Delegated Act on Independent Audits under the Digital Services Act

Under the Digital Services Act (DSA), Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) must subject themselves to an annual audit, carried out by an independent auditor, to assess their compliance with their DSA obligations and with any commitments undertaken pursuant to codes of conduct and crisis protocols adopted.

This delegated act on independent audits provides a framework to guide providers of VLOPs and VLOSEs, as well as auditing organisations, in the preparation and issuance of audits.

The delegated act is an important step towards ensuring the comparibility of audits carried out for the different platforms. It does so by setting out mandatory templates for the audit reports produced by auditors, as well as for the audit implementation reports, which will be produced by VLOPs and VLOSEs.

The reports should present a clear opinion concerning the compliance of the audited service with the DSA, and an opinion on the compliance with each code of conduct and crisis protocol under which an audited VLOP or VLOSE made voluntary commitments. Such codes and protocols will need to be recognised by the Commission and the European Board for Digital Services, which has been established on 17 February 2023.

The publication of audit reports and audit implementation brings about a step-change in the transparency and accountability of such providers and shall offer a comparative basis for public scrutiny. The audit reports should also be a valuable source of information for the Commission and Digital Services Coordinators and other competent authorities under the framework of the DSA.

The 20 VLOPs and 2 VLOSEs will have to transmit these audit reports to the Commission and the competent Digital Services Coordinator in their Member State of establishment. They will also have to publish them at the latest within three months from the time they complete the audit report.