Five lessons from three years of risk assessments under the Digital Services Act

The Digital Services Act (DSA) mandates that major online platforms conduct annual risk assessments to identify and mitigate systemic threats posed by their services. Analysis of the first three years of these assessments, from 2023 to 2025, by the European Center for Not-for-Profit Law (ECNL) has revealed significant shortcomings. These assessments, in their current iteration, may fail to deliver genuine transparency or hold platforms accountable for decisions impacting vast numbers of internet users. Key among the five identified gaps are concerns that the assessments are insufficient for fostering meaningful accountability. The process, intended to ensure platforms address issues like disinformation and illegal content, is proving to be more of a bureaucratic exercise than a robust mechanism for change. This raises critical questions about the efficacy of the DSA's risk assessment framework and its potential to safeguard users' digital rights. The implications of these identified gaps are far-reaching, affecting millions of users who rely on these platforms for information and interaction. Without effective transparency and accountability, the platforms' unchecked power to shape online discourse and user experiences remains a significant concern. The future direction of the DSA's implementation may need substantial revision to achieve its stated goals of a safer and more accountable digital environment in Europe.