- 2022
- 2023
-
Digital Services Act
First list of Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) covered by the DSA rules
-
Digital Services Act
Deadline for VLOPs and VLOSEs to prepare risk assessment reports under the Digital Services Act
- 2024
-
Digital Services Act
Entry into full application of the Digital Services Act with designation of Digital Services Coordinators
-
Digital Services Act
The European Commission opens an investigation against Microsoft on AI and elections
- 2025
-
Digital Services Act
Kickoff of work on Codes of Conduct for Online Advertising at the European Commission
- 2026
-
Political Advertising Regulation
Establishment of an Ad Repository under the Political Ads Regulation
- 2027
Entry into Force of Digital Services Act (DSA)
After a 2-year-long legislative procedure, the EU’s Digital Services Act (DSA), a set of new rules to regulate online platforms, was published in the Official Journal and entered into force on 17 November 2022. This marks the start of the implementation period, with rules to become fully applicable only in 2024.
First list of Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) covered by the DSA rules
Under the Digital Services Act, the European Commission has to designate a list of Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs), which would have to comply with stricter obligations, given their size and influence on the online sphere. Among these obligations, there is also the drafting of reports assessing risks for civic discourse and electoral processes and putting forward related mitigation measures. The first list of VLOPs and VLOSEs included: AliExpress, Amazon, App Store, Bing, Booking, Facebook, Google Maps, Google Play, Google Search, Google Shopping, Instagram, LinkedIn, Pinterest, Snapchat, TikTok, Twitter (X), Wikipedia, YouTube and Zalando. These were later followed by: PornHub, Shein, XNXX, Stripchat, Temu and XVideos.
Deadline for VLOPs and VLOSEs to prepare risk assessment reports under the Digital Services Act
Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) designated by the European Commission, for their size and influence on the online sphere, have to draft annual reports assessing risks for civic discourse and electoral processes and putting forward related mitigation measures. The first set of reports was due by 17 August 2023 and was made public in November 2024.
Entry into full application of the Digital Services Act with designation of Digital Services Coordinators
The Digital Services Act (DSA), the EU’s new rules to regulate online platforms, became fully applicable for all sorts of online platforms on 17 February 2024. This was also the deadline for EU Member States to designate national authorities in charge of the DSA enforcement, the Digital Services Coordinators (DSCs). Many Member States, however, missed the deadline and are still struggling to officially designate competent authorities, to properly staff them and to train them to enforce the new rules.
Digital Services Coordinators to be fully designated
On 26 February 2024, the European Commission published Guidelines on the mitigation of systemic risks for electoral processes to complement Digital Services Act rules when it comes to election integrity. EPD has pointed out strength and weaknesses of these Guidelines in a joint paper with Civil Liberties Union for Europe.
Entry into force of the Political Ads Regulation
After a 3-year legislative procedure, the EU’s Regulation on Transparency and Targeting of Political Ads (TTPA), a set of new rules to regulate political ads, was published in the Official Journal and entered into force on 9 April 2024. This marks the start of the implementation period, with all rules to become fully applicable only in 2026.
Adoption of guidance on risk mitigation for electoral processes
Under the Digital Services Act, the new EU rules to regulate online platforms, the European Commission is empowered to adopt guidelines on how Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) should mitigate risks for civic discourse and electoral processes. To this end, the Commission published Guidance on risk mitigation for electoral processes ahead of the EU elections.
The European Commission opens an investigation against Meta on political ads
On 30 April the European Commission opened an investigation on Meta regarding its policies and practices relating to deceptive advertising and political content on its services. The DSA does not set any legal deadline for bringing formal proceedings to an end. A non-compliance decision could include fines up to 6% of the global turnover.
The European Commission opens an investigation against Microsoft on AI and elections
On 17 May the European Commission opened an investigation on Microsoft on risks posed by Bing’s generative AI tools, which may have breached the DSA for risks linked to generative AI, such as so-called ‘hallucinations’, the viral dissemination of deepfakes, as well as the automated manipulation of services that can mislead voters. The DSA does not set any legal deadline for bringing formal proceedings to an end. A non-compliance decision could include fines up to 6% of the global turnover.
Entry into force of the AI Act
After a three-year legislative procedure, the EU’s Artificial Intelligence Act (AI Act), a set of new rules to regulate Artificial Intelligence, was published in the Official Journal and entered into force on 1 August 2024. This marks the start of the implementation period, with some exceptions, with all rules becoming fully applicable only in 2026.
Publication of the Draft Delegated Act on data access for researchers
Under the Digital Services Act, Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) are obliged to share data on systemic risks and mitigation measures on their platforms with researchers. This draft delegated act clarifies the procedures on how researchers can access such data and sets out rules on data formats and data documentation requirements. The final text should be adopted in 2025.
Application of rules on prohibited AI systems
The first batch of rules under the AI Act that become applicable are the prohibitions of certain AI systems, including those used for subliminal manipulation and for categorisation according to political opinions. Guidelines have also been published to clarify the prohibitions with examples of what should and shouldn’t be included under the banned applications.
Finalisation of the Code of Conduct on General Purpose AI (GPAI) models
Under the Artificial Intelligence Act, a voluntary Code of Conduct has been shaped to clarify and complement the rules on General Purpose AI. The work within the General Purpose AI Working Group took place from autumn 2024 until spring 2025.
Entry into application of the Political Ads Regulation
The EU’s Regulation on Transparency and Targeting of Political Advertising became fully applicable as of October 2025, with the exception of the establishment of the ad repository. From this date, online political ads will have to be identified and labelled as such, with information on targeting criteria, sources of funding and their link to elections or referenda. However, its prospects currently appear shaky: the industry it is aiming to regulate stepped out of the market to avoid compliance with the new rules, leaving the Regulation's relevance and effectiveness uncertain.
The European Commission puts forward a proposal on a Digital Omnibus
On 19 November 2025, the European Commission published a proposal for a regulatory simplification package on a Digital Omnibus. The new proposal aims at simplifying existing rules to boost innovation for EU businesses, in particular with modifications in the area of data protection (General Data Protection Regulation) and Artificial Intelligence (AI Act). However, the proposal might have the reverse effect and create more legal uncertainty and difficulties for companies to comply with the new rules. It is also a dangerous precedent as it proposes to scale back existing protections of fundamental rights in the EU, for example, on personal data. The proposal still needs to be negotiated and amended by the European Parliament and the Council of the EU in the next few years.
VLOPs and VLOSEs publish their second risk assessment report
The EU’s Digital Services Act (DSA), requires Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs) to identify and mitigate risks to democracy caused by their services, such as threats to civic discourse and electoral processes. Large tech companies are then required to publish their risk assessment findings and take measures to mitigate risks in the future. Since 2024, reports on risks and mitigation strategies have been published annually. In November 2025, VLOPs and VLOSEs published their second risk assessment report.
Establishment of an Ad Repository under the Political Ads Regulation
In April 2026 the Ad Repository under the Political Ads Regulation will have to be fully established. This will collect political ads to increase transparency for researchers, journalists and other experts on broader political ads campaigns.
Publication of draft guidelines on high-risk AI systems by the European Commission
The rules for high-risk AI systems are at the core of the Artificial Intelligence Act, with applications such as AI systems used to influence elections undergoing risk assessments before being put on the market. To clarify and complement such rules, the European Commission issued guidelines in May 2026.
Full application of all AI Act rules (except the ones for high-risk AI applications)
The EU’s Artificial Intelligence Act becomes fully applicable as of October 2025, with the exception of the rules for high-risk AI applications that will only apply in 2027.
Entry into application of the rules on high-risk AI systems
The rules for high-risk AI systems are at the core of the Artificial Intelligence Act, with applications such as AI systems used to influence elections to undergo risk assessments before being put on the market. They also include AI systems intended to be used to influence elections as high-risk. The entry into application of these rules, according to the AI Omnibus, will be December 2027 for standalone high-risk applications and August 2028 for AI embedded in other products.
Artificial Intelligence
Artificial Intelligence has been at the top of the EU agenda since the start of the 2019-2024 mandate, with the proposal for an Artificial Intelligence Act (AI Act). The discussions around it, however, intensified further in 2023, with the boom of generative AI systems. From deep fakes of politicians circulated online to AI-generated disinformation campaigns, from AI systems used for microtargeting of political ads to chatbot-based AI systems to provide voter assistance, AI applications with the potential to impact democracy and elections are countless. EPD is therefore working on assessing the effectiveness of mechanisms in the AI Act to mitigate the risks posed by such applications.
The Digital Services Act
The Digital Services Act (DSA) is an EU horizontal framework of rules put forward to create a safer online space. As many challenges posed by online platforms and regulated via the DSA can have an impact on democratic civic discourse and electoral processes, such as the spread of disinformation, coordinated attacks against civil society or the lack of transparency on how recommender systems work, having a DSA that works for democracy is of utmost importance for EPD.
Transparency and targeting of political advertising
Political advertising online has been historically the main focus of EPD’s work in the digital sphere. Since the Cambridge Analytica scandal, it has become increasingly evident how online practices such as micro-targeting of political ads can steer public opinion ahead of elections. When the European Commission put forward its proposal for a Regulation on Transparency and Targeting of Political Advertising (TTPA), EPD took an active role in leading the advocacy work on this file by promoting more transparency and accountability for both sponsors and online platforms.
Our work on these files is funded by Civitates and the Open Society Foundations.