EU Digital Services Act
Active · VLOP enforcement
Article 15 — algorithmic accountability
VLOPs (Very Large Online Platforms) must produce documentation of recommender system logic and automated moderation decisions. DSA audits by the European Commission can demand decision-level audit trails. Active enforcement since February 2024.
EU AI Act
Aug 2 2026 / Dec 2 2027*
Article 6 — high-risk classification
AI used in content moderation and recommender systems is under active scoping for Annex III high-risk classification. If classified, Article 12 logging requirements apply. Platforms should prepare now.
UK Online Safety Act
Active · UK
Algorithmic transparency duties
Ofcom-regulated platforms must document and audit automated content moderation systems. Tamper-evident records of automated enforcement decisions are required to demonstrate duty-of-care compliance.
US Section 230 reform
Proposed · US
Algorithmic decision documentation
Multiple proposed reforms condition Section 230 protections on documented, auditable content moderation practices. Platforms pre-building verifiable audit infrastructure position defensively regardless of which bill passes.
European Commission — DSA VLOP Supervision
Active · VLOPs since Feb 2024
Regulation (EU) 2022/2065 — direct enforcement authority
The European Commission (DG CNECT) is the sole supervisory authority for Very Large Online Platforms and Very Large Online Search Engines. It can demand decision-level audit trails during DSA audits, compel access to algorithmic systems, and impose fines up to 6% of global annual turnover. Meta, Google, TikTok, X, Snap, LinkedIn, Pinterest, and others are designated VLOPs.
Coimisiún na Meán (Ireland)
Active · Dublin-based VLOPs
DSA national coordinator — principal establishment jurisdiction
Ireland's Digital Services Coordinator has jurisdiction over platforms with EU principal establishment in Ireland — Meta, Google, TikTok, X, Snap, LinkedIn, and Pinterest all qualify. Day-to-day supervisory cooperation with the European Commission. Enforcement powers include access to systems, interim orders, and referral to EC for fines.
eSafety Commissioner
Active · Australia
Online Safety Act 2021 — Australia
Australian federal regulator with mandatory CSAM removal notice powers (24-hour takedown), Basic Online Safety Expectations compliance reporting, and industry code enforcement. Fines up to AUD 782,500/day for platforms. Covers all platforms operating in Australia regardless of corporate domicile.
NCMEC / CyberTipline
Active · US (mandatory)
18 U.S.C. § 2258A — mandatory CSAM reporting
US Electronic Service Providers are legally required to report apparent CSAM to the NCMEC CyberTipline. Reports must include contextual metadata (IP, timestamp, account identifiers). Tamper-evident audit records demonstrating reporting completeness and detection timing are required for regulatory examination and child exploitation investigations.
KJM / CMS Germany
Active · Germany
Jugendmedienschutz-Staatsvertrag (JMStV) — youth protection
The Commission for Youth Media Protection (KJM) and the Commission for Media Concentration (CMS) enforce German youth protection requirements for online platforms. Age verification, content classification, and moderation audit documentation requirements apply. Fines up to €500K per violation for non-compliant platforms with German users.