What the DSA actually expects when users upload illegal content

If you run a service where users upload images, video, or text, and people in the European Union can use it, the Digital Services Act applies to you. Not "will apply", not "applies to Big Tech" — it has applied to intermediary services of every size since 17 February 2024, and it applies whether or not your company is established in the EU.

This guide covers the part of the DSA that matters most for trust & safety work: what happens when illegal content — child sexual abuse material (CSAM) being the most serious case — shows up on your infrastructure. It's written for founders, engineers, and whoever just became "the trust & safety owner" at a platform that is too big to ignore the problem and too small to have a policy department.

Who the DSA covers, in one minute

The DSA — Regulation (EU) 2022/2065 — stacks obligations in tiers. Each tier includes everything from the tiers below it:

• Intermediary services — the baseline: points of contact, terms that say how you moderate, annual transparency reporting.
• Hosting services — anyone storing content at a user's request. This adds the mechanics that matter here: notice-and-action, statements of reasons, and the duty to report suspected serious crimes. If your users upload anything, you are at least in this tier.
• Online platforms — hosting services that disseminate content to the public (social networks, marketplaces, forums). Adds internal complaint handling, trusted flaggers, protections for minors, and more. Micro and small enterprises are exempt from parts of this tier — but not from the hosting-tier basics.
• Very large online platforms (VLOPs) — 45 million+ average monthly EU users, designated by the Commission. Adds systemic risk assessments, mitigation measures, and independent audits.

Non-EU providers serving EU users must also designate a legal representative in the Union (Article 13). Enforcement runs through national Digital Services Coordinators, with fines of up to 6% of annual worldwide turnover at the top end.

The core mechanics for illegal content

The liability shield is conditional (Article 6). Hosting providers aren't liable for user content they don't know about. But once you obtain actual knowledge or awareness of illegal content — through a notice, your own detection, or any other route — the clock starts: act expeditiously to remove it or disable access, or the shield drops.

Notice-and-action is mandatory (Article 16). You must offer an accessible way for anyone to flag content they consider illegal, and process those notices in a timely, diligent, non-arbitrary way. A sufficiently precise and substantiated notice can itself count as actual knowledge — which is what makes "we never look at reports" a liability strategy, not a neutral default.

Every restriction needs a statement of reasons (Article 17). Remove content, demote it, or suspend an account, and you owe the affected user a clear, specific explanation: what happened, on what legal or contractual ground, what facts it was based on, and how to appeal. Online platforms additionally submit these statements to the Commission's public DSA Transparency Database. You cannot write these from memory — they have to come from moderation data you actually recorded.

Suspected serious crimes must be reported (Article 18). If you become aware of information giving rise to a suspicion that a criminal offence involving a threat to someone's life or safety has taken place, is taking place, or is likely — CSAM is the canonical case — you must promptly inform law enforcement or judicial authorities of the member state concerned. This is a duty you want an escalation path for before the first incident, not during it.

Transparency reporting is annual, minimum (Articles 15 and 24). Reports cover notices received, actions taken, own-initiative moderation, and accuracy indicators. The practical consequence: you can only report what you logged.

What the DSA does not require

This part gets overstated by vendors, so let's be precise.

There is no general monitoring obligation (Article 8). Nothing in the DSA forces you to scan every upload or actively hunt for illegality. Anyone telling you "the DSA requires you to scan all content" is selling something.

Voluntary detection does not cost you the liability shield (Article 7). Before the DSA, platforms genuinely feared that proactively looking for illegal content meant knowing about it, and knowing meant liability. The DSA's "Good Samaritan" clause settles this: carrying out voluntary, good-faith investigations to detect and remove illegal content does not forfeit the hosting exemption. Proactive scanning is legally safer than it has ever been.

No tool makes you compliant. Compliance lives in your processes — your notice channel, your decisions, your statements of reasons, your reports. Detection infrastructure supplies those processes with signals and evidence. It cannot replace them, and a vendor who claims otherwise should worry you.

Why platforms deploy proactive detection anyway

If scanning is optional, why does everyone serious about this do it?

1. "Expeditiously" is measured from awareness — harm is measured from upload. Relying on notices alone means the worst material stays live until someone reports it. For CSAM, the users most likely to encounter it are the least likely to report it.
2. Article 18 needs a trigger. You cannot report a suspicion you never formed. Detection is what turns "it was on our servers for months" into "it was blocked at upload and reported the same day".
3. Statements of reasons need evidence. A logged score, threshold, and timestamp make Article 17 statements and transparency reports precise. "A moderator thought so" does not.
4. Your moderators are people. Routing only genuinely ambiguous cases to human review is a duty-of-care decision as much as an efficiency one.
5. Notices scale with users; review teams don't. Platforms that grow into the online-platform tier — or toward VLOP designation and its risk-mitigation duties — need machinery that scales sublinearly in humans.

Where detection infrastructure fits

A detection API sits between upload and moderation queue: content goes in, a probabilistic score and a verdict come back, and an audit entry records what was decided and why. Mapped to the DSA, that gives you awareness at upload time (Article 6), a documented basis for every restriction (Article 17), a trigger for law-enforcement reporting (Article 18), and the numbers your transparency report needs (Articles 15 and 24).

The division of labour stays fixed: detection provides the technical capability; the obligations — and the decisions — remain yours. That's not a disclaimer, it's the design. Details on how Visork handles the data side of this are on the trust page.

Adjacent rules to keep on your radar

• GDPR. Scanning user content is processing personal data. You need a lawful basis, Article 28 data-processing agreements with every processor that touches user content, and a considered answer on data residency. (The Visork DPA is public.)
• The proposed EU CSA Regulation. The draft regulation on combating child sexual abuse — risk assessments and, most controversially, detection orders — has been under negotiation for years and was still not finalized at the time of writing. If adopted, it would introduce obligations beyond the DSA. Track it.
• National law. Member-state criminal law adds its own reporting and preservation duties, and a provider that falls within the US definitions of an electronic communication service or a remote computing service separately owes NCMEC CyberTipline reports under 18 U.S.C. § 2258A — a test about what kind of provider you are, not simply about having US users.

A reasonable starting point

A checklist that would put a small or mid-size platform ahead of most:

1. A notice channel (Article 16) that a human actually reads, with target handling times written down.
2. An internal policy that distinguishes illegal content from terms-of-service violations, and says who decides what.
3. A statement-of-reasons template (Article 17) that fills itself from moderation data.
4. A law-enforcement escalation path (Article 18): who contacts whom, what gets preserved, on what timeline.
5. Proactive detection at upload for the highest-severity categories, with score, threshold, and verdict logged for every decision.
6. Logging designed for the annual transparency report from day one — retrofitting it is miserable.
7. Signed DPAs and a residency decision for every processor in the content path.
8. A recurring reminder to check the CSA Regulation's status.

This guide is general information about the DSA as it stood in August 2026, not legal advice. Obligations depend on your service's classification, member state, and facts — verify the current state of the law with counsel before relying on it.