/807-regulations-eu-digital-services-act

name: 807-regulations-eu-digital-services-act
description: Use when reviewing, designing, or modifying Java enterprise systems that may support intermediary services, hosting services, online platforms, marketplaces, content moderation, recommender systems, advertising delivery, complaint workflows, transparency reporting, or systemic-risk evidence under the EU Digital Services Act. This should trigger for requests such as Review a Java online platform for DSA controls; Design notice-and-action or appeal workflows; Add recommender, ad transparency, moderation, audit, researcher access, or privacy-safe observability evidence; Assess online-platform transparency controls before production release. Part of Plinth Toolkit
license: Apache-2.0
metadata:
  author: Juan Antonio Breña Moral
  version: 0.19.0

EU Digital Services Act Regulation for Java Online Platform Engineering

Use this Skill to review Java enterprise applications, online platforms, marketplaces, hosting services, content moderation tools, recommender systems, advertising systems, complaint workflows, transparency reporting pipelines, operational dashboards, or audit evidence that may require Digital Services Act-aware engineering controls.

Apply this Skill to determine what engineering controls, operational evidence, and escalation paths are needed before a Java system is released, connected to production traffic, used for online platform operations, or relied on for content moderation, recommender, advertising, complaint, or systemic-risk workflows.

This Skill is not legal advice. It helps Java engineers, architects, tech leads, platform teams, trust-and-safety teams, and reviewers identify when Digital Services Act concerns may apply and how to translate online platform expectations into enterprise architecture controls such as content decision audit logs, moderation workflow state, notice intake and response tracking, recommender and ranking explanation evidence, advertising transparency metadata, user controls, complaint and appeal workflows, risk assessment evidence, incident escalation, data access for auditors or researchers where applicable, and privacy-safe observability.

The purpose of this Skill is to increase awareness of potential gaps in the system and create engineering evidence for qualified review. The response produced by this Skill does not represent legal advice, a legal opinion, or a final regulatory determination.

The main question is:

> When does a Java enterprise system require Digital Services Act-aware online platform controls, and what should developers build differently?

External reference: [Regulation (EU) 2022/2065 Digital Services Act](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R2065).

Digital Services Act chapters summary reference: [Digital Services Act chapters summary](references/807-regulations-eu-digital-services-act-chapters-summary.md).

Java engineering examples reference: [Digital Services Act engineering examples](references/807-regulations-eu-digital-services-act-engineering-examples.md).

Report template asset: [Digital Services Act engineering review report template](assets/reports/807-eu-digital-services-act-engineering-review-report-template.md).

Scope

This Skill applies to:

• Java systems that may provide intermediary services, hosting services, online platforms, online marketplaces, or online interfaces where users, traders, or third parties provide content, products, services, or information
• Spring Boot, Quarkus, Micronaut, and framework-agnostic Java services with notice-and-action, content moderation, statement-of-reasons, trusted flagger, complaint, appeal, or out-of-court dispute evidence requirements
• Search, ranking, recommendation, feed, catalog ordering, personalization, advertising, ad repository, trader traceability, transparency reporting, user controls, and minor-protection workflows
• Very large online platform or very large online search engine evidence where applicable, including systemic risk assessment, mitigation, crisis response, independent audit, compliance function, data access, vetted researcher access, and transparency reporting
• Privacy-safe observability, incident escalation, moderation audit logging, user notification, workflow state, data access control, retention, and evidence reconstruction for platform governance

Digital Services Act Engineering Review

Treat intermediary classification, hosting or online-platform classification, very-large-online-platform or very-large-online-search-engine scope, illegal-content policy, advertising or recommender interpretation, audit or researcher access duties, systemic-risk conclusions, and regulatory interpretation as governance decisions for legal, compliance, trust-and-safety, privacy, security, product, risk, and executive accountability owners.

Engineering teams should still create evidence that makes those decisions reviewable:

• Which user, trader, platform, marketplace, hosting, recommendation, advertising, complaint, or moderation workflows are in scope
• Which content or product decisions are made, why they are made, which policy or order drove them, who can appeal them, and how decisions are audited
• Which notices, orders, complaints, appeals, trusted flagger reports, and out-of-court dispute outcomes can be tracked end to end
• Which recommender, ranking, advertising, user-control, minor-protection, trader-traceability, and transparency-reporting evidence exists
• Which risk assessment, mitigation, audit, data access, researcher access, incident escalation, and privacy-safe observability evidence is available where VLOP or VLOSE concerns may apply

Constraints

Translate Digital Services Act concerns into engineering controls for Java enterprise systems. Do not provide legal advice or replace review by legal, compliance, trust-and-safety, privacy, security, product, risk, audit, research-access, or executive accountability owners.

• **N