Blog · Analysis · Last reviewed June 19, 2026

The Platform Risk Assessment Becomes the Feed's Confession

The Digital Services Act does something simple and radical: it treats the feed as a system that can create public risk, not merely host user speech. Very large platforms must assess, document, audit, and sometimes redesign the machinery that decides what becomes visible.

The confession is not a moral admission. It is a contestable record: what the platform believes its systems do, what evidence supports that belief, what it redacted, what it changed, and what risk remains.

From Content to System

For years, platform accountability was argued as if the central object were the individual post: remove it, leave it up, label it, demote it, suspend the account, restore the account, write a policy, improve the appeals queue. That frame is still necessary. Illegal content, harassment, fraud, manipulation, and abuse often arrive as particular messages attached to particular accounts.

But the public experience of a platform is not a bag of posts. It is a ranked environment. A feed chooses sequence, salience, repetition, tempo, friction, and adjacency. It decides which thing appears after grief, which clip follows outrage, which account becomes a suggestion, which rumor becomes trend-shaped, which ad arrives beside fear, and which synthetic artifact is repeated until it feels like common weather.

The clearest argument for why this systemic layer needs governing came from inside one of the platforms. In September 2021, the former Facebook product manager Frances Haugen, who had worked on the company's Civic Integrity team, gave the Wall Street Journal a trove of internal documents that became "The Facebook Files." The revelation was not a single viral post. It was that Facebook's own researchers had measured systemic harm and kept it private: internal studies found that Instagram made body-image issues worse for a large share of teenage girls, and that an engagement-based ranking change had amplified outrage and divisive content. The company held the risk assessment all along; what it lacked was any obligation to disclose it. That gap, a platform privately measuring the harms of its own design while presenting a neutral face to the public, is precisely the gap the next wave of regulation set out to close.

The EU Digital Services Act, or DSA, is important because it forces that systemic layer into law. It does not only ask whether a platform has rules against bad content. For very large online platforms and very large online search engines, it asks whether the design and functioning of the service, including algorithmic systems, create systemic risks. That changes the governance object from "the post" to "the conditions under which posts become reality."

Here, a platform risk assessment means a documented, evidence-based process for identifying actual and foreseeable systemic risks that stem from the service's design, functioning, algorithmic systems, advertising systems, data practices, user behavior, and business incentives. It is not a model evaluation, a generic trust-and-safety slide deck, a public-relations impact statement, or a one-time score. It is a socio-technical record of how the service allocates attention, money, enforcement, identity, friction, and visibility. Under the DSA, it is supposed to connect risk claims to mitigation choices, audits, regulator access, researcher access, and public reporting.

The useful unit is the evidence chain: risk hypothesis, affected population, system feature, measurement method, internal data, mitigation decision, residual risk, responsible owner, review date, and update trigger. A report that names a risk without showing how the platform measured, mitigated, and rechecked it is not yet a confession. It is a claim about a confession.

Calling it a confession should not romanticize it. A confession, in this sense, is a structured admission that the feed is governed by choices: ranking objectives, feature defaults, thresholds, advertising incentives, user controls, AI integrations, moderation queues, experiment gates, and business tradeoffs. It matters only if outsiders can test the record against evidence.

This belongs with related work on the platform engine of belief, answer engines as the front page, AI audits as compliance interfaces, transparency and public registers, AI encyclopedias as canon, and provenance that is not truth. The risk assessment is the bureaucratic form of a deeper cultural question: can the institution that shapes public perception be made to describe the shape of its own influence?

What the DSA Requires

The DSA's strongest obligations apply to services designated as very large online platforms or very large online search engines. The threshold is more than 45 million average monthly recipients in the European Union, roughly 10 percent of the EU population. The DSA's general date of applicability was February 17, 2024; for services designated as VLOPs or VLOSEs, the obligations apply four months after designation, and the first 17 VLOPs and two VLOSEs were designated on April 25, 2023. By June 2026, this is no longer a rollout promise. It is an operating enforcement regime.

Article 34 requires those providers to identify, analyse, and assess systemic risks in the EU that stem from the design or functioning of the service and its related systems, including algorithmic systems, or from the way people use the service. The listed risks include illegal content, negative effects on fundamental rights, negative effects on civic discourse, elections and public security, and serious negative consequences for public health, minors, gender-based violence, and physical or mental well-being.

That list matters because it names platform harm as more than content violation. A recommender can affect civic discourse without every amplified item being illegal. A design pattern can affect mental well-being without looking like a moderation case. A synthetic-media feature can change the risk profile of a platform before any single incident is adjudicated. An advertising system can produce vulnerability at scale without being reducible to one deceptive ad.

Article 34 also tells providers to consider how recommender systems, other algorithmic systems, content moderation systems, terms and conditions, advertising systems, and data practices influence the risks. Article 35 then requires reasonable, proportionate, and effective mitigation measures. Those measures can include adapting the service's design or interface, testing and adapting algorithmic systems including recommender systems, changing advertising systems, improving internal supervision, protecting children, and marking generated or manipulated media that falsely appears authentic.

Article 37 requires independent audits for the largest services, and Article 38 adds a specific recommender-system rule: they must provide at least one recommender option not based on profiling. Article 42 requires public reporting of risk assessments, mitigation measures, audit reports, and audit implementation reports, with some redactions allowed for confidentiality, security, public security, and user harm. Commission Q&A guidance says providers must explain redactions to the Commission and the relevant Digital Services Coordinator, and that generic or incomplete confidentiality claims cannot justify withholding material.

The timing also matters. The risk-assessment regime is not supposed to be only an annual paperwork cycle. Article 34 covers actual and foreseeable risks, and the Commission's transparency guidance treats risk assessment and audit publication as comparable annual records. For a living feed, the stronger governance norm is that major recommender changes, generative AI features, youth-facing engagement loops, advertising-delivery changes, or identity signals receive an ad hoc assessment before they alter exposure at scale. The law therefore creates a paper trail around the feed. It is not a complete window into the machine, but it is more than a platform blog post.

That service framing matters for AI products. If a chatbot-like feature becomes search, discovery, recommendation, advertising, marketplace, or creator infrastructure, DSA risk analysis should follow the service's role, scale, and function rather than the product label. A model presented as an assistant may still change what a feed shows, which accounts get reach, which ads find targets, which appeals are routed, or which synthetic media is made easy to produce. Interface form should not become a way to move systemic risk out of view.

The Feed as Evidence

The risk assessment turns ordinary product choices into evidentiary objects.

Infinite scroll is no longer only a growth feature. Autoplay is no longer only convenience. Push notifications are no longer only retention. A personalized recommendation model is no longer only relevance. A generative AI feature inside a social platform is no longer only product expansion. Under a systemic-risk frame, each can become part of the explanation for how the service affects minors, public discourse, public health, electoral processes, gender-based violence, illegal content, scams, or mental well-being.

This is the right level of abstraction for model-mediated public reality. The deepest effect of a feed is often not that it says one false thing. It is that it repeatedly arranges attention until some things feel normal, urgent, popular, inevitable, laughable, dangerous, or unreal. It turns statistical prediction into cultural tempo.

AI intensifies the problem because the feed is no longer ranking only human-origin content. It is beginning to rank generated images, synthetic voices, AI-written comments, bot-like engagement, AI-assisted ads, model-generated summaries, and platform-native AI features. The same service may host the synthetic artifact, recommend it, label it, monetize it, moderate it, summarize it, and train on traces of the response. Risk no longer sits at one layer.

The assessment is therefore not a moral diary. It should be a map of causal pressure: which systems amplify what, which user groups are affected, which risks are foreseeable, which metrics reveal harm, which mitigations changed outcomes, and which choices remain tradeoffs rather than solved problems.

A risk assessment is also a measurement claim. It should say what counts as exposure, reach, prevalence, complaint, reversal, harmful session, underage access, synthetic-media encounter, scam impression, or recommender contribution; which geography, language, age group, and service version the measurement covers; what the baseline is; and how uncertainty is handled. Without denominators, time windows, sampling methods, and version history, "we reduced risk" is not yet evidence.

What the Record Has to Preserve

A serious platform risk assessment needs a preservation layer. The public report is only the readable edge. Behind it should be a record that lets auditors, regulators, and vetted researchers reconstruct why a platform believed a risk was controlled, why a mitigation was chosen, and whether the system changed after warnings appeared.

That record should include recommender objectives, model and policy versions, ranking and eligibility rules, feature flags, rollout dates, experiment windows, youth-default settings, advertising targeting and delivery rules, synthetic-media labeling rules, moderation classifier changes, reports and appeals, exposure and prevalence metrics, incident escalations, mitigation tests, and known uncertainty. It should also include a redaction log: what was withheld from the public version, on what legal or safety basis, and who could still inspect it under stronger access rules.

Some evidence should not be public. User data, security controls, abuse-detection methods, trade secrets, and sensitive investigations can be genuinely protected. But confidentiality should move evidence into controlled access, not erase it. The DSA's logic depends on tiered evidence rights: public reports for contestability, stronger access for regulators and auditors, privacy-preserving access for vetted researchers, and durable internal records that cannot disappear when the product team changes the interface.

The record should also preserve rights-impact evidence. A mitigation can reduce one risk while creating another: over-removal can chill lawful speech, age-assurance tools can increase privacy risk, anti-scam friction can lock out vulnerable users, and automated classifiers can burden minority-language communities. The assessment should therefore record not only whether the platform acted, but which rights, groups, and appeal routes the action affected.

This is why the Commission's January 2025 technical measures in the X proceeding, including preservation of internal documents and information about future recommender changes during the relevant period, matter beyond one company. Risk governance is not only an obligation to write; it is an obligation to keep enough memory for someone else to test the story.

Researcher Access and the Audit Surface

A risk assessment written entirely by the platform would be weak governance. The DSA tries to widen the evidence surface through transparency reports, advertisement repositories, independent audits, regulator access, and researcher access.

Article 40 requires very large platforms and search engines to provide regulators with data necessary to monitor and assess compliance. It also requires them, on request, to explain the design, logic, functioning, and testing of algorithmic systems, including recommender systems. For vetted researchers, Article 40 creates a path to data access for research on systemic risks and mitigation measures.

The machinery became more concrete in 2025. On July 2, 2025, the European Commission adopted a delegated act on data access. On October 29, 2025, the Commission said the delegated act had entered into force and that qualified researchers could request access to previously unavailable data from very large platforms and search engines. As of the June 19, 2026 review date, the DSA Data Access Portal is the formal route for researchers, platforms, search engines, and Digital Services Coordinators to communicate about internal-data access requests. The rules require researchers to be vetted, disclose funding, show independence from commercial interests, and handle data under security, confidentiality, and privacy rules. They also require platforms to make data catalogues available so researchers can identify relevant datasets.

This is not only academic convenience. It is institutional counterweight. Platforms hold the logs, models, experiments, ad delivery data, moderation data, recommendation data, and internal measurements that make public claims testable. Without access, researchers are left scraping fragments, studying visible outputs, or relying on platform-selected disclosures. With access, there is at least a formal route for independent work to ask whether the official risk story matches the system's behavior.

The March 2026 harmonised transparency-reporting template points in the same direction. The Commission says the new machine-readable template standardizes moderation reporting across platforms and aligns categories with the DSA Transparency Database, allowing consistency checks across tools. That sounds dry. It is dry because it is governance. Accountability often begins when records become comparable.

The scale explains why comparability matters. The Commission's DSA impact page says platforms reported more than 9 billion content-moderation decisions to the Transparency Database in the first half of 2025, with 99 percent taken proactively under platforms' own terms and only a marginal fraction related to reports of illegal content. At that scale, classification schemes, automation labels, appeal data, and reversal rates are not clerical details. They are the public memory of moderation power.

Current Enforcement Signals

As of June 19, 2026, the DSA is already being used against systems, not only posts. The Commission's public DSA pages list designated very large platforms and search engines, publish enforcement histories, and maintain links to risk assessment, audit, advertising, transparency, and terms-and-conditions records. In November 2025, the European Board for Digital Services and the Commission also published the first annual Article 35(2) risk landscape report, drawing on platform risk assessments, audit reports, transparency reports, independent research, and civil-society input. The report named recurring risks including minors' protection, mental health, generative AI on platforms, intellectual-property issues, and marketplace harms.

On December 5, 2025, the Commission issued its first DSA non-compliance decision, fining X 120 million euros. The decision concerned transparency obligations: the deceptive design of the blue checkmark, lack of transparency in X's advertising repository, and failure to provide researchers access to public data. The researcher-access part is central to this essay. If independent scrutiny is part of the governance design, then blocking or burdening data access is not a side issue. It is a way of keeping the feed from becoming evidence.

On January 26, 2026, the Commission launched a new formal investigation into X and extended its ongoing investigation into X's recommender-system risk management obligations. The new inquiry concerns Grok functionalities inside X and whether X properly assessed and mitigated risks before deployment. The Commission specifically named risks around illegal content, gender-based violence, and serious negative consequences for physical and mental well-being. This is the DSA risk-assessment logic applied to a platform-native AI feature.

On February 6, 2026, the Commission preliminarily found TikTok in breach of the DSA for addictive design. The statement named infinite scroll, autoplay, push notifications, and a highly personalized recommender system. It said TikTok had not adequately assessed how those features could harm physical and mental well-being, including for minors and vulnerable adults, and that its mitigation tools appeared too easy to dismiss or too burdensome for parents. These are preliminary findings, not a final decision. But the direction is clear: the feed's basic design can become the compliance problem.

The same risk-assessment logic now reaches beyond social feeds. On May 28, 2026, the Commission fined Temu 200 million euros, saying the company failed to diligently identify, analyse, and assess systemic risks from illegal products offered on its platform and did not properly assess how service design, recommender systems, and product-promotion programs could amplify dissemination risks. The Temu decision is about marketplace safety, not political speech, but it reinforces the same governance shift: a platform's architecture can be the regulated object.

Child-safety governance is also becoming more specific. In July 2025, the Commission published DSA guidelines on protecting minors that call out recommender changes, private-by-default settings, disabling excessive-use features such as autoplay and push notifications, safeguards around AI chatbots integrated into platforms, and effective age assurance where proportionate. Its age-verification blueprint became feature-ready on April 15, 2026, and the May 29, 2026 trusted-flagger consultation said more than 70 trusted flaggers had already been designated. The safety lesson is not "collect more identity data." It is that youth risk assessment has to connect product defaults, recommender behavior, reporting channels, privacy-preserving age signals, and appealable enforcement.

These actions do not all have the same legal status. Some are final non-compliance decisions, some are formal investigations, and some are preliminary findings. They should not be collapsed into a single scoreboard. The important pattern is not that the EU has solved platform governance. It has not. The important pattern is that regulators are now treating interface design, recommender behavior, AI feature deployment, data access, ad transparency, and risk documentation as one connected institutional surface.

Failure Modes

The first failure mode is self-audit theater. A platform writes a polished risk assessment, publishes a partial public version, redacts the hardest evidence, and treats the existence of a report as proof that the risk has been governed.

The second is metric substitution. The platform measures what is easy: removals, response times, reports, clicks, watch time, user controls opened, or labels displayed. It then treats those metrics as substitutes for harder questions about compulsive use, civic distortion, harassment networks, synthetic-media propagation, or vulnerable-user exposure.

The third is researcher access attrition. Access exists on paper, but the process is slow, narrow, legally risky, technically constrained, poorly documented, or shaped by platform-defined data catalogues that omit the most important questions.

The fourth is redaction gravity. Confidentiality, trade secrets, privacy, and security are real concerns. They can also become broad excuses. If too much disappears from public reports, the public receives the ritual of transparency without the evidence needed for trust.

The fifth is AI feature laundering. A platform introduces a generative AI system as an assistant, search feature, creator tool, or entertainment layer while treating it as separate from the platform's existing recommender, advertising, moderation, and data systems. The user experiences one environment; governance treats it as disconnected modules.

The sixth is jurisdictional fragmentation. A European risk regime may force useful disclosures and design changes, while users elsewhere remain governed by weaker rules. Global platforms may then maintain different safety surfaces by region, making public accountability depend on geography.

The seventh is rights-blind mitigation. A platform may respond to pressure by suppressing more speech, collecting more identity data, or adding more automated enforcement without proving that the new control is proportionate, appealable, privacy-preserving, and effective for the risk it claims to address.

The eighth is ad hoc evasion. A platform may publish an annual risk assessment while making important system changes between reporting windows: model swaps, ranking-objective changes, generative AI launches, monetization redesigns, or youth-setting adjustments. The public record then describes yesterday's service.

The Governance Standard

A serious platform risk-assessment regime should satisfy several tests.

First, assess systems, not only content categories. Recommenders, ads, generative AI features, notification systems, search ranking, creator monetization, moderation queues, and account-verification signals should be evaluated as interacting systems.

Second, publish enough to contest. Public reports should state concrete risks, affected groups, mitigation logic, residual uncertainty, audit results, and material design changes. Redaction should be narrow and explained.

Third, protect independent research. Researcher access should include useful metadata, codebooks, changelogs, and appropriate technical modalities. Access rules should protect privacy and security without letting platforms define scrutiny out of existence.

Fourth, measure outcomes, not only controls. A screen-time tool matters only if it changes harmful use. A non-profiled feed option matters only if users can find and understand it. A synthetic-media label matters only if it travels with the content and avoids false certainty.

Fifth, protect minors without building a universal surveillance layer. Child-safety duties should combine privacy-preserving age assurance, safer defaults, recommender limits, usable reporting, and effective appeal, while avoiding unnecessary identity collection.

Sixth, preserve appeal and speech rights. Risk mitigation can itself harm fundamental rights through over-removal, political bias, weak appeal, or chilling effects. Systemic-risk governance must not become an excuse for unreviewable centralized censorship.

Seventh, connect platform records to public memory. Risk assessments, audit summaries, transparency reports, enforcement actions, researcher findings, and major incidents should be traceable over time. A platform should not be able to forget each controversy as soon as the product surface changes.

Eighth, separate public disclosure from protected evidence rights. Some data cannot be public without exposing private users, security defenses, or abuse-detection methods. That is not a reason to leave the evidence inside the company. Regulators, auditors, and vetted researchers need stronger access than ordinary readers, under privacy and security controls.

Ninth, give insiders a safe channel. Whistleblower routes matter because internal metrics, launch debates, experiment results, and escalation decisions often reveal what public reports omit. A risk regime that cannot hear from workers is dependent on platform-selected evidence.

Tenth, test mitigations with affected groups. Minors, journalists, political minorities, disabled users, non-dominant language communities, targets of gender-based violence, and people exposed to scams or dangerous products should not appear only as categories in a report. Their experience should shape assessment, mitigation, and appeal design.

Eleventh, require versioned evidence retention. Risk assessments should be tied to system versions, rollout dates, experiment logs, mitigation records, and update triggers. Otherwise a report can describe yesterday's feed while today's feed governs users under a different risk profile.

Twelfth, name rights tradeoffs. Mitigations should say how they affect lawful speech, privacy, data protection, non-discrimination, consumer protection, child rights, and appeal rights. Risk reduction is not legitimate merely because it is forceful; it has to remain explainable under platform governance rather than disappear into emergency rhetoric.

Thirteenth, require ad hoc assessment for material changes. Annual reporting should be the floor. Major recommender, advertising, generative AI, identity, youth, or monetization changes should trigger assessment, evidence retention, and update notices before the new system becomes the default environment.

What This Changes

The feed is one of the main belief-formation machines of the present. It does not merely show culture. It trains the rhythm by which culture appears.

That rhythm is recursive. Users react to what the feed shows. The feed learns from the reaction. Creators learn the feed. Advertisers learn the feed. Political actors learn the feed. Generative systems learn the platform-shaped traces of culture. Then the platform ranks the next wave of generated, optimized, emotionally tuned material as if it were simply what people wanted.

The DSA risk assessment is a crude but important interruption in that loop. It says the platform must stop presenting itself as a neutral mirror. It must name the risks produced by its own design, keep supporting documents, submit to audits, provide data access, and adapt systems when mitigation is required.

That does not make the state an arbiter of truth. It does not make regulators immune to political pressure. It does not make platforms honest by default. But it creates a contested record where before there was often a public-relations surface and an internal dashboard.

The deeper lesson is institutional. A society governed by feeds needs more than media literacy. It needs risk literacy at the level of infrastructure: who ranked this, who profited, who measured harm, who saw the logs, who audited the claims, who could appeal, who could study the system, and what changed after the warning signs appeared?

The feed's confession will always be incomplete. No institution naturally reveals the full shape of its power. But a partial confession, forced into records, audits, data access, and public dispute, is better than a machine that shapes reality while insisting it only reflects us.

Source Discipline

DSA sources should be read by legal status. The regulation itself establishes duties. Commission policy pages explain enforcement architecture but are not substitutes for the legal text. Commission press releases describe allegations, preliminary findings, decisions, and investigations at different procedural stages. A preliminary finding is not a final ruling. A formal investigation is not proof of breach. A non-compliance decision is stronger evidence, but still belongs inside a legal process that may include appeal.

Platform risk reports, audit reports, transparency reports, ad repositories, and data catalogues are institutional records, not neutral reality. They show what the platform measured, how it classified the world, what it disclosed, what it redacted, and what auditors or regulators could see. They should be compared against independent research, civil-society findings, affected-user evidence, whistleblower material, regulator requests, and the underlying logs or datasets when lawful access exists.

For AI claims, source discipline should separate the layers: a model feature, a recommender system, an advertising system, a moderation classifier, a user interface, and a data-access workflow can all contribute to one systemic risk. Saying "the algorithm caused it" is usually too blunt. Saying "the platform only hosted it" is usually too narrow. The evidence has to identify which system changed exposure, incentives, friction, reporting, appeal, or harm.

Sources

Return to Blog