. On 10 September 2025 the General Court, in Cases T-55/24 and T-58/24, annulled the Commission’s 2023 fee decisions for Meta’s Facebook and Instagram and for TikTok because “that methodology is an essential and indispensable element of the determination of the supervisory fee,” and “should have been adopted not in the context of implementing decisions but in a delegated act”; it “did not find any error affecting the obligation of the companies concerned to pay the supervisory fee for 2023,” so it “temporarily maintains the effects of the annulled decisions” for no more than 12 months from the date the judgments become final (Court of Justice of the European Union: Press release No 114/25). The arithmetic is the finding: a supervisory arm of roughly 270 posts is paid for by the supervised, to a ceiling set as a share of each one’s net income, and the one judicial correction so far went to the method of counting users, not to the principle of the fee.

Institutional Voice & Intent

The voice is the harmonization register — the grammar of “a safe, predictable and trusted online environment,” of risk assessments and transparency reports and statements of reasons. The statute speaks in process, and the process is real: removal decisions must be explained, users can appeal, and the Commission’s own two-year report counts 165 million moderation decisions appealed through platforms’ internal mechanisms with 30 percent reversed — almost 50 million — which the Commission presents as the accountability machinery working, and which is, on its face, the strongest evidence anyone has offered that it sometimes does.

Stated intent: Harmonize the rules for intermediaries across 27 member states; make platforms accountable for illegal content; give users transparency and appeal rights; protect elections, minors, and public health from systemic platform risks.

Observed intent: Hold the fine authority over the world’s largest speech platforms in a single supranational regulator; convert content moderation into a compliance discipline whose categories — “illegal content,” “disinformation,” “systemic risk” — are defined and expanded by the regulator holding the fine; and export the result globally, since platforms build one system for their largest regulated market. The legal literature calls this the Brussels Effect, and the Commission does not dispute it; it advertises it.

Gap: The stated and observed intents overlap wherever “illegal content” means the unarguable cases — the CSAM, the terrorist livestream. The gap opens at the elastic categories. “Systemic risk” is not a defined harm; it is a framework a regulator interprets, and the observed enforcement history runs in one direction: the first formal proceedings (X, December 2023) covered risk management, dark patterns, ad transparency, and researcher data access; by January 2026 the same statute reached an AI chatbot’s image generator — a case brought under the DSA precisely because the AI Act’s own enforcement teeth had not yet engaged. The statute built for platform moderation became, within two years, the Union’s available instrument for regulating generative AI outputs. Nothing in that expansion was unlawful. That is the point of building it as a statute.

Interest: What each rule in the statute pays, documented, with the Commission’s own best case. The positions are the Regulation’s and the Commission’s, from the articles and the Commission’s own pages; the personal record of the commissioner who fronted them is on Thierry Breton.

• Priority for designated flaggers (Article 22). Position: the Commission’s page says “The notices submitted by them must be treated with priority as they are expected to be more accurate than notices submitted by an average user,” and that “Providers have the sole responsibility to decide upon notices and, where justified, removing content” (Commission: Trusted flaggers under the DSA). What it pays: the lane belongs to whoever a national coordinator designates, and the Commission’s downloadable list of 89 designated flaggers shows who that is. By its own area-of-expertise column, 29 list intellectual-property infringements (among them Stichting BREIN and the Irish Music Rights Organisation), 33 list scams and fraud (among them the financial regulators FMA in Austria, FSMA in Belgium and the Central Bank of Ireland), 28 list protection of minors, 33 list illegal speech, and 6 list “Negative effects on civil discourse and elections” (among them Debunk EU, certified 21 March 2025, and Repsense, certified 8 September 2026). HateAid gGmbH was certified by the Bundesnetzagentur on 2 June 2025 and the REspect! reporting office on 1 October 2024 (Commission: list of DSA trusted flaggers, last updated 5 October 2026). Best case, the Commission’s: priority goes to notifiers “expected to be more accurate,” the criteria are expertise, independence from platforms and “diligence, accuracy, and objectivity,” and the platform keeps the decision. Convergence: rights-holder bodies, financial supervisors and child-protection hotlines gain the same queue position as the government-funded speech flaggers described above, which is why the lane has a wide coalition behind it that does not depend on any one category of content.
• Systemic-risk assessment, mitigation and audit (Articles 34, 35, 37). Position: the Commission’s own words on the first fine for failing the duty: “Risk assessments are not box-ticking exercises - they are the backbone of the DSA” (Commission: fine on Temu, IP/26/1178). What it pays: the duty puts large platforms “at their own expense” under “independent audits” every year, which is a standing order for audit and compliance work paid by the audited; the Commission’s own staff document lists “External experts” at EUR 3,485,000 and “compliance monitoring contracts” in the fee-funded estimate, without naming a vendor. Each new designation also adds a fee payer, because the fee is “proportionate to the number of average monthly active recipients” (Article 43(5)(b)), and the supervisory arm’s 270 posts are paid from those fees. Best case, the Commission’s, on AliExpress: “Scale is not an excuse; risks must be identified and addressed systematically to ensure consumers can safely shop online” (Commission: fine on AliExpress). Convergence: audit firms and compliance consultancies, whose work the Article 37 audit and the fee-funded contracts require, and the Commission’s own staff. No named vendor contract is documented in the sources read.
• Researcher access to public data (Article 40(12)). Position: the Commission accepted X’s action plan “to comply with transparency obligations and researchers’ access to data,” under which X will “give eligible researchers effective access to public data” and “access to data free-of-charge” (Commission: X action plan, 16 July 2026). What it pays: eligible researchers, including those “affiliated to not for profit bodies, organisations and associations,” receive data they would otherwise have to buy or scrape, and the Commission’s own list of designated flaggers includes a university (ISCTE - Instituto Universitário de Lisboa, certified 20 March 2026) and a human-rights institute (Vlaams Mensenrechteninstituut, 13 October 2025), so the research class and the flagging class overlap on the roster. Best case, the Commission’s: the measures let “researchers, civil society and the public in general” see “X’s systemic risks” for themselves. Convergence: the academic and civil-society bodies that qualify, which are also the audience for the Commission’s own supervisory findings.
• Bringing generative AI inside the statute (designation, Articles 33 and 34). Position: on 31 August 2026 the Commission “designated ChatGPT as a Very Large Online Search Engine (VLOSE), as well as Reddit and Roblox as Very Large Online Platforms (VLOPs),” with four months, “by January 2027,” to comply with duties such as “assessing and mitigating the systemic risks stemming from their service and algorithmic systems” (Commission: designation of ChatGPT, Reddit and Roblox). What it pays: the Commission’s exclusive supervisory competence, and its fee base, extend to the service, with the Irish Digital Services Coordinator as the national partner on the supervision page (Commission: supervised VLOPs and VLOSEs, updated 15 October 2026). Best case, the Commission’s: the service declared “at least 45 million average monthly users in the EU and thus meet[s] the threshold.” Convergence: none documented in the sources read beyond the national coordinator, Ireland’s, named beside the service on the supervision page; the Union’s separate AI regulation has its own file at EU AI Act.
• The opposing faction’s position: the DSA is a censorship law. Position: the House Judiciary Committee’s interim staff report says “The EU claims that the DSA applies only to Europe and that it targets only harmful or illegal content. Both of those claims are inaccurate,” and “Put simply, the DSA infringes on American online speech” (House Judiciary Committee, July 2025); its February 2026 sequel says the documents produced under subpoena “show the extent–and success–of the European Commission’s global censorship campaign” and inform “the Committee on legislative steps it can take” (House Judiciary Committee, 3 February 2026). What it pays: the committee’s subpoenas run to ten technology companies, among them Apple, Amazon, Microsoft, Alphabet, TikTok, X, Meta, Reddit and OpenAI, which are the same companies the Commission supervises; a rule that bars the Commission’s demands protects them from the Article 74 fine. The State Department’s policy of 28 May 2025 says “It is similarly unacceptable for foreign officials to demand that American tech platforms adopt global content moderation policies” (State Department: visa restriction policy). Best case, the committee’s: American speech on American platforms should not be set by a foreign regulator’s fine schedule. Best case, the Commission’s, as the committee records it: the DSA targets only illegal content and applies to the Union. Convergence: the platforms under the Commission’s fine and the platforms under the committee’s subpoena are one list; the committee and the platforms gain from the same outcome.

Interest is a documented fact about each position, not a claim about motive, and not a verdict that the argument is wrong. Each best case is stated at the strength its author states it.

Position in the Apparatus

The DSA is the load-bearing statute of the European wing of the apparatus this file documents. Its trusted-flagger lane institutionalizes what the American wing did informally — the Twitter Files documented flags moving from government-adjacent bodies to platforms by email and portal; Article 22 gives the same flow a legal basis, a designation procedure, and a priority queue. Its systemic-risk framework is the template other jurisdictions cite. Its fine authority is what the informal American system never had, which is why the enforcement gravity has shifted to Brussels: the flagging machine’s American nodes spent 2023–2025 under subpoena, while the European node acquired statutory teeth, a public budget, and a fee stream from the platforms it supervises. The personal enforcement face of the statute’s first years, Thierry Breton, has his own file; the statute survived his exit without slowing, which is the difference between a man and a rulebook.

Actions & Leadership Choices

Founding purpose, judged on evidence. The DSA answered real failures — the platforms’ own transparency reports, the Christchurch livestream, the takedown chaos of 27 divergent national regimes. As harmonization it is genuine: one rulebook now replaces a patchwork, and the appeal-and-reversal machinery it created processes complaints at a scale no platform voluntarily offered before. The due process is not decorative. A hundred and sixty-five million appeals, thirty percent of them — almost fifty million decisions — reversed, is a functioning correction layer, and this file records it as one.

The enforcement record, where the conduct shows. The record to date runs through three platforms: X, then Temu, fined 200 million euros in May 2026, then AliExpress, fined 550 million euros in July 2026. The Commission opened its first DSA formal proceedings against X in December 2023. In December 2025 it issued its first fine — 120 million euros — and the charges are worth stating precisely, because both sides of the litigation rest on them: deceptive design of the blue checkmark, insufficient transparency of the ads repository, and failure to provide researchers access to public data. Verification plumbing and transparency, on the Commission’s own framing — not speech. In February 2026 X filed the first legal challenge ever brought against a DSA fine, arguing prosecutorial bias and extraterritorial consequences for speech. The litigation is live and unresolved; X’s characterization and the Commission’s travel together here, and this file asserts neither. What the file does assert is the selection effect visible on the surface of the record: fourteen investigations open across the sector, and the first fine landed on the platform whose owner spent three years publicly defying the statute’s enforcement face.

The counter-move, on the record. In December 2025 the United States imposed visa bans on five Europeans it accused of censoring Americans — including the DSA’s own former enforcement commissioner, whom Under Secretary of State Sarah Rogers called the statute’s “mastermind” (Al Jazeera, 24 Dec 2025; EWN, 24 Dec 2025), and the leaders of three flagging organizations. Secretary of State Marco Rubio’s stated grounds: they “have led organized efforts to coerce American platforms to censor, demonetize, and suppress American viewpoints they oppose.” France’s president called the bans “intimidation and coercion”; the Commission’s president said the EU would protect its rules. For the first time, the cost of operating Europe’s content-control machinery was imposed on named operators personally, by another government — the apparatus and the counter-apparatus now sanction each other’s staff. Both characterizations are on the record; the escalation itself is the documented fact.

The enforcement ledger, on the Commission’s own supervision page. The page, updated 15 October 2026, lists every action by service. X: proceedings opened 18 December 2023, preliminary findings 12 July 2024, a retention order on 17 January 2025, the EUR 120 million fine on 5 December 2025, a new investigation on Grok and X’s recommender systems on 26 January 2026, and “Commission accepts X’s action plan” on 15 July 2026 (Commission: supervised VLOPs and VLOSEs). The fine’s own release calls it “the first non-compliance decision under the DSA,” quotes Executive Vice-President Henna Virkkunen on “evading accountability,” and says what it did not decide: the December 2023 proceedings “to assess whether X may have breached the DSA in areas linked to the dissemination of illegal content and the effectiveness of the measures taken to combat information manipulation” are ones “for which the investigation continues” (Commission: fine on X, IP/25/2934, 4 December 2025). The Grok investigation is framed around “manipulated sexually explicit images, including content that may amount to child sexual abuse material” and an “ad hoc risk assessment report” owed “prior to their deployment” (Commission: Grok and X’s recommender systems, 26 January 2026). The July 2026 acceptance came with a Board for Digital Services opinion of 15 June that “considered the proposed changes partially adequate, but deemed X’s audit measures and, as a result, the overall action plan insufficient”; the Commission accepted the plan after “clarif[ying] several points that X must consider,” and gave X “six months to implement” it (Commission: X action plan, 16 July 2026). The marketplaces: Temu was fined EUR 200 million for a risk assessment that was “based on general information about risks concerning the eCommerce sector as a whole, rather than on specific evidence about Temu’s own service,” with mystery-shopping evidence that “a very high percentage of the selected chargers failed basic safety tests” (Commission: fine on Temu, IP/26/1178); AliExpress was fined EUR 550 million on 20 July 2026 for failing “to diligently assess and mitigate risks relating to the sale of illegal, unsafe or counterfeit products” (Commission: fine on AliExpress). The open files: Facebook and Instagram have proceedings from 30 April and 16 May 2024 and preliminary findings dated 24 October 2025, 29 April 2026 and, for Facebook, 10 July 2026, when the Commission “preliminarily found Meta in breach of the Digital Services Act for the addictive design of Instagram and Facebook,” citing “infinite scroll, autoplay, push notifications, and the platforms’ highly personalised recommender systems” (Commission: addictive design, 10 July 2026). TikTok has proceedings from 19 February 2024, 22 April 2024 and 17 December 2024, a binding-commitments decision on 5 August 2024, commitments accepted again on 5 December 2025, and preliminary findings on 15 May 2025, 24 October 2025, 6 February 2026 and 24 July 2026. The three adult-content platforms (Pornhub, XNXX, XVideos) and Stripchat have had proceedings since 27 May 2025 and, for Pornhub, XNXX and Stripchat, preliminary findings of 26 March 2026; Shein has had proceedings since 17 February 2026 and Snapchat since 26 March 2026. The reading across the ledger is narrow and checkable: three fines, none of them for failing to remove a specific item of content. One is for deceptive design and transparency, two are for a risk assessment that was not diligent. The speech-adjacent file, the “information manipulation” strand on X, is the one the Commission itself says is still open.

The counter-record, in the American documents themselves. The House Judiciary Committee’s staff report of 25 July 2025 says the Committee “has issued document subpoenas to nine technology companies,” and its 3 February 2026 sequel says ten, adding OpenAI (letter of 5 November 2025), and that “technology companies have produced to the Committee thousands of internal documents and communications with the European Commission” (House Judiciary Committee: The Foreign Censorship Threat, July 2025; Part II, 3 February 2026). The State Department’s policy announcement of 28 May 2025, “pursuant to Section 212(a)(3)(C) of the Immigration and Nationality Act,” makes foreign nationals “responsible for censorship of protected expression in the United States” inadmissible, and the Secretary’s statement of 23 December 2025 announced action “against five individuals who have led organized efforts to coerce American platforms to censor, demonetize, and suppress American viewpoints they oppose,” adds that the Department “stands ready and willing to expand today’s list if other foreign actors do not reverse course,” and notes that Section 237(a)(4)(C) “renders an alien deportable” on the same finding (State Department: May 2025 policy; State Department: Announcement of Actions to Combat the Global Censorship-Industrial Complex, 23 December 2025). The December release names no one; the five names above come from press reporting of it. The Commission’s own list of designated flaggers carries HateAid gGmbH (certified 2 June 2025 by the Bundesnetzagentur) and does not carry CCDH or GDI, so the “flagging organizations” in the visa action are, on the regulator’s list, one designated flagger and two organizations that are not.

CONDUCT verdict: STATUTE-INSTRUMENT — DUE PROCESS ON PAPER, ONE-WAY IN PRACTICE. A real harmonization statute with a functioning appeal layer, whose elastic risk categories, government-funded flagging lane, and fine-backed incentives push platforms toward over-removal as the safe default — and whose documented enforcement history expands in one direction, from platform process into generative AI, without ever needing to amend the text.

Alliance Map

These run at the same time. The supervised include the same American companies that the House committee subpoenaed; the supervisor is funded by those companies’ fees, and the fee-funded estimate includes staff in the EU Delegation to the United States; the flagger roster mixes rights-holder bodies, financial regulators, child-protection hotlines and, in six entries, civic-discourse monitors; and the State Department sanctions the people it connects to the regime while of the three organizations named in press reports of the action, one is a designated flagger and two are not. The overlap is the finding, not a coordination claim.

Reach Assessment

Institutional: Maximum within its class. The DSA is the enforcement template of the democratic world’s content-control architecture — statutory where the American system was informal, funded where the NGOs are grant-dependent, and permanent where commissioners are temporary. The UK’s Online Safety Act and successor regimes elsewhere are read against it.

Memetic: High. The Brussels Effect is the memetic mechanism in legal form: platforms build one compliance system for their largest regulated market, and the EU’s categories — systemic risk, trusted flagger, statement of reasons — become the vocabulary in which every jurisdiction’s moderation debate is now conducted, including in countries that never voted on it.

Civilizational: High. The statute does not build AI systems and does not write their refusals. It built the legal machinery that decides what the platforms carrying those systems must remove, on pain of six percent of global turnover — and its first reach into generative AI arrived in January 2026, under the old statute, before the new one’s teeth were in. The recurring lesson of this file’s drawer, in statutory form: the capability is built first, the category expands later, and a rulebook never resigns.

Score basis. Atk 9 is reach: Article 22(1) obliges “providers of online platforms” to give designated flaggers’ notices priority, Article 74(1) lets the Commission fine a very large platform “not exceeding 6 % of its total worldwide annual turnover,” and the Commission has used it, EUR 120 million on X, EUR 200 million on Temu and EUR 550 million on AliExpress (Regulation (EU) 2022/2065; fine on AliExpress). It is not a 10 because the Commission’s own releases show the fines so far fell on transparency and risk-assessment duties rather than on a specific takedown, and the Commission’s page says providers “have the sole responsibility to decide upon notices.” Def 9 is funding insulation of the supervisor: the fee is cost-recovery from the supervised, capped at “0,05 % of its worldwide annual net income,” with a 2027 estimate of EUR 58,531,030 before surplus, the Commission is investigator and fining authority in one office, and the one court ruling on its fee decisions, on 10 September 2025, annulled them on the method while keeping their effects (SWD(2026) 178 final; CJEU Press release No 114/25). It is not a 10 because a court has already annulled a Commission decision under the Act, X’s challenge to the December 2025 fine is pending, and the Board for Digital Services deemed X’s overall action plan “insufficient” before the Commission accepted it with clarifications. Hp 9 is entrenchment: a Regulation of 19 October 2022 can be amended only by the Parliament and the Council, the Commission’s staff plans “270 FTEs” and a fee line for 2027, enforcement continued under Virkkunen after the commissioner who first fronted it left, and the designated set grew to include ChatGPT on 31 August 2026 (Commission: designation of ChatGPT, Reddit and Roblox). Peers on the same values: Palantir at 9/9/9, hazard 90, whose def rests on a founder-voting trust and a customer spread, where this file’s rests on a statutory fee and a single investigating-and-fining office; and World Economic Forum at 9/9/9, hazard 84, which has convening reach but no fining power over any provider, which is the difference between 88 and 84. EU AI Act at 8/9/9, hazard 86, and UK Online Safety Act at 8/9/9, hazard 84, share def and hp and sit a point lower on reach; this file’s atk is higher because the Act’s fining power has already been exercised three times against named global platforms, as the releases above record. The values hold.

Sources: Regulation (EU) 2022/2065 — EUR-Lex; The Digital Services Act — European Commission; Trusted flaggers under the DSA — European Commission; Parliamentary question E-002057/2024 — ‘REspect!’ trusted flagger — European Parliament; Article 22 Digital Services Act: Building trust with trusted flaggers — Internet Policy Review; Two years of DSA — almost 50 million content moderation decisions reversed — European Commission; Commission opens formal proceedings against X under the DSA, 18 Dec 2023 — European Commission; Commission fines X €120 million under the Digital Services Act — European Commission; X challenges €120M fine under EU censorship law — ADF International (supports the challenge; characterization attributed); The EU’s fine against X is not about speech or ‘censorship’ — TechPolicy.Press (defense side); US-funded censorship hubs drive EU’s war on tech companies — Foundation for Freedom Online (partisan participant; attributed); The Digital Services Act and the Brussels Effect — Chicago Journal of International Law; EU probes Musk’s Grok AI feature over deepfakes — Al Jazeera, 26 Jan 2026; US bans visas for ex-EU commissioner over alleged censorship — CNBC, 24 Dec 2025; Regulation (EU) 2022/2065, consolidated text — EUR-Lex; Supervision of the designated VLOPs and VLOSEs — European Commission; The enforcement framework under the DSA — European Commission; Digital Services Coordinators — European Commission; Civil society organisations under the DSA — European Commission; List of DSA trusted flaggers (xlsx, updated 5 Oct 2026) — European Commission; Commission fines Temu €200 million — IP/26/1178; Commission fines AliExpress €550 million — European Commission; Commission preliminarily finds the addictive design of Instagram and Facebook in breach of the DSA — European Commission; Commission investigates Grok and X’s recommender systems — European Commission; Commission accepts X’s action plan — European Commission; Commission designates ChatGPT, Reddit, Roblox — European Commission; Overview of the supervisory fee estimate for 2026 — European Commission; Commission staff working document SWD(2026) 178 final — Council register; Press release No 114/25, Cases T-55/24 and T-58/24 — Court of Justice of the European Union; The Foreign Censorship Threat — House Judiciary Committee, 25 July 2025; The Foreign Censorship Threat, Part II — House Judiciary Committee, 3 February 2026; Visa restriction policy targeting foreign nationals who censor Americans — U.S. Department of State, 28 May 2025; Announcement of Actions to Combat the Global Censorship-Industrial Complex — U.S. Department of State, 23 Dec 2025; Thierry Breton — profile.