Module 5 – The Digital Rulebook: DSA, DMA, and Beyond

Step 1 – From Product Rules to the Digital Rulebook

In Modules 3 and 4 you saw how the New Legislative Framework (NLF) structures EU product rules: harmonised standards, conformity assessment, CE marking, and market surveillance.

This module zooms out to the EU’s digital rulebook, which focuses less on the safety of products and more on the behaviour of digital services and platforms.

Where we are today (late 2025)

• Digital Services Act (DSA)
• Regulation (EU) 2022/2065
• Entered into force in 2022
• Fully applicable since February 2024 (with earlier obligations for very large platforms in 2023)
• Digital Markets Act (DMA)
• Regulation (EU) 2022/1925
• Entered into force in 2022
• Core obligations started to apply from March 2024 after the first gatekeeper designations in 2023

These are Regulations, not Directives, so they apply directly in all Member States.

How this connects to the NLF

• NLF: "Is this product safe and compliant before it enters the market?"
• DSA/DMA: "Are digital services and platforms behaving fairly, transparently, and safely while operating in the EU?"

You should keep asking yourself:

> How do product-focused rules (NLF) and service/market-focused rules (DSA/DMA) complement each other rather than overlap?

Step 2 – The EU Digital Strategy and Where DSA/DMA Fit

The DSA and DMA sit inside a wider EU digital strategy that aims at a human‑centric, fair, and innovative digital economy.

Key building blocks (simplified):

• Digital Services Act (DSA) – Online safety & responsibility
• Focus: illegal content, systemic risks, transparency, user protection
• Digital Markets Act (DMA) – Fair competition in digital markets
• Focus: very large online platforms acting as gatekeepers
• Data & AI framework (for context, not main focus here):
• GDPR – personal data protection (since 2018)
• Data Governance Act – data-sharing mechanisms
• Data Act – access to and use of non-personal data (entered into force 2023, applies progressively from 2025–2026)
• AI Act – risk-based rules for AI systems (political agreement 2023, formally adopted 2024; obligations phase in from 2025 onwards)

Where NLF fits:

• NLF-based product laws (e.g. Radio Equipment Regulation, Machinery Regulation, Toys, Low Voltage Directive, etc.) regulate products and their safety.
• DSA/DMA regulate platforms, intermediaries, and digital markets.

Visual picture (imagine a layered diagram):

1. Bottom layer – Products: NLF + CE marking (Is the device/software as a product safe and compliant?)
2. Middle layer – Data & AI rules: GDPR, Data Act, AI Act (How is data and AI handled?)
3. Top layer – Platforms & Markets: DSA & DMA (How do online intermediaries and big platforms behave?)

Step 3 – The Digital Services Act (DSA): Who and What?

The DSA updates and replaces the older e-Commerce Directive (2000) as the main horizontal rulebook for online intermediaries in the EU.

Who does the DSA apply to?

Any intermediary service offered to users in the EU, whether or not the provider is established in the EU. This includes:

• Mere conduit: e.g. internet access providers
• Caching services
• Hosting services, including:
• Online marketplaces (e.g. Amazon Marketplace, eBay)
• Social media platforms (e.g. Facebook, TikTok)
• App stores
• Online platforms for content-sharing, reviews, rentals, etc.

Within this, the DSA defines special categories:

• Online platforms – hosting services that disseminate information to the public (e.g. social networks, marketplaces)
• Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) – services with 45 million+ monthly active users in the EU (about 10% of the EU population)

Why this matters for you

If you work on:

• a marketplace that sells CE‑marked products, or
• a social media service where traders advertise products,

…you must understand that product compliance (NLF) and platform obligations (DSA) both apply, but in different ways.

Think of the DSA as setting the rules of the game for how platforms handle content, users, and traders.

Step 4 – DSA in Practice: From Illegal Content to Transparency

Let’s make the DSA more concrete with three practical scenarios.

Scenario 1 – Illegal product listings on a marketplace

You run an EU‑facing online marketplace. A consumer reports a listing for a toy with fake CE marking and clear non‑compliance with toy safety rules.

Under the DSA, you must:

1. Provide a notice mechanism: A clear, user‑friendly way for anyone to flag illegal content (in this case, the illegal listing).
2. Act diligently: When the notice is sufficiently precise and well‑founded, you must act to remove or disable access to the listing expeditiously.
3. Inform the user who posted the listing and give reasons for your decision.
4. Keep records of notices and actions and publish transparency reports.

Note the complementarity:

• NLF/product law: says the toy itself must comply with product safety rules.
• DSA: says your platform must have proper processes to detect and act on illegal offers.

Scenario 2 – Recommendations on a social media platform

You work on the recommendation algorithm of a video‑sharing platform.

Under the DSA, especially for large platforms:

• You must explain in plain language how your recommender system works (main parameters).
• You must offer at least one non‑profiling option (e.g. chronological feed) to users of large platforms.
• For VLOPs/VLOSEs, you must assess and mitigate systemic risks, e.g. dissemination of illegal content, impact on fundamental rights.

Scenario 3 – Platform terms and conditions

You manage the legal/UX team for a platform.

DSA requires:

• Clear and unambiguous terms and conditions, easily accessible.
• Information on:
• content moderation policies
• use of automated tools
• complaint-handling systems and out-of-court dispute settlement.

These rules do not replace GDPR, consumer law, or sectoral safety rules; they sit on top and structure how platforms behave overall.

Step 5 – Quick Check: DSA Basics

Test your understanding of core DSA ideas.

Step 6 – The Digital Markets Act (DMA): Gatekeepers and Fairness

The DMA targets a specific problem: very large digital platforms that act as gatekeepers between business users and end users.

What is a gatekeeper?

A gatekeeper under the DMA is a company that:

• Provides one or more core platform services (CPS) such as:
• online intermediation (marketplaces, app stores)
• search engines
• social networking services
• video-sharing platforms
• operating systems
• web browsers, virtual assistants, online advertising services, etc.
• Has a significant impact on the internal market (based on turnover and market capitalisation thresholds).
• Has a strong intermediation position between business users and end users.
• Has or is expected to have a durable position.

The European Commission designates gatekeepers based on criteria and evidence. Several large tech companies were designated starting in 2023, and their core obligations have applied since 2024.

What does the DMA require?

The DMA uses a list of do’s and don’ts:

• Do’s (examples):
• Allow business users to access data they generate on the platform.
• Ensure interoperability with third-party services in certain conditions.
• Allow users to easily uninstall pre‑installed apps.
• Don’ts (examples):
• No self‑preferencing in rankings (e.g. favouring own services in search results).
• No preventing business users from offering better prices or conditions elsewhere.
• No combining personal data from different services without valid consent (in addition to GDPR rules).

The DMA is about market structure and fairness, not about individual product compliance.

Step 7 – DMA in Practice: Gatekeepers and Business Users

Consider three concrete situations to see how the DMA works.

Situation 1 – An app developer vs. an app store gatekeeper

You are a small EU app developer selling through a major app store that has been designated as a gatekeeper.

Under the DMA:

• You must be allowed to:
• Communicate directly with your customers (e.g. email them about cheaper offers on your website), within GDPR limits.
• Use alternative in‑app payment systems (subject to specific DMA conditions and ongoing enforcement practice).
• The gatekeeper cannot:
• Prevent you from promoting your app outside the app store.
• Use non-public data from your app to compete unfairly with your own app.

Situation 2 – Online marketplace favouring its own products

You sell electronics on a large marketplace that also sells its own brand electronics.

Under the DMA, if that marketplace is a gatekeeper:

• It cannot self‑preference its own products in search rankings.
• It must apply transparent and fair ranking criteria.

Situation 3 – Operating system and pre‑installed apps

You buy a smartphone with a pre‑installed browser and music app from a gatekeeper OS provider.

Under the DMA:

• You must be able to easily uninstall pre‑installed apps (with some exceptions, e.g. for essential system components).
• You must be able to change defaults (e.g. default browser, search engine) without undue friction.

These obligations are enforced centrally by the European Commission, which can impose significant fines and remedies for non-compliance.

Step 8 – Thought Exercise: DSA vs DMA vs NLF

Use this short exercise to connect the three frameworks.

For each scenario below, decide which framework is primarily engaged: DSA, DMA, or NLF/product law. (In reality, more than one may apply, but pick the main one.)

1. A smart toy sold in the EU has a design fault that can physically injure children.
2. A marketplace makes it hard for consumers to report clearly illegal product listings.
3. A dominant app store forces developers to use its own payment system with high commissions.
4. A connected home device is CE‑marked but later found to have cybersecurity vulnerabilities that could be exploited.
5. A very large social media platform’s algorithm spreads disinformation at scale, affecting elections.

Pause and decide before reading the suggested mapping below.

Suggested primary mapping:

1. NLF/product law – product safety and conformity.
2. DSA – notice-and-action mechanisms and platform duties.
3. DMA – gatekeeper abuse of power over business users.
4. NLF/product law (plus, in some cases, cybersecurity-specific acts) – safety and essential requirements for connected products.
5. DSA (especially VLOP obligations) – systemic risk assessment and mitigation, transparency.

Notice how DSA and DMA are horizontal service/market rules, while NLF is about products and CE marking.

Step 9 – Key Term Flashcards

Flip the cards (mentally or with your study tool) to reinforce the core concepts.

Step 10 – Linking DSA, DMA, and NLF

One more question to check how well you can connect the frameworks.