Document type: Toolkit Practice area: Technology — Platform Regulation Jurisdiction: European Union, with United States comparison Last reviewed: 5 September 2026

How to use this toolkit

European platform regulation is unusually form-driven. What a compliant notice must contain, what a statement of reasons must say, what a transparency report must include — these are prescribed, and a company either produces the required elements or does not.

So this toolkit is mostly forms and specifications. The annotations explain what each element is doing, because a team that understands why a field exists fills it in properly, and a team that does not produces compliant-looking documents that fail on inspection.

Tool 1 — Scoping memo template

Write this first. It settles the internal argument that otherwise consumes six weeks.

EU PLATFORM REGULATION — SCOPE DETERMINATION
[Company] — [Date] — Prepared by [ ] — Privileged

1. SERVICES OFFERED
   Service          | Description        | EU recipients? | Est. share
   -----------------|--------------------|----------------|------------
   [each service, separately — a company often has more than one tier]

2. TERRITORIAL SCOPE
   Do we offer services to recipients located in the Union?
     YES / NO — basis: __________________________
   NOTE: scope follows the OFFERING, not establishment. Absence of
   an EU entity, staff, or revenue is NOT a scope answer.
   Indicators considered: EU-language interface, EU currency, EU
   payment methods, EU targeting, EU domain, actual EU usage.

3. TIER DETERMINATION (per service)
   [ ] Intermediary — mere conduit / caching / hosting
   [ ] Hosting — do we store information provided by a user?
         (comments, reviews, uploads, bios, forums)
   [ ] Online platform — store AND disseminate to the public?
   [ ] Marketplace — consumers conclude distance contracts with
       traders?
   [ ] Small/micro enterprise exemption applies?  Y / N
         Headcount ____  Turnover ____  Balance sheet ____
         ** Recheck date: ____________ **
   [ ] Approaching 45m average monthly active EU recipients?

4. OBLIGATIONS THAT FOLLOW
   [list by tier, cumulative]

5. GAPS TODAY
   [what we do not have]

6. RECOMMENDED SEQUENCE AND OWNER

Prepared by: ______  Reviewed by: ______  Circulated: ______

Annotation. Section 2's note exists because the first reaction inside every American company is that the rules cannot apply without European operations. Putting the correct rule in the template, in bold, ends that conversation on page one instead of in week six. Section 3's recheck date exists because the small enterprise exemption is real, valuable, and lost by growth that nobody re-examines.

Tool 2 — Legal representative selection memo

LEGAL REPRESENTATIVE — MEMBER STATE SELECTION

CANDIDATE MEMBER STATES
  +-------------+------------------+------------------+----------+
  | State       | Coordinator      | Activity level / | Language |
  |             |                  | resourcing       | practice |
  +-------------+------------------+------------------+----------+

FACTORS
  [ ] Coordinator resourcing and enforcement posture
  [ ] Language of proceedings and of required communications
  [ ] Existing group presence or advisers in the state
  [ ] Local counsel availability and cost
  [ ] Practical experience of peers in our sector

CANDIDATE REPRESENTATIVE DILIGENCE
  [ ] Can it actually receive and act on authority communications?
  [ ] Does it have capacity, or is it a mail-forwarding service?
  [ ] Does it understand it can be held liable for non-compliance?
  [ ] Contract terms: scope, escalation, SLA, notice, termination
  [ ] Insurance and indemnity

RECOMMENDATION: ______________  Approved: ______  Date: ______

FOLLOW-ON
  [ ] Representative details published in the terms and on the site
  [ ] Coordinator of establishment identified: ______________
  [ ] Languages of communication published: ______________

Annotation. This decision is routinely made by whoever answers a vendor email first, and it determines which regulator supervises the company for years. The diligence block matters because the provider remains responsible for non-compliance regardless of what the representative does or fails to do — a mail drop transfers no risk.

Tool 3 — Terms and conditions clause set

CONTENT MODERATION — WHAT WE DO
  We may restrict content or accounts as described below. This
  section describes the policies, procedures, measures, and tools
  we use, including algorithmic decision-making and human review.

  Restrictions we may apply: removal · disabling access · reducing
  visibility · restricting monetization · suspending or terminating
  the service · suspending or terminating the account.

  Grounds: (a) the content is illegal under applicable law; or
  (b) the content is incompatible with [Policy], reproduced at
  [link].

  How decisions are made: [describe intake, triage, automated
  detection tools and what they do, human review stages, who
  decides, escalation]. We apply these measures diligently,
  objectively, and proportionately, with due regard to the rights
  and legitimate interests of all parties involved, including
  fundamental rights.

  Automated tools: we use [describe] to [detect / prioritize /
  action]. Where a decision is made or supported by automated
  means, we say so in the statement of reasons we send you.

NOTIFYING US ABOUT CONTENT
  Anyone may notify us of content they believe is illegal, using
  the form at [link]. [Summarize what a notice needs.] We
  acknowledge receipt and tell you our decision and how to
  challenge it.

IF WE RESTRICT YOUR CONTENT OR ACCOUNT
  We will send you a statement of reasons explaining what we did,
  why, on what legal or contractual ground, whether automated means
  were used, the territorial scope and duration, and how to
  challenge the decision.

CHALLENGING A DECISION
  Internal complaints: free, available for six months, at [link].
  Decisions are reviewed by qualified staff and not solely by
  automated means. If your complaint has sufficient grounds we will
  reverse the decision.
  Out-of-court dispute settlement: you may select any certified
  dispute settlement body. We will engage with it in good faith.
  Judicial redress remains available.

MISUSE
  After a prior warning, we may suspend, for a reasonable period,
  users who frequently provide manifestly illegal content, and the
  processing of notices or complaints from those who frequently
  submit manifestly unfounded ones. Examples: [ ].

RECOMMENDATIONS
  Where we rank or recommend content, the main parameters are
  [list, most significant first, with why each matters]. You can
  change [ ] at [link].

CONTACT
  Users: [electronic contact, not solely automated]
  Authorities: [electronic point of contact]
  Languages: [ ]
  Legal representative in the EU: [name, address, contact]

Annotation. The heading of the first clause — "what we do" rather than "rights we reserve" — is the whole point. Standard platform terms describe discretion; the regulation requires describing process. Drafting this clause forces the company to write down what the trust and safety team actually does, which is where the practices that should change get found.

Tool 4 — Notice submission form

REPORT ILLEGAL CONTENT

1. Where is the content?
   Exact URL(s): ________________________________  [REQUIRED]
   [Multiple URLs permitted — one per line]

2. What is the content?
   [ ] Post   [ ] Listing   [ ] Review   [ ] Message   [ ] Media
   [ ] Account   [ ] Advertisement   [ ] Other: ______

3. Why do you believe it is illegal?
   Category: [dropdown — IP infringement · defamation · consumer
   protection · counterfeit goods · product safety · data
   protection · hate speech · CSAM · terrorist content · other]
   Explanation (be specific — what law, and why this content
   breaks it):
   ______________________________________________________
   ______________________________________________________  [REQUIRED]

4. Supporting material
   [upload — e.g. proof of rights, court order, correspondence]

5. About you
   Name: ______________   Email: ______________  [REQUIRED except
   for notices concerning certain offences — see note]
   Acting on behalf of: ______________
   [ ] I am a trusted flagger.  Designating authority: ______

6. Declaration  [REQUIRED]
   [ ] I confirm my good-faith belief that the information and
       allegations in this notice are accurate and complete.

We will acknowledge receipt without undue delay, tell you our
decision and the reasons for it, and explain how to challenge it.
We will tell you whether automated means were used in processing
and deciding on your notice.

Annotation. Every field marked REQUIRED corresponds to an element that makes a notice legally sufficient. That is deliberate and it cuts both ways: a notice that is precise and adequately substantiated enough for a diligent provider to identify illegality without a detailed legal examination confers actual knowledge and starts the clock on the conditional liability exemption. A form that collects less produces notices that may not confer knowledge — but also produces notices you cannot act on. Collect the full set. Note also field 5's trusted flagger checkbox: it is what makes priority routing possible.

Tool 5 — Statement of reasons template and generation spec

STATEMENT OF REASONS

To: [recipient]                     Ref: [case ID]  Date: [ ]

WHAT WE DID
  Measure: [removed / disabled access to / reduced visibility of /
  restricted monetization of / suspended / terminated] the
  following: [content ref or account].
  Territorial scope: [worldwide / EU / member state(s): ____]
  Duration: [permanent / until ____ / ____ days]

WHY
  Ground: [ ] The content is illegal.
          [ ] The content is incompatible with our terms.

  IF ILLEGAL:
    Legal ground: [instrument and provision]
    Why this content is illegal on that ground: [specific to THIS
    content — not a category label]

  IF TERMS:
    Contractual ground: [clause reference and quoted text]
    Why this content is incompatible: [specific to THIS content]

HOW WE DECIDED
  This decision followed:
    [ ] a notice submitted to us on [date] [by [notifier] — include
        identity only where strictly necessary]
    [ ] our own-initiative investigation
    [ ] an order from [authority] dated [date]
  Automated means were used:
    [ ] in detecting or identifying the content
    [ ] in making or supporting the decision
    [ ] not used
  [Describe briefly what the automated means did.]

HOW TO CHALLENGE THIS
  1. Internal complaint — free, for six months from this date:
     [link]. Reviewed by qualified staff, not solely automated.
  2. Out-of-court dispute settlement — you may select any
     certified body. We will engage in good faith: [info link]
  3. Judicial redress in the courts of your member state.

[Company] · [contact] · [legal representative details]

Engineering generation specification:

TRIGGER: any enforcement action of type
  REMOVE | DISABLE | DEMOTE | DEMONETIZE | SUSPEND | TERMINATE
  where basis IN (ILLEGAL, TERMS)

REQUIRED FIELDS FROM THE CASE RECORD (enforce at write time —
a case cannot be actioned without them):
  measure_type · territorial_scope · duration
  basis (ILLEGAL | TERMS)
  legal_ground_ref  (required if ILLEGAL)
  legal_ground_explanation  (free text, required, min length)
  terms_clause_ref  (required if TERMS)
  terms_explanation  (free text, required, min length)
  source (NOTICE | OWN_INITIATIVE | AUTHORITY_ORDER)
  notifier_identity_disclosed (bool + justification if true)
  automated_detection (bool) · automated_decision (bool)
  automated_description
  decided_by · decided_at

ACTIONS ON TRIGGER (atomic with the enforcement action):
  1. Render statement of reasons
  2. Deliver to affected recipient
  3. Submit to the Commission transparency database
     (strip personal data)
  4. Open the complaint window (6 months)
  5. Write to the audit log

EXCEPTION: skip where content is deceptive high-volume commercial
content.

Annotation. The generation specification is the single most valuable item in this toolkit, and the critical design decision is in the third line of REQUIRED FIELDS: a case cannot be actioned without them. If the explanation fields are optional, moderators will leave them blank under volume pressure and the company will publish thousands of non-compliant statements into a public database. Make the fields blocking. It slows moderation slightly and it is the difference between a compliant program and a visible failure.

Tool 6 — Complaint form and decision record

CHALLENGE A DECISION                       Case ref: [prefilled]

What was decided: [prefilled from the statement of reasons]
Date: [prefilled]

Why do you think this was wrong?
  [ ] The content is not illegal
  [ ] The content does not breach the policy cited
  [ ] The decision relied on incorrect facts
  [ ] The measure is disproportionate
  [ ] Other: ______
  Explain: ______________________________________________

Supporting material: [upload]

Contact: ______________

COMPLAINT DECISION RECORD  (internal)

Case ref: ______   Original decision by: ______   Date: ______
Complaint received: ______   ** 6-month window opened: ______ **

Reviewer: ______   ** Different from original decision-maker? Y/N **
Reviewer qualification: ______________
Automated means used in this review: [ ] none  [ ] supporting only
  ** Decision must NOT be solely automated **

Original ground reviewed: ______________
Does the complaint contain sufficient grounds to reverse?  Y / N
Reasoning: ______________________________________________

DECISION: [ ] Upheld  [ ] Reversed  [ ] Modified: ______
Communicated to complainant: ______ (date)
Out-of-court settlement and judicial redress explained:  [ ]
Median-time metric updated:  [ ]
Reversal logged against: policy ______  reviewer ______

Annotation. The two boxed lines in the decision record are the compliance-critical ones: a different reviewer, and a decision not taken solely by automated means. The final line — logging reversals against both the policy and the reviewer — is the management value. A policy with a high reversal rate is a badly written policy; a reviewer far off the team median needs training. That data exists nowhere else.

Tool 7 — Trader verification file

TRADER VERIFICATION                    Trader ID: ______

INFORMATION OBTAINED  (all required before trading is permitted)
  [ ] Name
  [ ] Address
  [ ] Telephone
  [ ] Email
  [ ] Identification document / electronic identification — type
      and reference: ______________
  [ ] Payment account details
  [ ] Trade register and registration number (where registered),
      or equivalent means of identification: ______________
  [ ] SELF-CERTIFICATION: commitment to offer only products and
      services complying with applicable Union law   [signed ____]

BEST-EFFORTS ASSESSMENT OF RELIABILITY
  Sources used:
    [ ] Official online database: ______________  Result: ______
    [ ] Official interface: ______________         Result: ______
    [ ] Supporting documents requested: ______________
  Assessment outcome: [ ] Reliable  [ ] Inconsistent — details ____
  Assessed by: ______  Date: ______

IF INFORMATION IS INACCURATE / INCOMPLETE / OUT OF DATE
  [ ] Correction requested (date: ______)
  [ ] ** TRADER SUSPENDED pending correction ** (date: ______)
  [ ] Corrected and reinstated (date: ______)

STORAGE
  [ ] Held securely; retention = relationship + 6 months
  [ ] Retention date: ______

RE-VERIFICATION (existing seller base)
  Tier: [ ] High volume  [ ] Mid  [ ] Low  [ ] Dormant
  Notified: ______  Deadline: ______  Completed: ______
  Outcome: [ ] Verified  [ ] Suspended  [ ] Departed

Annotation. The suspension line is the one companies resist and the one the regulation requires: where information appears inaccurate or incomplete and is not corrected, the trader must be suspended. Build the suspension as an automated consequence of a stale verification record rather than a manual decision someone has to make about a revenue-generating seller, because manual decisions of that kind do not get made.

Tool 8 — Advertising and recommender disclosures

AD DISCLOSURE — REQUIRED ELEMENTS, VISIBLE IN REAL TIME
  [ ] Prominent marking that this is an advertisement
  [ ] "Paid for by [payer]"
  [ ] "Presented on behalf of [beneficiary]"  (if different)
  [ ] "Why am I seeing this?" → main targeting parameters, in
      meaningful terms, and how to change them where applicable

PROHIBITIONS — VERIFY IN THE AD STACK
  [ ] No profiling using special categories of personal data
  [ ] No profiling-based ads where we are aware with reasonable
      certainty the recipient is a minor
        Note: this turns on what we KNOW, not on age verification.
        Document what signals we have and how they are used.

RECOMMENDER EXPLANATION — IN THE TERMS AND IN-PRODUCT
  The main parameters we use to rank and recommend, most
  significant first:
    1. ______________  Why it matters: ______________
    2. ______________  Why it matters: ______________
    3. ______________  Why it matters: ______________
  What you can change: ______________
  Where: [link, directly accessible from the ranked section]

Annotation. The minor-advertising prohibition is the one most often misread as an age-verification mandate. It is not: it prohibits profiling-based advertising where the provider is aware with reasonable certainty that the recipient is a minor. The compliance artifact is therefore a document describing what age signals the company holds and how the ad stack uses them — not an age-gate.

Tool 9 — Dark patterns audit

INTERFACE AUDIT — DECEPTIVE OR MANIPULATIVE DESIGN

Screen / flow reviewed: ______________  Reviewer: ______

  [ ] Pre-checked boxes for consents, subscriptions, or add-ons
  [ ] Asymmetric choice — "Accept" prominent, "Reject" buried or
      requiring more clicks
  [ ] Confirmshaming — decline options worded to induce guilt
  [ ] False urgency — countdown timers that reset; "only N left"
      not tied to real inventory
  [ ] Obstruction — cancellation or deletion harder than signup
  [ ] Nagging — repeated prompts after a decision
  [ ] Default settings that favor us over the user's evident
      preference
  [ ] Hidden costs revealed late in a flow
  [ ] Visual interference — low-contrast or de-emphasized options
  [ ] Bait and switch

FINDINGS
  Issue | Screen | Severity | Owner | Fix by | Fixed
  ------|--------|----------|-------|--------|------

Sign-off: ______  Date: ______  Next audit: ______

Annotation. Run this on the whole funnel, not just the consent screen, and run it with someone who did not design the flows. Every first audit finds something; a countdown timer that resets on page reload and a pre-checked box are the two most common. Note that several of these patterns are independently actionable under consumer protection law in both the Union and the United States — FTC Act § 5 reaches deceptive practices — so the audit has value well beyond this regime.

Tool 10 — Authority order response

[Date]
[Issuing authority]

Re:  Order dated [date], reference [____]

Dear [ ],

[Company] acknowledges receipt on [date] of the above order
[to act against illegal content / to provide information].

EFFECT GIVEN
  [Company] gave effect to the order on [date/time] as follows:
  [describe precisely — what was removed/disabled/provided, scope].

  [OR, where the order is deficient:]
  Before giving effect, [Company] respectfully notes that the order
  does not appear to contain [the statement of reasons / the exact
  electronic location / information on redress / a statement of
  territorial scope] required of such orders. [Company] requests
  that the order be supplemented so that it can give effect
  appropriately.

  [OR, where scope is at issue:]
  [Company] notes that the territorial scope of an order is limited
  to what is strictly necessary to achieve its objective. The order
  appears to seek [global] removal. [Company] has given effect
  within [the Union / member state], and would welcome
  clarification if a wider scope is intended.

RECIPIENT NOTIFIED
  [For orders to act:] [Company] informed the recipient concerned
  of the order and the effect given on [date].

CONTACT
  [Company]'s point of contact for authorities is [ ], reachable
  at [ ]. Communications may be addressed in [languages].

Respectfully,

Annotation. The three alternative middle paragraphs are the point. Companies default to silent compliance with any order that arrives, including deficient ones and ones claiming global scope. The regulation prescribes what an order must contain and limits territorial scope to what is strictly necessary — and a polite, specific request for supplementation is a normal supervisory interaction, not defiance.

Tool 11 — Transparency report template

[COMPANY] — DSA TRANSPARENCY REPORT — [Period]

1. ORDERS FROM MEMBER STATE AUTHORITIES
   By type (act against illegal content / provide information),
   by member state, by category of illegal content.
   Median time to acknowledge: ____   Median time to give effect: ____

2. NOTICES VIA THE NOTICE AND ACTION MECHANISM
   Total: ____
   By category of alleged illegal content: [table]
   Submitted by trusted flaggers: ____
   Action taken: removed ____ · disabled ____ · demoted ____ ·
     demonetized ____ · account action ____ · no action ____
   Basis: law ____ / terms ____
   Automated means used in processing: ____
   Median processing time: ____

3. OWN-INITIATIVE CONTENT MODERATION
   Measures taken, by type and by category.
   Use of automated tools: [describe]
   Numbers of items and accounts affected.

4. INTERNAL COMPLAINTS
   Received: ____   By basis: [table]
   Decisions: upheld ____ / reversed ____ / modified ____
   ** Reversal rate: ____% **
   Median handling time: ____

5. AUTOMATED MEANS — QUALITATIVE DESCRIPTION
   Purposes · indicators of accuracy · possible rate of error ·
   safeguards applied.

6. OUT-OF-COURT DISPUTE SETTLEMENT
   Disputes submitted: ____   Outcomes: ____   Median time: ____
   Whether we implemented the decisions: ____

7. MISUSE SUSPENSIONS
   Users suspended: ____   Notifiers/complainants suspended: ____

8. METHODOLOGY
   Counting conventions. What counts as an "action". How median
   times are calculated. Period covered.

Published in machine-readable format at: [link]

Annotation. Section 8 is not optional in practice even where it is not prescribed in terms: two companies counting "actions" differently produce numbers that cannot be compared, and a report without a methodology note invites the assumption that the numbers were chosen. The boxed reversal rate is the number readers will look at first, and it is better to publish it with an explanation than to have it computed by someone else.

Tool 12 — DMA business user rights letter

[Date]
[Gatekeeper] — Compliance Function

Re:  Business user rights under the Digital Markets Act —
     [Company], [account/developer/seller ID]

Dear [ ],

[Company] is a business user of [core platform service], a core
platform service provided by [Gatekeeper] as a designated
gatekeeper. We write to request the following, to which business
users are entitled.

1. DATA ACCESS.  Effective, high-quality, continuous, and
   real-time access to the aggregated and non-aggregated data
   provided for or generated in the context of our use of the
   service, including data provided or generated by end users
   engaging with our products or services. Please confirm the
   available access mechanism and provide credentials.

2. STEERING.  Confirmation that we may communicate and promote
   offers, including at different prices or conditions, to end
   users acquired via the service, and conclude contracts with
   those end users, whether or not they use the service, free of
   charge and without restriction.

3. PRICING PARITY.  Confirmation that we are not required to
   offer the same prices or conditions on the service as we offer
   through other channels.

4. ANCILLARY SERVICES.  Confirmation that access is not
   conditioned on our use of [Gatekeeper]'s identification
   service, browser engine, or payment service.

5. ADVERTISING TRANSPARENCY.  For advertising services: daily
   information, free of charge, on each advertisement placed —
   the price and fees paid by us, the remuneration received by the
   publisher, and the metrics on which each is calculated. Please
   confirm the access mechanism.

6. NON-USE OF OUR DATA.  Confirmation that non-public data
   generated by our activity on the service is not used by
   [Gatekeeper] in competition with us.

7. ACCESS CONDITIONS.  Confirmation that the general conditions
   of access applicable to us are fair, reasonable, and
   non-discriminatory, and a copy of those conditions.

Please respond by [date]. We would prefer to resolve these matters
directly and reserve all rights, including recourse to the
European Commission and national authorities.

Very truly yours,

Annotation. This is the only tool in the toolkit that can make a company money, and almost nobody sends it. The seven items are entitlements, not requests, and the compliance functions on the receiving end exist precisely to process them. Assign this file to a commercial owner — the person who runs the platform relationship — rather than to compliance, because the value is in using the data and the freedoms, not in filing the response.

Tool 13 — Geo-blocking assessment

SHOULD WE SERVE THE EU AT ALL?

THE NUMBERS
  EU users: ____ (____% of total)   EU revenue: $____ (____%)
  3-year EU forecast: ______________
  One-time build cost:   $__________
  Annual operating cost: $__________
    (moderation and complaint staffing · statement-of-reasons
     pipeline · representative · dispute settlement · reporting)
  EU revenue per compliance dollar: ______

IF WE STAY
  [ ] Full program per the implementation plan
  [ ] Harmonize globally / geo-differentiate — decided: ______

IF WE EXIT — DO IT PROPERLY
  [ ] Actual technical geo-blocking, not a banner
  [ ] Terms prohibit use from the Union
  [ ] No EU-language interface or marketing
  [ ] No euro pricing
  [ ] No EU-specific payment methods
  [ ] No EU country domains
  [ ] No EU-targeted advertising
  [ ] Existing EU users notified, with data export and refunds
  NOTE: the test is whether the service is OFFERED to recipients
  in the Union. Geo-blocking while marketing in French and pricing
  in euros creates a record of having tried, not an exit.

REVISIT: ____________ (annually — year-two costs fall materially)

Annotation. Include this tool in the program even when the answer is obviously to comply. A board that has seen the alternative priced approves the compliance budget differently from one that has only seen a cost. And for a company with genuinely marginal European exposure, exiting is a rational business decision rather than a failure — provided it is done as a real exit rather than a gesture.

Related documents

This toolkit is general information, not legal advice, and does not create an attorney-client relationship.