UPDATE – JUNE 2025: The European Commission’s Delegated Regulation (EU) 2024/436 establishing mandatory audit rules for VLOPs and VLOSEs is officially in effect. These new provisions were adopted on February 22, 2024 and are applicable after a scrutiny period. They define how independent audits must be conducted under the DSA.

The first required audit submissions are due by August 2024, with designated platforms obligated to appoint independent auditors, agree on appropriate methodologies, and publish their audit findings within three months of filing their implementation reports.

ORIGINAL NEWS STORY:

European Commission Adopts Rules on Independent Audits

While the European Union continues to finalize the details of the Harmonised Rules on Artificial Intelligence, or the EU AI Act, a significant development has occurred with the European Commission adopting a delegated regulation under the Digital Services Act (DSA). This Commission Delegated Regulation complements the regulations in place for digital services by establishing rules for conducting audits on very large online platforms (VLOPs) and very large online search engines (VLOSEs). The DSA is presently applicable to VLOPs and VLOSEs.

The Commission Delegated Regulation outlines rules concerning procedural steps, auditing, and reporting templates for audits performed on VLOPs and VLOSEs. The audit report template encompasses sections on the audit scope, methodology, findings, and opinion. The audit implementation report template covers sections on the implementation of audit recommendations, implementation status, and reasons for any non-implementation. The selection of the audit methodology should cater to the specifics of the audited obligation or commitment and be adaptable. It should also consider other information provided by the provider. That includes a risk analysis if the provider has conducted such an analysis. A written agreement, incorporating contractual terms, must be established between the audited provider and the auditing organization.

 First 19 to Undergo Audits

19 services were identified by the European Commission in April 2023 as the first to undergo audits. These services include Alibaba AliExpress, Amazon Store, Apple AppStore, Bing, Booking.com, Facebook, Google Search, Google Play, Google Maps, Google Shopping, Instagram, LinkedIn, Pinterest, Snapchat, TikTok, Twitter, Wikipedia, YouTube, and Zalando. They have until the end of August 2024 to submit their initial audits to the Commission. It’s crucial to emphasize that the delegated act aims to establish a legal framework for all online intermediary services.

Need Help?

For assistance in navigating DSA audit rules and compliance, don’t hesitate to contact BABL AI. One of their audit experts can offer valuable guidance and support before the DSA goes into full effect.