EU DSA DSA Articles 37 and 42(4) — Independent audit and publication
Designated VLOPs/VLOSEs MUST undergo independent audits at least annually at their expense covering Chapter III obligations and applicable commitments. Where the audit opinion is not positive, adopt the Article 37(6) audit implementation report within one month of receiving recommendations. Publish the Article 42(4) reports within three months of receiving each audit report, subject to its permitted confidentiality omissions.
Where this comes from
Provision: DSA Articles 37 and 42(4) — Independent audit and publication
Instrument: EU Digital Services Act (Regulation 2022/2065)
Citation: DSA Articles 37 and 42(4) — Independent audit and publication
Text version: Regulation (EU) 2022/2065 (Digital Services Act), OJ L 277, 27.10.2022, as adopted (CELEX 32022R2065); no consolidated text exists on Cellar, consistent with the Regulation being unamended; text retrieved 2026-09-21.
Who it applies to
It applies when all of these are true:
- Service is a Very Large Online Platform/Search Engine (45M+ EU users)
- Service has users in the European Union
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Designated VLOPs/VLOSEs MUST undergo independent audits at least annually at their expense covering Chapter III obligations and applicable commitments (Art 37(1)); MUST give auditors the cooperation, data, premises access and answers they need and MUST NOT hamper, unduly influence or undermine the audit (37(2)); MUST use auditors that are independent (no non-audit services on the audited matters in the 12 months before or after, no more than 10 consecutive years, no contingent fees) with proven expertise, objectivity and ethics (37(3)); and MUST ensure the audit report carries an opinion of 'positive', 'positive with comments' or 'negative' and, where not positive, operational recommendations with a timeframe (37(4)(g)-(h)), or an explanation of what could not be audited (37(5)). Where the audit opinion is not positive, adopt the Article 37(6) audit implementation report within one month of receiving recommendations. Publish the Article 42(4) reports within three months of receiving each audit report, subject to its permitted confidentiality omissions.
- Keep audit scope, corrective recommendations, adoption, transmission and publication distinct. Record reasons and alternative measures for recommendations not implemented. Do not confine the audit to Section 5 or confuse one-month adoption with publication. Apply designation and transition rules separately. Prepare the board for the three audit opinions - 'positive', 'positive with comments', 'negative' (37(4)(g)) - and for the one-month implementation report that a non-positive opinion triggers. Check auditor independence against 37(3)'s specifics before engagement. Do not hamper, unduly influence or undermine the audit (37(2)).
- Record the assessed scope, evidence and unresolved questions; completing this task is not a legal compliance determination.
Questions people ask
- Does EU DSA DSA Articles 37 and 42(4) — Independent audit and publication apply to my service?
- It applies when Service is a Very Large Online Platform/Search Engine (45M+ EU users); Service has users in the European Union.
- From when does this apply?
- EU DSA DSA Articles 37 and 42(4) — Independent audit and publication applies from 17 February 2024. Its current status is: in force.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.