European Center for Not-for-Profit Law (ECNL)

Five critical lessons from three years of DSA risk assessments

Reviewing three annual rounds of filings (2023-2025) from Facebook, Instagram, TikTok, X and YouTube, ECNL found reports ‘despite often exceeding 100 pages... still lack the necessary detail’ to understand platforms’ decisions. It identified five recurring gaps: vague risk statements, less diligence on fundamental-rights risks than other systemic risks, unsubstantiated claims, missing detail on stakeholder-consultation feedback, and inconsistent treatment of linguistic/geographic diversity.

Joint civil society statement on transparency of risk assessments under the Digital Services Act

The statement, co-signed by ECNL within the DSA Civil Society Coordination Group, sets out what a transparent risk assessment must disclose: detailed methodology, descriptions of algorithmic and advertising systems, risks tied to specific platform functionalities, mitigation measures, which teams/stakeholders were involved, and how audit recommendations fed back into mitigation.

Towards Meaningful Fundamental Rights Impact Assessments under the DSA

The paper argues DSA Article 34(1)(b) fundamental rights impact assessments (FRIAs) risk becoming ‘tick-box’ exercises without harmonized minimum standards. It sets six benchmarks papers must meet — governance grounded in the EU Charter, full scope, sufficient methodological detail, public transparency, a harmonized-but-flexible structure, and regular external stakeholder consultation — plus separate benchmarks for algorithmic content-moderation risks.