Think the EU’s Digital Services Act is only for the big platforms? Think again.
The 2026 rules create tiers that hit marketplaces and any retailer hosting third-party sellers hardest, and they apply to services offered in the EU no matter where you’re registered.
This checklist tells you exactly what changed, why it matters, and what to do first: build a notice-and-action workflow, verify every professional seller, rewrite Terms to explain moderation and algorithms, and keep audit logs for the required transparency report.
Start by mapping where you fit under the DSA.
Core DSA 2026 Compliance Checklist for Online Retailers
The Digital Services Act creates a tiered system based on what you do and how many people you reach. If third-party sellers list products on your platform, you’re facing stricter rules than someone just running their own catalog. Your most urgent task? Building documented procedures for removing illegal content, notifying consumers, and verifying traders.
Start by figuring out where you fit in the DSA’s three-tier setup. General intermediary services have basic transparency duties. Hosting services need to respond when someone flags illegal content. Online platforms (marketplaces and any retailer letting users interact or third parties sell) carry the full load: content moderation, advertising transparency, complaint systems, trader traceability. And yes, this applies to you if you’re offering services in the EU, no matter where your business is registered.
Put your energy into notice-and-action workflows first. You need a public reporting tool, internal escalation routes, and documented timelines. Then verify every professional seller using standardized identity and business registration checks. Update your Terms to explain moderation rules, how your algorithms work, and user appeal rights in plain language. Finally, get ready for your first transparency report covering 2026, due by end of February 2027.
Documentation proves you’re compliant. Keep logs of every takedown request, your reasoning, trader checks, consumer notifications, complaint resolutions. Hold these for at least six months after you close the case. Longer if you’re a Very Large Online Platform or expect regulators to come knocking.
Critical steps for 2026:
- Build a standardized notice-and-action system that takes reports of illegal listings, processes them on a clear timeline, and tells reporters what happened.
- Verify identity, contact info, and business registration for all professional traders before they can list anything.
- Rewrite your Terms to describe moderation rules, recommendation algorithms, and banned product categories in language actual humans can understand.
- Set up a complaint and appeals process so users can challenge your decisions, with documented internal review steps.
- Label all ads clearly and disclose who’s advertising. Explain why someone saw a specific ad if you used algorithmic targeting.
- Add user reporting tools right into product pages and checkout, so reports reach your moderation team without friction.
- Create workflows that prioritize notices from “trusted flaggers” certified by national authorities.
- Notify consumers who bought an illegal product in the last six months if you learn about the violation. Publish a public notice if you can’t reach them.
- Run random spot checks of active listings against EU product safety and compliance databases.
- Publish an annual transparency report by end of February each year, covering all moderation actions, complaints, and suspensions from the prior year.
- Keep audit trails for every moderation decision: timestamps, criteria used, who or what made the call.
- Use the standardized transparency report templates required by Regulation (EU) 2024/2835, starting 1 July 2025.
| Requirement | Who Must Comply | Due By |
|---|---|---|
| Annual transparency report | All online platforms and marketplaces | End of February each year |
| Trader verification and traceability | All online marketplaces | Already in force (17 Feb 2024) |
| Standardized reporting templates | All reporting entities | 1 July 2025 |
| Biannual transparency reports with staffing metrics | VLOPs (≥45 million EU users) | End of February and August |
| Independent risk audits and vetted researcher data access | VLOPs only | Within 4 months of VLOP designation |
Understanding Your Platform Category Under the DSA
The DSA breaks online services into three buckets, each with different compliance weight. Intermediary services (ISPs, domain registrars, network infrastructure) need to publish contact points and cooperate with authorities but don’t handle content moderation. Hosting services store user content or third-party info (cloud storage, basic web hosts). They have to act on notices about illegal content but don’t need proactive moderation systems or complaint workflows.
Online platforms sit at the top. If users can post reviews, upload images, interact with sellers, or list products, you’re an online platform under DSA rules. Traditional marketplaces, social commerce sites, any retailer with customer interaction beyond a basic contact form. Once you’re classified as an online platform, you inherit the full package: transparency, moderation, user protection obligations.
What this means for you:
- Intermediary services get minimal burden. Transparency about service terms and cooperation with authorities.
- Hosting services must remove illegal content when notified, keep logs of notices, provide a reporting mechanism.
- Online platforms face full DSA compliance: trader verification, advertising transparency, content moderation policies, complaint systems, annual reporting.
- Very Large Online Platforms (VLOPs, 45 million monthly EU users or more) add systemic risk assessments, independent audits, biannual reports, and data sharing with regulators and vetted researchers.
Mandatory Transparency and Reporting Requirements
Every online platform publishes an annual transparency report covering the prior calendar year, due by end of February. You’ll detail illegal listings removed, moderation actions taken, complaints received, disputes escalated to certified bodies, trader suspensions. Starting 1 July 2025, all reports follow standardized templates from Regulation (EU) 2024/2835, which nail down specific categories, metrics, formatting.
VLOPs report twice a year, end of February and six months later. These reports add operational details: how many people you’ve got on content moderation, average monthly active users broken down by EU Member State, summaries of systemic risk assessments. The tighter schedule and deeper disclosure reflect the platform’s reach and potential impact on public safety and consumer protection.
Algorithmic transparency is separate but connected. If you use recommender systems to surface products, personalize search, or target ads, explain the main parameters and logic in your Terms. Users should understand why they’re seeing certain products and how the algorithm weighs things like purchase history, location, browsing behavior. You don’t have to give away proprietary code, but the explanation needs to be clear enough for an average consumer.
What goes in your report:
- Total moderation actions, broken down by type (removal, suspension, restriction).
- Number of notices from users, trusted flaggers, authorities, plus average response time.
- Complaint and appeals stats, including how things got resolved and how long it took.
- Trader accounts suspended and suspension duration.
- Summary of cross-checks you ran against product safety databases.
Notice-and-Action and User Complaint Mechanisms
You need an easy reporting tool that lets anyone (customers, rights holders, authorities) flag illegal content or unsafe products. The notice should include enough detail to pin down the issue: a link to the listing, what’s wrong, supporting evidence. Acknowledge receipt and communicate a decision within a reasonable timeframe.
When you pull a listing or suspend a trader, notify both the reporter and the affected seller. Explain which rule got broken and whether they can appeal. If the notice came from a “trusted flagger” (an entity certified by national authorities), process it faster and log that priority handling.
Users whose content gets removed or accounts restricted can appeal. Your complaint system has to be accessible, free, and staffed with human reviewers for anything non-trivial. Document every complaint: date received, decision, reasoning, whether you upheld or reversed the original call. If the user’s still unhappy, point them to certified out-of-court dispute resolution bodies.
Traceability and Verification of Professional Traders
Before a business seller lists their first product, verify who they are and their legal status. Collect full legal name, registered address, contact details, business registration number, bank account info. Cross-check against official company registries, tax databases, chamber of commerce records. If verification fails or they give you incomplete information, don’t let them go live.
Keep an internal database of verified traders and flag anyone providing false or misleading information. If a trader repeatedly sells illegal or unsafe products, suspend their account after a warning. The suspension should be proportionate (long enough to matter but not indefinite without review). Document every suspension: prior warnings, specific violations that triggered the action.
Traceability goes beyond onboarding. Use tech to track product origin, supply chain steps, seller fulfillment patterns. Digital product identifiers, GS1 barcodes, tamper-proof records help you notify affected consumers fast if a product turns out to be illegal or unsafe. If you discover a violation after sale, notify every customer who bought the item in the last six months. Can’t reach them? Publish the warning prominently on your platform.
What you need to verify:
- Legal business name and any trading names used on the platform.
- Full registered address and primary contact email and phone number.
- Official business registration or tax ID number.
- Bank account details or payment service provider info to establish financial accountability.
Content Moderation and Terms of Service Updates
Your Terms need to spell out what’s prohibited, how you detect violations, and what happens when someone breaks a rule. Write in plain language. Users should understand without a lawyer that selling counterfeit goods or unsafe products gets them removed and possibly suspended.
Explain your moderation tools. If you use automated filters to scan for prohibited keywords or image recognition to catch unsafe products, say so. If human moderators review flagged items, describe the workflow and typical response times. Being transparent about how decisions get made builds trust and shows you’re compliant.
Don’t design your platform to manipulate users into choices that hurt them. Dark patterns (confusing layouts, hidden opt-outs, pre-checked boxes for unwanted services) are banned. Your checkout flow, subscription settings, product presentation need to be straightforward and neutral. Audit your UX regularly to make sure it supports informed decisions, especially for vulnerable groups like minors.
Data Retention, Recordkeeping, and Audit Preparation
Keep logs of every notice received, moderation decision made, complaint processed. Minimum six months after you close the matter. If you’re a VLOP or expect regulatory scrutiny, extend retention to support annual audits and potential enforcement investigations. Each log entry should include timestamps, who initiated the action, who decided (human or automated), and a brief explanation referencing the specific Terms clause.
Get your recordkeeping infrastructure ready for transparency reports and audit requests. When a national authority or the European Commission asks for compliance evidence, you need to pull aggregated stats and drill into individual cases fast. Invest in compliance management software that tags records by violation type, trader identity, resolution outcome. Run internal audits quarterly to verify logs are complete, retention policies are followed, documentation matches what users see.
Risk assessments and mitigation are ongoing, especially for larger platforms. Document the controls you’ve built to reduce exposure to illegal goods, protect minors, ensure algorithmic fairness. VLOPs must commission independent audits annually and publish results. Even smaller retailers benefit from periodic third-party reviews that confirm systems work as designed and gaps get addressed before enforcement.
Records to maintain:
- Notice logs: every report received, who submitted it, what got flagged, date, response taken.
- Moderation decision records: timestamps, criteria applied, human or automated reviewer, notification sent.
- Trader verification files: identity documents, business registration confirmations, database cross-check results, ongoing compliance checks after onboarding.
Final Words
in the action we laid out a prioritized EU Digital Services Act checklist: core obligations, how to classify your platform, transparency and reporting deadlines, notice-and-action rules, trader verification, T&C and moderation updates, and recordkeeping needs.
Use the EU Digital Services Act 2026 compliance checklist for online retailers as a simple playbook: audit top sellers, implement notice-and-action, update T&Cs, schedule your annual transparency report, and keep 6-month records.
Small moves now cut risk later. You’ll be compliant and keep running.
FAQ
Q: What is the core DSA compliance checklist for online retailers?
A: The core DSA compliance checklist for online retailers includes illegal‑content procedures, consumer protection checks, trader traceability, transparency reporting, notice‑and‑action systems, algorithm and ad disclosures, and recordkeeping for audits.
Q: Which platform category applies to my service under the DSA?
A: The platform category that applies depends on your role: intermediary (pure conduit), hosting (stores third‑party content), or online platform (organises interactions); size and user metrics determine the exact track and obligations.
Q: What are the differences in obligations between general online retailers and VLOPs/VLOSEs?
A: The differences are that large platforms face stricter requirements: deeper transparency, systemic‑risk assessments, independent audits, stronger algorithm explanations, and faster reporting and mitigation duties than general retailers.
Q: What must go into annual transparency reports in 2026?
A: Annual transparency reports must include moderation practices, enforcement statistics, recommender system summaries, ad transparency details, number of notices handled, and metrics on complaints and remedies.
Q: What are the notice‑and‑action and user complaint requirements?
A: Notice‑and‑action and complaint requirements mean you must publish a standardized complaint interface, acknowledge notices, act within set timelines, communicate decisions to users, and keep audit logs.
Q: What timelines apply for responding to illegal content notices under the DSA?
A: Timelines for responding to illegal content notices vary by severity and platform size; expect expedited handling for urgent cases (often 24–72 hours) and documented responses within the DSA’s required periods.
Q: What does trader verification require for professional sellers?
A: Trader verification requires KYC‑style checks: verify corporate identity, business registration, VAT/tax identifiers, contact details, and remove or suspend sellers who fail verification.
Q: What must I change in my Terms of Service and moderation policies?
A: You must make T&Cs and moderation policies clear, user‑friendly, non‑discriminatory, explain moderation tools and appeals, and publish decision criteria so users easily understand enforcement.
Q: How long must I retain notices, complaint logs, and decision justifications?
A: You must retain notices, complaint logs, and decision justifications for at least 6 months; larger platforms may face longer retention and extended documentation for audits.
Q: What are the ad and algorithm transparency obligations?
A: Ad and algorithm transparency obligations require disclosing sponsored content, advertiser identity, targeting criteria, and providing plain‑language explanations of recommender logic and significant parameters.
Q: Who are trusted flaggers and what internal processes are needed?
A: Trusted flaggers are vetted organizations or experts whose notices get priority; you need a validated intake channel, faster review workflows, and documentation for flagged actions.
Q: What practical first steps should retailers take now to prepare for DSA 2026?
A: Practical first steps are to audit current systems, implement notice‑and‑action flows, update T&Cs, build seller verification, plan annual reports, set 6‑month retention, and train staff on new processes.