Working Paper
Section 3 - DSA, VLOPs and VLOSEs · Section 4 - Measuring the Platforms
Under Article 37 DSA, VLOPs and VLOSEs must be subject to independent audits at least once a year (Regulation (EU) 2022/2065, Art. 37; Commission Delegated Regulation (EU) 2024/436), with audit reports and audit implementation reports published under Article 42(4). As of September 2026, two annual cycles of audit reports have been published, in late 2024 and late 2025 (Albert, 2025; KPMG, 2026).
The DSA contains five Chapters comprising 93 Articles. Not all Articles are subject to audit. Many provide the administrative, supervisory and enforcement framework for mechanisms not undertaken by providers. The audited obligations sit within Chapter III (Articles 11–48), which sets out providers' due diligence obligations (Regulation (EU) 2022/2065, Art. 37(1)). The Articles outside Chapter III could support a broader, deeper model assessing how well Member States, the EU, auditors and VLOPs and VLOSEs interact and create space for developed democracy. However, that is not the purpose of this research.
Within Chapter III, two Articles, 34 and 35, do much of the work my paper needs. Article 34(1) names what counts as a risk. It gives four broad categories: the dissemination of illegal content; negative effects on fundamental rights, including human dignity, privacy, freedom of expression, non-discrimination, the rights of the child and consumer protection, listed "in particular" rather than exhaustively; negative effects on civic discourse, electoral processes and public security; and negative effects related to gender-based violence, the protection of public health and minors and serious negative consequences to a person's physical and mental well-being. Freedom of expression and non-discrimination sit closest to my paper's concern with vertical accountability and the space of reasons; the other categories matter to the Act, but less directly to the argument developed here. Article 34(2) names what must be examined as a possible cause of that risk: it requires platforms to assess how these four categories are influenced by, among other things, "the design of their recommender systems and any other relevant algorithmic system". The algorithm is, in this narrow sense, firmly inside the legal framework: 34(1) sets the harm, 34(2) puts the algorithm on the list of things that might be causing it. What neither Article does is define its own terms with enough precision to test a risk assessment or an audit against a fixed benchmark: what counts as a "significant" effect, what "plain and intelligible language" requires, what the "most significant" parameters of a recommender system are. Each of those terms is left for the platform, and the auditor it engages, to define. The same imprecision carries through to the next stage of the Act. Article 35(1) requires platforms to put in place "reasonable, proportionate and effective" mitigation measures once a risk has been identified. What counts as proportionate mitigation, like what counts as a significant effect, is left for the platform to determine in the first instance. Sandri and Novelli identify why this matters beyond legal drafting. The severity of a harm and the level of risk deemed acceptable are evaluative judgements. When such judgements are delegated to a private provider "the underlying value choices become as opaque as the technical operations that carry them", leaving open "who is authorized to set the risk attitude on the public's behalf" (2026, pp. 6–7). Under Articles 34 and 35, that authority sits with the platform.
Audits are conducted against two Regulations. Regulation (EU) 2022/2065 sets out what the DSA requires of providers and Commission Delegated Regulation (EU) 2024/436 sets out how audits must be performed. Alongside these sit the DSA Transparency Database, which records providers' statements of reasons (SORs) for content moderation decisions (Regulation (EU) 2022/2065, Arts 17, 24(5)), and the professional assurance standards auditors apply, such as ISAE 3000 (Revised) (International Auditing and Assurance Standards Board, 2013). Audit recommendations are not legally binding. A provider must take account of them and produce an audit implementation report within one month, but it may decline to implement a recommendation if it justifies its reasons and sets out any alternative measures (Regulation (EU) 2022/2065, Art. 37(6)). Non-compliance does not lead to enforcement automatically: the Commission may open proceedings and, where it finds an infringement, adopt a non-compliance decision and impose fines (Regulation (EU) 2022/2065, Arts 66, 73–74). Providers select their own auditor and may change auditor between cycles, subject to independence requirements, including a bar on any organisation auditing the same provider for more than ten consecutive years (Regulation (EU) 2022/2065, Art. 37(3)). In practice, only AliExpress and X changed auditor, with the rest choosing continuity for the second cycle (Albert, 2025). The arrangement resembles the remedy Pasquale proposed for black-box firms: algorithms opened for inspection, if not to the public at large, then to 'some trusted auditor' (Pasquale, 2015, p. 141). The DSA adopts the auditor but not the trust. The auditor is chosen and paid by the firm it audits, with the public receiving only its conclusion.
My Harm Index is tested against three VLOPs: Facebook, X and YouTube. This provides a consistent application referencing the same Articles. Within Google's services, Google Search is designated a VLOSE (Google Ireland Limited, 2025b, p. 1). It is subject to the DSA, but to a narrower set of obligations.
The distinction between the two designations (VLOP/VLOSE) is not one of scale. Article 3 defines "online platform" and "online search engine" as separate categories (Regulation (EU) 2022/2065, Art. 3(i), (j)). An online platform stores and disseminates information to the public at a recipient's request, whereas an online search engine allows users to input queries and returns results. Chapter III, Section 3 (Articles 19–28), which covers among other things internal complaint-handling, out-of-court dispute settlement, trusted flaggers and advertising transparency, applies by its own terms only to providers of online platforms. Section 2 (Articles 16–18), including notice-and-action, applies only to hosting services and Section 4 (Articles 29–32) only to online platforms allowing consumers to conclude distance contracts with traders. Google Search's audit report reflects this. Only two Section 3 sub-articles, Articles 24(2) and 24(3), are listed as applicable with every sub-article in Sections 2 and 4 marked not applicable. In most cases, Google's stated rationale is that the obligation "does not apply to Google Search as it is an online search engine" (Google Ireland Limited, 2025b, p. 4). Google Search was therefore not used as this study's third platform. In the same audit cycle, its report lists 41 applicable sub-articles against 76 for YouTube (Google Ireland Limited, 2025b; 2025c). Several of the model's twelve indicators would therefore have had no applicable DSA obligation from which to draw evidence, making cross-platform comparison impractical.
For each audited Article, the auditor reaches one of three statutory conclusions or, where it cannot reach one with reasonable assurance, records no conclusion (see "What a disclaimer means" below).
This gives four possible states per Article, per cycle:
The statutory "negative" conclusion is coded here as Failed (F). This reflects my framing: the DSA's most explicit democratic reference is the systemic risk category in Article 34(1)(c), which requires VLOPs and VLOSEs to assess "any actual or foreseeable negative effects on civic discourse and electoral processes, and public security" (Regulation (EU) 2022/2065). Read through the lens of democracy, a provider's failure to meet a DSA obligation is also a failure of the conditions supporting democratic space.
Comparing an Article's state across the two published cycles gives 4 × 4 = 16 possible Cycle 1 → Cycle 2 transitions. The transition labels, compliance and architecture readings and status scores in the table below are my coding scheme, developed for this research. They are not categories used in the DSA or in the audit reports.
Table 3.1. The Audit Matrix: Scheme for Cycle 1 → Cycle 2 audit transitions
| C1 → C2 | Label | Compliance reading | Architecture reading | Status |
|---|---|---|---|---|
| P → P | Sustained clean record | Best possible outcome | Verification working, nothing to report | 2 |
| P → PC | New concern | Decline | Verification still working | 1 |
| P → F | New failure identified | Regression | Verification still working (caught it) | 0 |
| P → D | Clean record loses verification | Unknown, cannot tell | Regression: working process stopped engaging | 0 |
| PC → P | Issue resolved | Improvement | Verification working | 2 |
| PC → PC | Issue persists | Unresolved but non-critical | Verification working, same soft spot both times | 1 |
| PC → F | Issue escalated | Worsening | Verification working (caught the escalation) | 0 |
| PC → D | Flagged issue loses verification | Unknown, cannot tell | Regression: a visible soft spot becomes invisible | 0 |
| F → P | Full remediation | Repaired | Verification working | 2 |
| F → PC | Partial remediation | Improved, not resolved | Verification working | 1 |
| F → F | Persistent failure | Unresolved problem | Verification working both times (caught it twice) | 0 |
| F → D | Documented failure loses verification | Unknown | Regression: working process stops engaging | 0 |
| D → P | Full resolution from opacity | Repaired | Verification recovers | 2 |
| D → PC | Partial resolution from opacity | Improved | Verification recovers | 1 |
| D → F | Resolved-negative | Unresolved problem | Verification recovers (produces negative outcome) | 0 |
| D → D | Verification not obtained | Unknown | Non-engagement continues unchanged | 0 |
Source: Coding scheme. Positive, Positive with comments and Negative are the statutory conclusion categories (Regulation (EU) 2022/2065, Art. 37(4)(g)); Negative is coded here as F. D marks the unlabelled no-conclusion outcome (Commission Delegated Regulation (EU) 2024/436, Art. 8(8)).
The ISAE 3000 (Revised) assurance standard, under which the audits examined were conducted, provides reasonable assurance within a defined scope, not exhaustive verification. The auditor reduces engagement risk to an acceptably low level in the circumstances of the engagement, and reasonable assurance is less than absolute, reflecting factors such as selective testing and evidence that is persuasive rather than conclusive (International Auditing and Assurance Standards Board, 2013, paras 12(a)(i)(a), A14). A fall in non-positive findings between cycles could therefore reflect improved practice or reduced audit attention. Distinguishing between the two would require obligation-by-obligation tracking of applicability and testing depth across cycles. This falls outside the scope of my process-level Harm Index model. A natural extension of this work, for future research, would be a depth-of-testing audit trail. This would track not just whether an Article appears in the non-positive findings, but what sample size, materiality threshold and evidence basis supported each positive conclusion, to establish whether practice has reliably improved or audit attention has merely reduced.
PC, F and D each generate a documented flag, a specific problem the auditor identifies and reasons through in the report. A P typically comes with process commentary, confirmation that the platform's stated procedure was followed. However, that commentary is assessed against criteria that can vary by auditor and by platform. My Harm Index applies the same twelve indicators to every P, so the Article is measured against a consistent, external standard rather than the platform's own account of its process. This is what gives my model a degree of universality across platforms and why the outcome varies.
Under the DSA's audit regime, the auditor must reach one of three conclusions on each audited obligation: positive, positive with comments or negative, each with a reasonable level of assurance (Regulation (EU) 2022/2065, Art. 37(4)(g); Commission Delegated Regulation (EU) 2024/436, Art. 8(1)). Where the auditor cannot reach a conclusion at that level, the Delegated Regulation does not create a fourth category; it requires the audit report to explain the circumstances and the reasons why that level of assurance could not be achieved (Commission Delegated Regulation (EU) 2024/436, Art. 8(8)). This fourth outcome is therefore unlabelled in the DSA framework. ISAE 3000 (Revised), the assurance standard under which most audits are conducted, names it a disclaimer of conclusion, issued where a limitation of scope prevents the auditor from obtaining sufficient appropriate evidence (International Auditing and Assurance Standards Board, 2013, para. 74(a)). Ernst & Young LLP (EY) states that, where obligations are subject to formal Commission proceedings, it "may disclaim an opinion on such individual obligations or commitments" (Ernst & Young LLP, 2025, p. 136). A disclaimer is neither a finding of non-compliance nor a finding of compliance.
For the edge of democracy, this matters. A disclaimer is a formal statement that the process built to answer the question "is this platform complying with the law?" was unable to answer it, for that obligation, in that year.
My model treats a disclaimer as functionally equivalent to a failure to verify and scores it 0 on the process indicators (Independent verification, Depth of verification, Outcome reporting), regardless of the reason given. This is a coding choice, not a legal classification. Whether the auditor lacked evidentiary access or the obligation overlapped with a parallel legal proceeding makes no difference to the score. My model does not ask whether the platform complied. It asks whether independent, audited verification confirmed that the obligation was met. A disclaimer and a negative conclusion are legally distinct, but in the Harm Index they produce the same score: in both cases, no external body has confirmed that the obligation was met during that period.
My research covers two consecutive audit cycles for each platform. A disclaimed obligation can move in one of four directions the following year and each is treated differently:
A disclaimer is where the DSA's accountability architecture fails. In the reports examined for this study, disclaimers cluster on the obligations most central to the model (Table 3.2). Ernst & Young LLP declined to reach a conclusion on the same 14 Facebook sub-articles in both cycles, all subject to ongoing Commission investigations (Ernst & Young LLP, 2024, p. 2; 2025, pp. 3–4). In the second cycle, BDO LLP was unable to provide an opinion on 10 X sub-articles under formal Commission proceedings (BDO LLP, 2025, p. 5). Seven sub-articles, spanning notice-and-action, interface design, systemic risk assessment and mitigation and researcher data access, were disclaimed for both platforms. YouTube, by contrast, received a conclusion on every applicable obligation in both cycles (Google Ireland Limited, 2024b, p. 137; 2025c, p. 178).
Where verification is absent in a cycle, and remains absent across cycles, the platform's most significant exercises of power are those with the least publicly accessible evidence. This is the phenomenal form of the addressee problem: a system whose most significant conduct is structurally unreachable by the very mechanism built to hold it answerable, the DSA audit process. Table 3.2 shows two routes to that outcome. For Facebook, and for X in the second cycle, verification stopped where Commission investigations began. The auditor records that Meta imposed no limitations and cooperated fully (Ernst & Young LLP, 2025, p. 3). Nothing was hidden: the mechanism could not produce an output. In X's first cycle, by contrast, FTI could reach no conclusion on two obligations because the information needed was treated as privileged or not supplied (FTI Consulting, 2024, pp. 109, 238)1. Whether the cause is a parallel proceeding or a provider's non-disclosure, the result is the same: no independent verification for that obligation in that cycle.
Table 3.2. Sub-articles on which no audit conclusion was reached, by platform and cycle
| Sub-article | Subject | Facebook C1 | Facebook C2 | X C1 | X C2 | YouTube C1 | YouTube C2 |
|---|---|---|---|---|---|---|---|
| 14(1) | Terms and conditions | D | D | – | – | – | – |
| 16(1) | Notice-and-action mechanisms | D | D | – | – | – | – |
| 16(5) | Notice-and-action: notification of decision | D | D | – | D | – | – |
| 16(6) | Notice-and-action: processing, incl. automated means | D | D | D | D | – | – |
| 17(1) | Statement of reasons | D | D | – | – | – | – |
| 20(1) | Internal complaint-handling | D | D | – | – | – | – |
| 20(3) | Internal complaint-handling | D | D | – | – | – | – |
| 24(5) | Submission to Transparency Database | D | D | – | – | – | – |
| 25(1) | Online interface design | D | D | – | D | – | – |
| 28(1) | Protection of minors | D | D | – | – | – | – |
| 34(1) | Systemic risk assessment | D | D | – | D | – | – |
| 34(2) | Systemic risk assessment: factors | D | D | – | D | – | – |
| 34(3) | Risk assessment: supporting documents | – | – | D | – | – | – |
| 35(1) | Risk mitigation | D | D | – | D | – | – |
| 39(1)–(3) Three sub-articles | Advertising repository | – | – | – | D | – | – |
| 40(12) | Researcher data access | D | D | – | D | – | – |
| Total | 14 | 14 | 2 | 10 | 0 | 0 | |
| Stated reason | Commission investigations | Commission investigations | Evidence not provided by X | Commission proceedings | – | – | |
| Source | Ernst & Young LLP (2024, p. 2) | Ernst & Young LLP (2025, pp. 3–4) | FTI Consulting (2024, pp. 24, 35, 108–109, 237–238) | BDO LLP (2025, p. 5) | Google Ireland Limited (2024b, p. 137) | Google Ireland Limited (2025c, p. 178) |
Key: D = no audit conclusion reached - = conclusion reached or not applicable.
How an article is reported, the final audited decision, is driven by four elements. It starts with an article of the DSA. A rule such as "Providers of online platforms shall not design, organise or operate their online interfaces in a way that deceives or manipulates the recipients of their service " (Article 25(1)) or "provide recipients of services with a concise, easily-accessible and machine-readable summary of the terms and conditions, including the available remedies and redress mechanisms, in clear and unambiguous language." (Article 14(5)). The article says what a platform must do, but nothing about how that is checked.
General guidance on independence and access is provided by Article 37, the DSA's audit clause. It says platforms must be independently audited every year, sets basic ground rules for the auditor (independence, no conflicts of interest) and says every audit must end in one of three verdicts. However, Article 37 does not guide how an auditor should reach that verdict. It requires the auditor to describe, after the fact, methods used and remedial actions, if appropriate.
Guidance for the DSA audits is provided by the Commission's Delegated Regulation (EU) 2024/436. This is where the ‘how’ of auditing is contained, covering aspects such as how much evidence is enough, "’reasonable level of assurance’ means a high but not absolute level of assurance” (Commission Delegated Regulation (EU) 2024/436, Art. 2(13)), how big a sample has to be and the measurements and benchmarks applied.
The fourth element is guidance provided by the auditors' professional bodies. The majority of the professional guidance is provided by the ISAE 3000 standards. The DSA does not specify a particular set of guidelines or mandate which professional rubric is used. This is a theoretical issue, but it complicates any cross audit matching where different standards are used by auditors. The guidance from the EU is derived from the DSA “Audits performed pursuant to paragraph 1 shall be performed by organisations which: … have proven objectivity and professional ethics, based in particular on adherence to codes of practice or appropriate standards” (Regulation (EU) 2022/2065, Art. 37(3)(c)) and the Delegated Regulation “audits shall be performed by using appropriate auditing methodologies to reduce the assessed audit risks to a level that enables the auditing organisation to reach audit conclusions at a reasonable level of assurance” (Commission Delegated Regulation (EU) 2024/436, Art. 10(1)).
The multi-element nature of the audit process, together with the lack of enforcement available to auditors or the EU, creates several issues which impact on the edge of democracy issue my research is concerned with. The most dangerous of these, if we are to protect democracy from algorithmic harm, can be summarised as follows:
DSA Article 37(6) duty is to "take due account" of a recommendation, not to implement it. A platform can read a recommendation, disagree and ignore, provided it records why. There is no penalty or escalation in Article 37 or the Delegated Regulation for refusing an operational recommendation. The only route to any consequence at all is the Commission separately, independently deciding to open an investigation. This is a different legal track with no automatic link to what the audit found.
The audit process is diagnostic. An auditor can request data, ask questions and provide conclusions. It cannot order a fix or impose interim measures beyond the general cooperation duty “Providers of very large online platforms and of very large online search engines shall afford the organisations carrying out the audits pursuant to this Article the cooperation and assistance necessary to enable them to conduct those audits” Article 37(2). The EU’s enforcement tools: investigations, binding decisions, fines up to 6 percent of global turnover, exist under DSA Articles 65–76 and can create a legal environment where a platform could choose to comply, to avoid further fines and censure for example. However, there is no direct trigger requiring the EU to act if Articles in the DSA are not passed. Article 66(1) “The Commission may initiate proceedings … (if platforms infringe) any of the provisions of this Regulation”. The key phrase here is ‘may’.
A failure that repeats across cycles produces no built-in escalation within the DSA. Each audit may produce the same finding and recommendation in each cycle. Nothing in the audit mechanism itself provides a means to pressure or change the consequence for a problem that was not fixed the first time. It just gets recorded again.
The disclaimer option lets the process exit the hardest questions entirely, without penalty for exiting. Every audit obligation is supposed to end with the auditor making a judgement: the platform is compliant, it is not, or it is compliant with some caveats. Problematically, the rules allow a fourth option. If something outside the auditor's control blocks them from gathering enough evidence, most often, an investigation already looking into the same issue, they are allowed to say nothing at all. This does not require bad faith on anyone's part, but the structure creates room that can be used opportunistically whether or not it is. The obstacle can be genuinely evidentiary. An auditor cannot necessarily see what an investigation can see and cannot rule out that the investigation knows something that would change the audit's answer. However, the same structure also creates a second, discretionary route to the identical outcome. If an auditor becomes aware, during audit planning, that a set of Articles is under investigation, they may choose not to investigate that Article at all, rather than being blocked from doing so. Both routes produce the same disclaimer on the record and nothing in the process distinguishes a disclaimer reached through genuine evidentiary block from one reached through discretionary avoidance. In the Harm Index, both routes score 0 (see "Disclaimers and the Harm Index").
This ability to disclaim clusters on some of the most important Articles, the ones where the edge of democracy issue resides.
Article 25(1) requires that “Providers of online platforms shall not design, organise or operate their online interfaces in a way that deceives or manipulates the recipients of their service or in a way that otherwise materially distorts or impairs the ability of the recipients of their service to make free and informed decisions”.
Article 28(1) focuses on protection of minors where they “shall put in place appropriate and proportionate measures to ensure a high level of privacy, safety, and security of minors”.
Article 34(1) states that platforms “shall diligently identify, analyse and assess any systemic risks in the Union stemming from the design or functioning of their service and its related systems, including algorithmic systems, or from the use made of their services”.
Article 40(12) has an open data requirement requiring that platforms “shall give access … to real-time data, provided that the data is publicly accessible in their online interface by researchers”.
What connects the four Articles is not that the platforms are guilty of anything on the record, a disclaimer is not a finding of non-compliance. What connects them is that a form of oversight continues. An investigation may be scrutinising exactly these questions, but the channel built to be visible, the one a researcher could read, is void. Auditing an obligation that might otherwise be disclaimed produces an outcome rather than a void, even where that outcome is negative and disputed by the platform. As I show, when applying the Harm Index, X's Cycle 1 record on Article 34 and the related obligation 35(1) was mixed rather than uniformly negative: Positive with comments on 34(1), Negative on 34(2), No Conclusion on 34(3), where FTI could not obtain the supporting documents despite several requests, and Negative on 35(1) (FTI Consulting, 2024, pp. 34–36, 238). In Cycle 2, BDO reached no conclusion on 34(1), 34(2) or 35(1), all under formal Commission proceedings (BDO LLP, 2025, p. 5). Only 34(3) produced a finding, Positive, with that resting on an assurance that supporting documents "will be preserved" and an inspection that the risk assessment itself had been retained, within a single examination period that could not test the three-year retention requirement (BDO LLP, 2025, p. 52). A negative conclusion is a position on the record. A disclaimer forecloses even that. It produces neither a favourable nor an unfavourable finding, only an absence. This is the edge-of-democracy issue: not that manipulative design, child safety, systemic risk and independent research access go unexamined, but that the public's own means of holding that examination to account is empty where it matters most. Power over civic discourse, minors and the platform's own account of its risks continues to be exercised either way. What is lost is an addressee's ability to question it, or to hold anyone answerable for it. That loss recurs, in the case examples, across successive audit cycles. This is a structural feature of how the audit regime and the investigatory regime fail to communicate with each other, resulting in the erosion of democracy in this area.
Where the audit does reach a finding, it has no way to resolve a disagreement about what the law requires. The auditor's conclusion is an informed opinion, not a legal determination. Binding findings of non-compliance are a reserve of the Commission's enforcement powers (Regulation (EU) 2022/2065, Arts 66, 73–74), subject to review by the Court of Justice of the European Union (Art. 81). Within the audit itself, interpretation begins with the platform. Meta's auditor records that management is responsible for "making interpretations, defining ambiguous terms and developing benchmarks" to implement the obligations being audited (Ernst & Young LLP, 2024, p. 1; 2025, p. 2). Disclaimers aside, a platform can therefore dispute a finding not by denying the facts, but by contesting the meaning of the obligation itself. X's first-cycle audit shows how this could work. X took the position that its advertising recommender systems may not be subject to the same legal requirements as other recommender systems and FTI, unable to consider this "an unreasonable position", recorded "No Conclusion" in respect of those systems, within an otherwise Positive with comments finding on Article 38(1) (FTI Consulting, 2024, pp. 248, 251). Nothing in the audit process adjudicates a dispute of this nature. The platform's only mandatory response is procedural. Within one month of receiving operational recommendations, it must adopt an audit implementation report, and where it does not implement a recommendation, it must justify its reasons and set out any alternative measures (Regulation (EU) 2022/2065, Art. 37(6)); both reports are then transmitted to the Commission and the Digital Services Coordinator and made public (Art. 42(4)). The platform responds to a finding with its own reading of the obligation and that reading stands unless the Commission takes enforcement action. This highlights a gap in the DSA's power to enable change. Where interpretive power over the law's meaning sits, within the audit, with the object the law is meant to constrain, the audit stops being a check on the platform and becomes, as a consequence, a forum the platform can use to author the rule it is being measured against.
Each of the twelve indicators across Tables 2.3-2.5 of my model draws on one or more Articles of the DSA and some Articles inform more than one indicator. This allows mapping of each indicator to the specific articles that generate verifiable evidence for it. In the tables below I attach Articles to indicators with a reason why the Article and indicator are paired. This is further linked to the platform, Article and Cycle from the three platforms applied to my model. This evidence is included in the three appendices, providing the foundation for applying my model to other platforms and future cycles.
The indicator-Article mapping and the reasons given for each pairing are my own methodology choices. Descriptions of what each provision requires are taken from Regulation (EU) 2022/2065 and Commission Delegated Regulation (EU) 2024/436, cited by pinpoint in each table.
Table 3.3. Purpose (Architectural Transparency)
| Primary articles | Why |
|---|---|
| Article 14(1) (terms and conditions) | Requires platforms to state, directly within the Terms and Conditions, information on content-moderation policies/tools (including algorithmic decision-making and human review) and internal complaint-handling rules of procedure, in "clear, plain, intelligible, user-friendly and unambiguous language". Whether that's stated directly or only reachable via linked pages is the disclosure question. |
| Articles 15(1), 24 (transparency reporting) | The periodic disclosure obligation, largely quantitative: orders received, notices, own-initiative moderation, complaints and use of automated means (Art. 15(1)), plus platform-specific figures on out-of-court disputes, suspensions and average monthly active recipients (Art. 24(1)–(2)). |
| Article 27(1)-(2) (recommender transparency) | Disclosure of why content is suggested |
| Article 39(1) (advertisement repository) | Disclosure duty specific to advertising, structurally separate from content moderation. |
| Primary articles | Why |
|---|---|
| Article 37(1), (4)(d) (independent audit) | The verification mechanism itself: annual independent audit of Chapter III obligations (Art. 37(1)), with the report describing "the specific elements audited, and the methodology applied" (Art. 37(4)(d)). |
| Article 34(1), 35(1) (risk assessment / mitigation) | Verified annually as part of the same audit cycle; whether verification reaches these is a live question given the disclaimer pattern. Audited under Art. 37(1)(a); specific audit methodologies in Delegated Reg. Arts 13–14. |
| Primary articles | Why |
|---|---|
| Article 24(5) (Transparency Database) | Public-facing verification-adjacent output. Disclosure of moderation actions rather than audit results specifically. |
| Article 42(4)(c)-(d) (publication of audit report and implementation report) | The actual publication duty |
| Primary articles | Why |
|---|---|
| Article 37 + Delegated Reg. (EU) 2024/436 | Commission Delegated Regulation (EU) 2024/436 sets the audit process externally: the audit risk analysis (Art. 9), audit methodologies and materiality threshold (Art. 10), quality of audit evidence (Art. 11) and sampling (Art. 12), with methodologies drawn up "without influence from the audited provider" (Recital 22). The audit criteria themselves, however, are defined based on the benchmarks the provider uses to monitor its own compliance (Commission Delegated Regulation (EU) 2024/436, Art. 10(2)(a), read with Art. 5(1)(a); Recital 22). The professional standard auditors apply (e.g. ISAE 3000) is set by neither Regulation; the audit report need only reference "any auditing standards applied in the audit, as applicable" (Commission Delegated Regulation (EU) 2024/436, Annex I, Section B.5). |
| Article 20(4) (and any other finding citing the “audited provider's developed supplemental criteria") | EY defines these as the "audited provider's legal interpretation, operational benchmarks and definitions" (Ernst & Young LLP, 2025, p. 6). It applies the same definition to YouTube, stating that "many of the obligations needed to be supplemented by the audited provider's own legal determination, operational benchmarks and/or definition of ambiguous terms" (Google Ireland Limited, 2025c, p. 172). The phrase signals that the benchmark was self-authored, not externally imposed. See, for example, Art. 20(4) for Facebook (Ernst & Young LLP, 2025, p. 34) and Art. 24(5) for YouTube, measured against the provider's own "4-day" operational benchmark (Google Ireland Limited, 2024b, p. 73). |
| Primary articles | Why |
|---|---|
| Article 37(4)(d), Delegated Reg. Art. 10(2) (audit procedures) | The methodology statement itself shows whether checking went beyond existence-confirmation. |
| Any Disclaimed Article | The cleanest possible negative case. Whatever checking occurred, no conclusion was reached and the report records only why (Delegated Reg. Art. 8(8)). |
Sources: Regulation (EU) 2022/2065; Commission Delegated Regulation (EU) 2024/436; audit reports as cited. Indicator-Article mapping by the author.
Table 3.4. Petition (Justificatory Addressability)
| Primary articles | Why |
|---|---|
| Article 11(1), 12(1) (points of contact) | The most literal "someone to go to" for authorities and for users respectively. |
| Article 37(1) (the auditor) | A structural external addressee, even if its independence is separately in question (see Table 3.5). |
| Primary articles | Why |
|---|---|
| Article 37(6) / 42(4)(d) (implementation report) | Recommendations are non-binding by design. The provider can decline and explain why, which is direct textual evidence of weak enforceability. |
| Primary articles | Why |
|---|---|
| Article 16(1) (notice and action) | The initial reporting route. Mechanisms must be "easy to access and user-friendly" and allow notices to be submitted "exclusively by electronic means". |
| Article 17(3)(f) (statement of reasons: redress information) | The route is only accessible if the complainant is told it exists. Statements of reasons must give "clear and user-friendly information on the possibilities for redress", including out-of-court dispute settlement. |
| Article 20(1), (3) (internal complaint-handling) | The main complaint route. Recipients must have access, for at least six months after a decision, to a system that lets them complain "electronically and free of charge" (Art. 20(1)), and the system must be easy to access and user-friendly (Art. 20(3)). |
| Article 21(1), (5) (out-of-court dispute settlement) | The escalation route. Recipients may select any certified body (Art. 21(1)), and for them dispute settlement must be "available free of charge or at a nominal fee" (Art. 21(5)). |
| Primary articles | Why |
|---|---|
| Article 17(1) (statement of reasons) | The individual-level outcome report. |
| Article 24(5) (statement-of-reasons database submission) | The aggregated public version of the same. |
| Article 42(4)(c)-(d) (audit/implementation report publication) | The process-level outcome report. |
Sources: Regulation (EU) 2022/2065; Commission Delegated Regulation (EU) 2024/436; audit reports as cited. Indicator-Article mapping by the author.
Table 3.5. Peer (Minimal Co-authorship)
| Primary articles | Why |
|---|---|
| Article 21(1), (2), (5) (out-of-court dispute settlement bodies) | A certified outside body can hear a dispute, but it "shall not have the power to impose a binding settlement of the dispute on the parties" (Regulation (EU) 2022/2065, Art. 21(2)). Pressure comes from cost allocation, since the platform bears the body's fees where the recipient wins (Art. 21(5)) and from public reporting, not from an override power. Disputes concern individual decisions (Art. 21(1), referring to Art. 20(1)) not the system logic that produced them. |
| Primary articles | Why |
|---|---|
| Article 37(3)(a)-(c) (auditor independence requirements) | The direct textual independence standard the auditing organisation must meet before it can be engaged at all. |
| Delegated Reg. 2024/436, Annex I, Section B.4 | Where the auditor provides a declaration of interests and documents attesting its independence under Art. 37(3)(a) and (c). |
| Delegated Reg. 2024/436, Annex I, Section B.5 | Where the auditor states which professional auditing standard it actually followed. The audit report need only reference it "as applicable”. |
| Primary articles | Why |
|---|---|
| Article 40(12) (researcher data access) | The DSA's mechanism for independent outside access. VLOPs must give researchers access "without undue delay" to data, including real-time data where technically possible, but only data that is "publicly accessible in their online interface" and only for research on systemic risks. It gives access to data, not to system logic directly. |
| Article 24(5) (Transparency Database) | Platforms must submit their decisions and statements of reasons to the Commission for inclusion in a publicly accessible, machine-readable database. This channel is weaker than Art. 40(12) in principle, since it holds aggregate disclosure rather than research access, but it is unaffected by the disclaimer pattern and has independently extracted evidence2. |
| Auditor's own methodology statement (required by Article 37(4)(d): "a description of the specific elements audited, and the methodology applied") | The paid auditor's access is bounded by its own scoping choices. Meta's auditor states that it examined internal controls "but not for the purpose of expressing an opinion on the effectiveness of the audited provider's internal control" (Ernst & Young LLP, 2024, p. 5; 2025, p. 5). This is EY's standard scoping language, which also appears in its YouTube report (Google Ireland Limited, 2025c, p. 5). The limit is therefore structural rather than specific to Meta and it is set by the auditor's methodology, not by Art. 37(4). |
| Article 38 (non-profiling recommender option) | A narrow, opt-out form of system access. VLOPs must provide "at least one option for each of their recommender systems which is not based on profiling". |
Sources: Regulation (EU) 2022/2065; Commission Delegated Regulation (EU) 2024/436; audit reports as cited. Indicator-Article mapping by the author.
Section 3 set out the structural case for why DSA-mandated audit alone cannot be trusted as a self-sufficient accountability mechanism. Section 4 tests that case against evidence. The Harm Index, twelve indicators across three sub-indices (Purpose, Petition, Peer), applies in full to three VLOPs: Facebook (Meta), X and YouTube, chosen for contrast.
X's auditor relationship changed entirely between cycles. Of the nineteen services initially designated as VLOPs or VLOSEs, all of which have now published two rounds of audit reports, only two, AliExpress and X, changed auditor (Albert, 2025). X replaced FTI Consulting with BDO LLP, a member of the European Contact Group, whose guidance advises auditors not to reach conclusions on obligations under Commission investigation (Albert, 2025). The professional basis of the audit changed too: FTI applied ISACA's IT audit and assurance standards (FTI Consulting, 2024, p. 11), whereas BDO conducted its engagement under ISAE 3000 (BDO LLP, 2025, p. 4).
X's response to its first-cycle audit was selective. It accepted some recommendations, committing, for example, to update its trusted flagger guidance and its transparency reporting manual (Twitter International Unlimited Company, 2024, pp. 29, 35). But where FTI reached negative conclusions on contested or investigated obligations, X met the findings with reinterpretation or deferral rather than correction. FTI found X non-compliant on online interface design (Art. 25(1)) and the protection of minors (Art. 28(1)) (FTI Consulting, 2024, pp. 33, 191). X replied that the first finding "goes beyond the requirements of Article 25", and that the auditor's proposed age-assurance standard "does not comply with Article 28.3 DSA" (Twitter International Unlimited Company, 2024, pp. 42, 52). FTI also reached negative conclusions on systemic risk assessment and mitigation (Arts 34(2), 35(1)) (FTI Consulting, 2024, pp. 35–36). On these, and on Article 25, all under Commission investigation, X stated that it "does not intend to implement the auditor's recommendation and will await the EC's decision in the investigation" (Twitter International Unlimited Company, 2024, pp. 42, 57–58, 62; see also Albert, 2025).
YouTube serves as the control case. Its auditor reached a conclusion on every applicable obligation in both cycles, including the systemic risk obligations under Articles 34 and 35 that were disclaimed for Facebook in both cycles and for X in Cycle 2 (Table 3.2; Google Ireland Limited, 2024b, p. 137; 2025c, p. 178). Its headline Harm Index score of 1 diverges from the 0 recorded for both Meta and X under the same model and DSA rules (see the platform results below). Together the three span the range the model is built to detect: concentrated failure, contested failure and a partial pass.
One scoring choice carries through every table that follows: a disclaimed Article scores 0 on the relevant process indicators, as a documented failure would, whatever the reason given (Section 3, "Disclaimers and the Harm Index"). The tables apply this rule without restating it.
Tables 4.1–4.3 set out the scores for all three platforms, one table per index. Each table asks one question of every platform.
Purpose (five indicators) how strong is the architectural transparency of its governing logic
Petition (four indicators) can its decisions be challenged
Peer (three indicators) can its logic be contested
Each cell gives the score and the band it corresponds to; the full scoring guidance for each indicator is set out in Tables 2.3–2.5.
The evidence and reasoning behind every score follow, platform by platform.
Table 4.1. Purpose (Architectural Transparency): scores by platform
| Indicator | DSA Articles | Meta | X | YouTube |
|---|---|---|---|---|
| Disclosure of optimisation objective or declared decision logic | 14, 15/24, 27, 39 | 1: Disclosed reactively | 1: Disclosed reactively | 1: Disclosed reactively |
| Independent verification of declared logic against operation | 34/35, 37 | 0: No independent verification | 0: No independent verification | 2: Routine, continuous verification |
| Public availability | 24(5), 42(4)(c)–(d) | 2: Proactively published on a fixed cycle | 2: Proactively published on a fixed cycle | 2: Proactively published on a fixed cycle |
| Methodological concurrence across subjects | 37; Delegated Reg. (EU) 2024/436 | 1: Common procedural framework; subject-defined benchmarks | 1: Common procedural framework; subject-defined benchmarks | 1: Common procedural framework; subject-defined benchmarks |
| Depth of verification | 37(4); disclaimed Articles | 0: Confirms only that a control exists | 0: Confirms only that a control exists | 1: Confirms an observable effect; logic not characterised |
| Index score | 0 | 0 | 1 |
Source: author's scoring.
Evidence for each score is given in the platform narratives below and in Appendices A–C.
Indicators reflecting minimal, record-generating compliance: Disclosure (1), Methodological concurrence (1), Public availability (2). Meta meets its formal disclosure obligations on the statutory cycle: EY reached positive conclusions on terms and conditions and recommender transparency in both cycles (Ernst & Young LLP, 2024, pp. 49, 51; 2025, pp. 61–62). However, those obligations require disclosure of a recommender system's main parameters (Regulation (EU) 2022/2065, Art. 27(1)–(2)), not its optimisation objective. What Meta's systems are optimised for has surfaced reactively, through litigation discovery: internal documents record a decision to reduce advertising load for teenage users to "maximize long-term revenue growth" (In re Social Media Litigation, 2026, p. 21). The formal route to data is constrained, with the Commission preliminarily finding Meta in breach of its researcher data access obligations (European Commission, 2025a). Meta's audit reports and audit implementation reports are likewise published as Article 42(4) requires (Regulation (EU) 2022/2065, Art. 42(4); Ernst & Young LLP, 2024; 2025; Meta Platforms Ireland Limited, 2024; 2025), which satisfies a statutory obligation. On Methodological concurrence, the audit criteria for Article 20(4), which requires complaints to be handled in a timely manner, rest on a benchmark Meta set itself. EY describes such benchmarks as the "audited provider's developed supplemental criteria", comprising its "legal interpretation, operational benchmarks and definitions" (Ernst & Young LLP, 2025, p. 6). That benchmark changed between cycles. In Cycle 1, management defined "timely" as complaints "decisioned within 72 hours" (Ernst & Young LLP, 2024, p. 31); in Cycle 2, it was redefined as handling reviews "as quickly as reviewer resources allow", against an internal goal of seven days (Ernst & Young LLP, 2025, p. 34). The benchmark is therefore one Meta can, and did, revise at its own discretion, rather than an externally fixed requirement.
Indicators reflecting the absence of independent examination: Independent verification (0), Depth of verification (0). These two scores are of concern. They do not indicate that Meta was tested and found deficient. Rather, no independent verification occurred in either audited year in respect of the systemic risk obligations (Arts 34(1), 34(2), 35(1)). In both cycles, and in near-identical terms, EY stated that ongoing Commission investigations meant it could not obtain sufficient appropriate evidence and that it did "not express a conclusion" on these and eleven other sub-articles (Ernst & Young LLP, 2024, p. 2; 2025, pp. 3–4; see Table 3.2). Where EY did examine Meta's controls, it did so "not for the purpose of expressing an opinion on the effectiveness of the audited provider's internal control" (Ernst & Young LLP, 2024, p. 5; 2025, p. 5).
The relationship between the 2 and the two 0s. Considered in isolation, "findings proactively published on a fixed cycle" suggests good transparency practice. However, what is published on these obligations is that no conclusion was reached, rather than any substantive finding about the systems themselves. Publication also does not make the public the report's audience. The audit report is "intended solely for the information and use of" Meta, the Commission and the Digital Services Coordinator (Ernst & Young LLP, 2024, p. 3). From Cycle 2 it expressly excludes "users of the service" (Ernst & Young LLP, 2025, p. 4). This is EY's standard wording, also used in YouTube's report (Google Ireland Limited, 2025c, p. 5) and so a feature of the audit architecture rather than of Meta's conduct. Meta's documentary record is timely. Evidentiary content, on the obligations of greatest consequence, is minimal. The pattern is one of visible process and untested substance, (Arts 34(1), 34(2), 35(1)) recurring across both zero scores as the obligations where that gap is concentrated. Ultimately, because Independent verification and Depth of verification both score 0, Meta fails the Purpose index outright.
Disclosure (1). Cycle 1 findings (Articles 14(1), 14(2)) show algorithmic decision-making, human review and internal complaint-handling procedures documented nowhere in X's Terms and Conditions directly (FTI Consulting, 2024, pp. 66–67). The information exists but is dispersed across separately linked pages rather than stated at the point a user would need it (p. 13). X's Rules and Policies are treated inconsistently against its formal Terms of Service and users are not informed when they change (pp. 71, 73). Disclosure occurs, but reactively and diffusely rather than as a matter of routine, proactive practice resulting in a score of 1.
Independent verification (0). Articles 34(1), 34(2) and 35(1) were disclaimed in Cycle 2 (BDO LLP, 2025, p. 5). Under the disclaimer rule it scores 0, whatever a prior cycle found. It is nonetheless worth noting what Cycle 1 had found before the disclaimer took effect. FTI returned Positive with comments on 34(1), Negative on 34(2), No Conclusion on 34(3), and Negative on 35(1), where mitigation effectiveness was measured only by the volume of content that evaded proactive detection, with no other effectiveness measure in use (FTI Consulting, 2024, pp. 34–36). In Cycle 2, three of the four obligations were disclaimed outright. The fourth, 34(3), returned Positive, but on the strength of an assurance that supporting documents "will be preserved" and an inspection that the risk assessment itself had been retained (BDO LLP, 2025, p. 52).
Public availability (2). X's audit and implementation reports are published on the statutory cycle required under Article 42(4), proactively rather than on request. Nothing in the appendix evidence distinguishes X's case from Meta's or Google's on this narrow point.
Methodological concurrence (1). Article 20(4) requires internal complaint-handling to be applied in a timely, non-discriminatory, diligent and non-arbitrary manner. This is the DSA's standard, not X’s. The Cycle 1 finding is not that X substituted its own benchmark, as Meta did, but that FTI could not verify the DSA's existing standard was applied consistently. Complaints from high-profile accounts, when escalated, could not be confirmed as reviewed under the same criteria as standard accounts (FTI Consulting, 2024, pp. 142–143). The framework is externally set; whether it was met consistently across different classes of user remains unverified.
Depth of verification (0). In Cycle 2, BDO disclaimed 10 of X's sub-articles and, for a further 14 where no occurrences were reported, "only assessed the design of processes, systems and controls", performing no tests of implementation or operating effectiveness (BDO LLP, 2025, pp. 5–6). Of 75 conclusions, 24 therefore carry no operational verification. Cycle 1 had tested substantively: of FTI's 82 obligation-level conclusions, 9 were Negative and a further 29 Positive with comments or No Conclusion (FTI Consulting, 2024, pp. 20–44).
What the pattern shows. X's failure is broader than Meta's. Where Meta's two 0s concentrated on a fixed pair of obligations disclaimed identically across both cycles, X's two 0s sit on top of a documented collapse in scrutiny. A Cycle 1 that tested substantively found issues. This was followed by a Cycle 2 in which almost a third of the obligations discussed stopped being tested at all. Independent verification and Depth of verification both register 0 not for lack of checking, but because whatever checking occurred has now not been reported on. This is a more concerning trajectory of the two platforms, since it shows genuine oversight capacity being withdrawn rather than never having existed. Because Independent verification and Depth of verification both sit at 0, X fails the Purpose index outright. This is the same conclusion reached for Meta, though the underlying narrative here is one of erosion across cycles rather than a static, repeated gap.
Disclosure (1). In Cycle 1, Articles 14(5) and 14(6) both returned Positive with comments (Google Ireland Limited, 2024b, pp. 28, 30): the terms-and-conditions summary and translation obligations were tested and broadly met with recommendations only. Articles 39(1) and 39(2) (advertisement repository) similarly returned Positive with comments (Google Ireland Limited, 2024b, pp. 109, 111). In Cycle 2, Article 14(6) returned Negative: 24 of 33 in-scope terms were not published in all 24 official Member State languages (Google Ireland Limited, 2025c, pp. 26–27). YouTube represented that the most deficient term was published in all languages by 19 June 2025, which EY did not evaluate (Google Ireland Limited, 2025c, p. 27). The remaining 23 were still under assessment at the time of the implementation report (Google Ireland Limited, 2025a, p. 11). Disclosure occurs and is independently tested every cycle, but the pattern across both cycles is one of partial or delayed compliance rather than proactive disclosure, band 1.
Independent verification (2). In my coding of EY's obligation-level conclusions for YouTube (Appendix B), every applicable risk-assessment and mitigation sub-article received a conclusion in both cycles. Articles 34(1) and 34(2) returned Positive with comments in both cycles (Google Ireland Limited, 2024b, pp. 96, 98; 2025c, pp. 103, 106). Article 34(3) returned Positive in both (Google Ireland Limited, 2024b, p. 100; 2025c, p. 107). Article 35(1) returned Positive in Cycle 1 and Positive with comments in Cycle 2 (Google Ireland Limited, 2024b, p. 102; 2025c, p. 111). Articles 35(2) and 35(3) are not obligations on the provider and were marked not applicable (Google Ireland Limited, 2024a, p. 50; 2025a, p. 38). EY's own declaration confirms the result: in both reports, the section for obligations where "an audit conclusion could not be reached with a reasonable level of assurance" (Article 8(8) of the Delegated Regulation) reads "Not applicable" (Google Ireland Limited, 2024b, p. 137; 2025c, p. 178). No risk-assessment or mitigation obligation was therefore disclaimed or left without a conclusion in either cycle. This is the strongest record on this indicator of any platform in the study.
Methodological concurrence (1). EY declares that both engagements were conducted under ISAE 3000 (Revised) (Google Ireland Limited, 2024b, p. 6; 2025c, p. 6), as the Delegated Regulation's Annex I, Section B.5 requires. The procedural standard is named and external to YouTube. The substantive benchmarks are not. In both cycles EY states that "many of the obligations needed to be supplemented by the audited provider's own legal determination, operational benchmarks and/or definition of ambiguous terms" (Google Ireland Limited, 2024b, p. 10; 2025c, p. 172). The Article 24(5) finding, for example, is measured against YouTube's own "4-day operational benchmark" (Google Ireland Limited, 2024a, p. 24). This is the same language EY used auditing Facebook (Ernst & Young LLP, 2024, p. 11; 2025, p. 122). The same auditor applies the same caveat to both clients. A common procedural framework with provider-defined substantive benchmarks is band 1.
Depth of verification (1). The Articles tested, 14(6)'s translation completeness (Google Ireland Limited, 2025c, pp. 26–27), 24(1)'s transparency-report specificity (Google Ireland Limited, 2024b, p. 68; 2025c, p. 75), 22(1)'s trusted-flagger delay (Google Ireland Limited, 2025c, p. 60) are procedural and reporting-focused. As such, they are not obligations that reach the platform's ranking, weighting, or recommender logic. A tested, disclaimer-free examination, but of process rather than of the system's governing logic itself.
What the pattern shows. YouTube's Purpose record is the only one of the three with no indicator at 0. The strongest indicator, independent verification, contrasts with Meta's and X's weakest results, systemic risk assessment and mitigation, a reversal of the pattern on the other two platforms. The three 1s, Disclosure, Methodological concurrence, Depth of verification, show the record does not yet clear the top band on every indicator. YouTube's record shows disclaimer-free testing throughout, and a named procedural standard, though with provider-defined substantive benchmarks. However, the benchmarks against which compliance is measured remain YouTube's own.
Its Purpose score is 1. No indicator at 0, so YouTube does not fail the Purpose index outright, unlike Meta and X. This is the first index score, for any platform in this research, above the minimum.
Table 4.2. Petition (Justificatory Addressability): scores by platform
| Indicator | DSA Articles | Meta | X | YouTube |
|---|---|---|---|---|
| Existence of an external addressee for individual grievances | 11, 12, 37 | 1: Internal channel only; no certified external body | 1: Internal channel only; no certified external body | 1: Internal channel only; no certified external body |
| Enforceability of findings | 37(6), 42(4)(d) | 0: Advisory only | 0: Advisory only | 1: Must engage and report; not required to implement |
| Accessibility of the channel to an individual citizen | 16, 20, 21 | 0: Realistically usable only by well-resourced actors | 0: Realistically usable only by well-resourced actors | 1: Open to individuals; cost or procedural burden |
| Outcome reporting | 17, 24(5), 42(4)(c)–(d) | 0: Outcomes not reported | 2: Reported with enough granularity to assess function | 1: Aggregate statistics only |
| Index score | 0 | 0 | 1 |
Source: author's scoring.
Evidence for each score is given in the platform narratives below and in Appendices A–C.
The one indicator reflecting a functioning channel, existence of an external addressee. Article 12(1) establishes a single point of contact through which EU users can communicate directly with Meta. The Cycle 1 audit found this channel working, with one qualification: 1 of 25 sampled requests was not answered within Meta's own 7-day "rapid response" target, attributed to a volume spike (Ernst & Young LLP, 2024, p. 16). A channel exists and, on the evidence tested, functions. It falls short of the top band because it is a point of contact rather than the external, independently certified body the top band specifies.
The three indicators reflecting the absence of functional recourse: Enforceability (0), Accessibility (0), Outcome reporting (0). On Enforceability, Meta declined an auditor recommendation in Cycle 2. EY concluded that Meta complied with Article 14(2), with comments, and recommended that Meta assess whether changes to the webpages linked from its Terms of Service were significant enough to notify users (Ernst & Young LLP, 2025, p. 15). Meta replied that the recommendation would extend compliance "beyond the contours of Art. 14(2)", and that "no additional measures, over and above MPIL's existing measures, have been implemented" (Meta Platforms Ireland Limited, 2025, pp. 4–5). X made the same move on Article 25, arguing that its auditor's finding "goes beyond the requirements" of the Article (Twitter International Unlimited Company, 2024, p. 42). Nothing in the audit regime compels reconsideration: a provider may decline a recommendation provided it justifies its reasons (Regulation (EU) 2022/2065, Art. 37(6)). The regime is advisory by design.
On Accessibility, the evidence is mixed rather than absent. The 0 reflects a judgement on that mixed record rather than a default. Article 20(4) and 20(5) were tested and returned Positive with comments, the same finding already noted under Methodological concurrence, where two sampled appeals missed Meta's self-set 7-day timeliness target. Set against that finding is a much larger disclaimed cluster: Articles 16(1), 16(5), 16(6), 20(1) and 20(3), covering the notice-and-action and internal complaint-handling mechanisms, were disclaimed in both cycles (Ernst & Young LLP, 2024, p. 2; 2025, pp. 3–4; see Table 3.2). The tested evidence, on Article 20(4), indicates only how quickly Meta handled appeals that had already been successfully lodged, measured against Meta's own timeliness benchmark (Ernst & Young LLP, 2024, pp. 31–32; 2025, pp. 34–35). The disclaimed obligations cover an earlier question: whether the routes into that process, flagging content and lodging a complaint at all, are accessible to a genuine complainant in the first place. The indicator is scored on the obligations that define the channel, not the one obligation that happened to be tested, which is why the mixed record still returns 0.
On Outcome reporting, Article 17(1), the statement-of-reasons obligation, was disclaimed in both cycles. Article 17(3) was tested in Cycle 2 and returned Positive with comments: Meta's statements of reasons did not specify whether a decision followed a notice or automated detection, as Article 17(3)(b) requires (Ernst & Young LLP, 2025, p. 30). The score remains 0: the disclaimer rule applies to the obligation that defines the indicator, Article 17(1), whatever a narrower, adjacent obligation shows.
What the pattern shows. A working point of contact exists and is evidenced. Beyond that, the audit record either finds against Meta directly (Enforceability), finds only on a narrow procedural item while leaving the substantive mechanism untested (Accessibility), or is silent on the core obligation by disclaimer while returning a finding on an adjacent one (Outcome reporting). In each of the three failing indicators, some evidence exists; in none of them does it meet the obligation the indicator is testing.
Because Enforceability, Accessibility and Outcome reporting all sit at 0, Meta fails the Petition index outright. One functioning point of contact does not offset the absence of enforceability, of accessibility on the mechanisms that matter, or of outcome transparency on the core reporting obligation.
Existence of an external addressee (1). Articles 11(2) and 12(2) require X to make its points of contact for authorities and users easy to identify. In Cycle 1, FTI found the information publicly available but not easily accessible: a process-flow error in the Help interface meant the relevant form was reached only by clicking "Contact Us" twice (FTI Consulting, 2024, pp. 20, 53–54, 63). X reports having fixed the flow in August 2024 (Twitter International Unlimited Company, 2024, pp. 2–4).
Enforceability (0). Article 14(4), Cycle 1: FTI concluded Positive with comments (FTI Consulting, 2024, p. 21). Its detailed finding states that “insufficient evidence of objectivity was seen in enforcement of the Terms of Service”, attributing this to "accepted privileges for accounts with large followers or certain checkmarks" (FTI Consulting, 2024, p. 77). X did not simply decline the recommendation; it inverted the finding's premise. It argued that high-follower accounts require "prioritized moderation for effective risk mitigation" (Twitter International Unlimited Company, 2024, pp. 11–12).
Accessibility (0). In Cycle 1, FTI reached a Negative on Article 16(3): having confirmed content as illegal in one Member State, X does not assess whether it is illegal in others where it may be viewed (FTI Consulting, 2024, pp. 23, 99). Articles 20(1), 20(4) and 20(5) each returned Positive with comments: statements of reasons to advertisers did not identify the violation, escalated complaints from high-profile accounts could not be verified as reviewed under the same criteria and redress notices sometimes omitted out-of-court dispute settlement information (FTI Consulting, 2024, pp. 26–27). Article 16(6) reached No Conclusion in Cycle 1 and, with 16(5), was disclaimed in Cycle 2 (FTI Consulting, 2024, p. 24; BDO LLP, 2025, p. 5). Unlike Meta's record on this indicator, each of these tested obligations surfaced a deficiency rather than a narrow caveat.
Outcome reporting (2). Articles 17(1), 17(2) and 17(3) returned Positive with comments in Cycle 1: statements of reasons for advertisers did not identify the violation, advertisers were not consistently notified of monetisation restrictions from the date imposed and statements of reasons for pausing ads revenue sharing omitted redress information (FTI Consulting, 2024, pp. 24–25). In Cycle 2, all three returned Positive (BDO LLP, 2025, pp. 26–29). Deficiencies identified in Cycle 1 were retested a year later and found resolved: identification, followed by remediation and independent verification that the remediation held.
What the pattern shows. X's Petition record does not fail uniformly, attracting scores across the full 3 value range. A working point of contact exists, functioning despite a navigational defect. Outcome reporting shows the audit mechanism working as intended, an issue corrected, then independently confirmed as resolved. Set against that, Enforceability and Accessibility show a more troubling pattern: not absence of testing, as with Meta, but active contestation of a finding's legal meaning and a consistent run of tested obligations each returning a real deficiency rather than a caveat. Where Meta's failures came from obligations never reaching an opinion, X's come from obligations that were tested, opined on and either disputed or found wanting outright. Because Enforceability and Accessibility both sit at 0, X fails the Petition index outright. One functioning point of contact and one genuinely resolved obligation do not offset the absence of enforceability or of accessibility on the mechanisms that matter.
Existence of an external addressee (1). Articles 11 and 12, the points of contact for authorities and for users, returned Positive in both cycles (Google Ireland Limited, 2024b, pp. 17–22; 2025c, pp. 14–18). This is a stronger record than Meta's (a single missed 7-day target out of 25 sampled requests) or X's (a process-flow defect making the channel hard to reach). The auditor, EY, is itself an external party, appointed in both cycles (Google Ireland Limited, 2024a, p. 3; 2025a, p. 3). The indicator still scores at band 1 rather than 2: the top band specifically requires the external, independently certified body under Article 21, not a point of contact under Articles 11 and 12.
Enforceability (1). No declined recommendation appears in YouTube's implementation reports (Google Ireland Limited, 2024a, pp. 6–44; 2025a, pp. 8–28). Every finding is engaged with and most are remediated or in progress, though not all: on Article 16(1), YouTube is still "determining the extent to which remediation is necessary and appropriate" (Google Ireland Limited, 2025a, pp. 13–14). This is the strongest enforceability record of any platform in the study. Band 2 is structurally unreachable for platforms under the current DSA architecture: Article 37(6) obliges only that a recommendation be "taken due account of", never implemented. No mechanism exists to compel a fix regardless of platform conduct. YouTube's score of 1 therefore reflects the best available outcome under a ceiling the DSA itself imposes, not a shortfall in YouTube's own response. The democracy-relevant finding here is not about YouTube specifically: Meta's Article 14(2) shows what the same architecture permits when a platform chooses otherwise. Until a positive audit finding carries a direct enforcement consequence, every platform retains the fallback ability YouTube chose not to use.
Accessibility (1). Articles 16(1), 16(5), 16(6) and 20(1) were tested in both cycles, and none was disclaimed (Google Ireland Limited, 2024b, pp. 33, 38–39, 50; 2025c, pp. 31, 35, 37, 47). Article 21, not applicable in Cycle 1, returned Positive on 21(1), 21(2) and 21(5) in Cycle 2 (Google Ireland Limited, 2024a, p. 50; 2025c, pp. 55–58). YouTube's record is one of full testing. This is a fuller and more consistent testing record than either Meta (a disclaimed core cluster) or X (a run of comprehensive deficiencies). Each auditor finding is a narrow operational gap rather than an untested obligation or a systemic failure. In Cycle 2, the notice mechanism for allegedly illegal content was not operable on the desktop webpage for users without a YouTube channel, though those users could still report through the Help Centre webform (Article 16(1)) (Google Ireland Limited, 2025c, p. 31). In Cycle 1, YouTube did not retain evidence of when decisions on notices were made. In Cycle 2, YouTube represented that it had retained this from 27 March 2025, but EY did not obtain evidence of it (Articles 16(5) and 16(6)) (Google Ireland Limited, 2024b, pp. 38–39; 2025c, pp. 35, 37). Also in Cycle 2, a public-facing appeal policy stated that appeals could be filed up to 90 days after a warning or strike, when the system allowed six months (Article 20(1)) (Google Ireland Limited, 2025c, pp. 46–47).
Outcome reporting (1). Article 24(1) (transparency-report specificity on suspensions) returned Negative in both cycles for the same defect: suspensions for manifestly unfounded complaints were not reported per platform (Google Ireland Limited, 2024b, p. 68; 2025c, p. 75). The breakdown was missing again from the August 2024 Transparency Report and was supplied only in February 2025, nine months after the Cycle 1 examination period ended (Google Ireland Limited, 2025c, p. 75). Article 24(5) (statement-of-reasons submission timeliness) returned Negative in Cycle 1, with 14 percent of statements submitted late (Google Ireland Limited, 2024b, p. 73), and Positive in Cycle 2 (Google Ireland Limited, 2025c, p. 80). Article 17 (individual-level statements of reasons) returned Positive in both cycles (Google Ireland Limited, 2024b, pp. 41, 43; 2025c, pp. 39, 41). Both audit reports and both implementation reports are published, satisfying Article 42(4)(c)–(d) (Google Ireland Limited, 2024a; 2024b; 2025a; 2025c). A defect flagged, repeated in the next reporting period and corrected only late holds the indicator at band 1.
What the pattern shows. All indicators score 1. This is based on disclaimer-free testing, with a finding attached to each auditor judgement. The contact channel works but is not the certified adjudicatory body band 2 requires. Recommendations are acted on, but nothing makes a finding binding. Accessibility obligations are tested, but each reports an issue. Outcome reporting has a gap that recurred across both cycles before late correction. This is a different position from Meta, where obligations went untested altogether, and from X, where obligations were tested and either disputed or found deficient. YouTube's Petition record is one of consistent, moderate friction across every indicator, not extreme failure and not complete success either.
Table 4.3. Peer (Minimal Co-authorship): scores by platform
| Indicator | DSA Articles | Meta | X | YouTube |
|---|---|---|---|---|
| Permanent channel to contest the governing logic itself | 21 | 1: Narrow or conditional channel | 1: Narrow or conditional channel | 1: Narrow or conditional channel |
| Independence of any structural-input mechanism | 37(3); Delegated Reg. (EU) 2024/436, Annex I, B.4–B.5 | 1: Nominally external; funding or governance entanglement | 0: Controlled by the regulated entity | 1: Nominally external; funding or governance entanglement |
| Functioning access to system-level data | 40(12), 24(5), 37(4)(d), 38 | 0: No usable external access to system-level data | 0: No usable external access to system-level data | 1: Access exists but incomplete or unreliable |
| Index score | 0 | 0 | 1 |
Source: author's scoring.
Evidence for each score is given in the platform narratives below and in Appendices A–C.
Contesting channel (1). Article 21 establishes certified out-of-court dispute settlement bodies, and Meta's Cycle 2 audit found this positive, without comment, on 21(1), 21(2) and 21(5) (Ernst & Young LLP, 2025, pp. 40–42). It fails to achieve the top band because of what the mechanism actually reviews. Article 21 bodies rule on individual disputes, whether a specific decision should be overturned, not on the governing logic that produced the decision in the first place. A channel that exists and is tested still scores 1 rather than 2 if its scope is confined to outputs rather than the system that generated them. That is the case here. The space of reasons is limited.
Independence (1). The baseline is Article 37(3) and the Delegated Regulation's independence provisions (Annex I, Sections B.4–B.5). Meta's auditor, EY, is nominally external, a third-party firm, but is selected and paid by Meta itself, in both cycles. That is precisely the funding and governance entanglement band 1 describes: the mechanism is not internal to Meta, but it is not free of Meta's control over who performs the check either. It falls short of band 2, which requires the mechanism to be governed by parties other than the regulated entity.
System access (0). Primary Transparency Database evidence, drawn from Facebook's full July 2026 submissions (29,454,716 statements of reasons; see footnote 2), shows the decision_facts field taking only two values across the entire month: "This account was determined to violate terms of service" (20,628,316 statements) and "This content was determined to violate terms of service" (8,826,400). The same two sentences are used regardless of what was actually decided, across 13 statement categories, both decision grounds and every type of action, including 1,085,971 decisions categorised as negative effects on civic discourse or elections and 933 decisions grounded in illegal content. In a 1,000-row sample from 30 June 2026, the incompatible_content_ground field returned a single identical string, "This was a violation of "sections 3.2" of our terms of service". Whatever reasoning Meta's systems applied, the disclosed output cannot distinguish one case from another. The pattern is not unique to this research. Kaushal et al. (2024), analysing over 131 million statements of reasons submitted by all 16 VLOPs then reporting, between 19 and 28 November 2023 (including around 20 percent of Facebook's submissions to that date), found Facebook using the same two-template structure, then worded "terms of use" and the same single ground string (Kaushal et al., 2024, pp. 1122, 1127). The disclosure has therefore remained essentially unchanged for both audit cycles. Article 40(12), the route through which outside researchers would reach the underlying data, was disclaimed in both cycles (Ernst & Young LLP, 2024, p. 2; 2025, pp. 3–4; see Table 3.2). This evidence also bears directly on an obligation the audit left unverified: Facebook's submissions to the database under Article 24(5) were disclaimed in both cycles (Ernst & Young LLP, 2024, p. 2; 2025, pp. 3–4; see Table 3.2).
A second point of corroboration sits within the audit record itself. Article 38 requires VLOPs to offer at least one recommender option "not based on profiling" (Regulation (EU) 2022/2065, Art. 38), the DSA's only mechanism giving users a structural lever over the logic applied to them. In Cycle 1, EY reached a negative conclusion on this obligation because the option was missing from the Facebook Dating recommender system "between 29 August 2023 to 15 February 2024", roughly five and a half months of the examination period, until Meta implemented it on 15 February 2024 (Ernst & Young LLP, 2024, p. 58). Two separate channels of system access, one for disclosure and one for user control, both show the same gap.
What the pattern shows. A contesting channel and an independence mechanism both exist in some form. Neither is fabricated or absent, the audit record supports a limited version of each. What is missing is the one indicator that would let a genuine act of contestation happen: system-level access good enough to reconstruct or verify the governing logic itself. Without that, the channel and the nominally independent auditor both operate on Meta's own account of what happened, because no other account is available to check it against.
Because System access resolves 0, Meta fails the Peer index outright. A contesting channel and a genuinely external auditor do not amount to co-authorship if neither can be tested against the system's actual logic.
Contesting channel (1). In Cycle 1, FTI found 21(1), 21(2) and 21(5) Positive, but because no out-of-court dispute settlement bodies had yet been certified in Ireland, so there were "subsequently no requirements to satisfy" (FTI Consulting, 2024, pp. 27–28, 152). In Cycle 2, BDO found no occurrences and assessed only the design of the process, concluding Positive with comments (BDO LLP, 2025, pp. 6, 35–37). Across both cycles, X has never had this obligation operationally tested. The channel exists on paper in both years; whether it functions has not yet been established either way, which is what band 1 describes.
Independence (0). Like every DSA provider, X selects and pays its auditor. What moves X below band 1 is how that power was used. FTI's Cycle 1 audit reached Negative conclusions on interface design, the protection of minors and the systemic-risk obligations (FTI Consulting, 2024, pp. 33, 35–36, 191). For Cycle 2, X replaced FTI with BDO LLP, a member of the European Contact Group (Albert, 2025), which reached no conclusion on the systemic-risk obligations then under Commission proceedings (BDO LLP, 2025, p. 5). The professional standard changed with the firm, from ISACA's standards to ISAE 3000 (Revised) (FTI Consulting, 2024, pp. 10–11; BDO LLP, 2025, pp. 4, 72). Meta and YouTube hold the same power of selection but did not exercise it against an adverse audit; X did. That is control over the check, not merely entanglement with it.
System access (0). Primary Transparency Database evidence, drawn from X's full July 2026 submissions (379,888 statements of reasons, retrieved 3 September 2026; dataset X726.csv, see footnote 2 and Data), shows a similar pattern to Meta's at a smaller scale. The decision_facts field takes only 10 action-and-trigger combinations across the month, such as "Decision - action Suspend triggered by the system with no human intervention". The decision_ground field returns DECISION_GROUND_ILLEGAL_CONTENT for every statement, with none under the terms-of-service ground on which Meta relies almost exclusively. The illegal_content_legal_ground field shows more surface variety, 74 distinct values across the month, against Meta's single fixed string. But each value is a short internal policy code, such as PlatformManipulation, Cse or NsfwAdultContent, which names the category that applies rather than explaining the specific case. In all of the 379,888 statements, the illegal_content_explanation field repeats that code verbatim: the field meant to explain why content is illegal restates the category instead. Pasquale's description of credit 'reason codes' applies. Rather than explain what happened, they simply name a factor in the decision (Pasquale, 2015, p. 149). A wider menu of categories is still a menu of categories. Data that is schema-compliant but withholds case-specific content functions as a denial of access and is scored accordingly rather than given partial credit for the larger menu. Article 40(12), researcher data access, points the same way: tested Positive in Cycle 1 (FTI Consulting, 2024, p. 40), it was disclaimed in Cycle 2 (BDO LLP, 2025, p. 5) and, under the disclaimer rule, scores 0.
Contesting channel (1). Article 21 was Not Applicable in Cycle 1 (Google Ireland Limited, 2024a, p. 50) and tested for the first time in Cycle 2, returning Positive, no comments, on 21(1), 21(2) and 21(5) (Google Ireland Limited, 2025c, pp. 55–58). X's Cycle 1 finding was Positive because no certified dispute-settlement bodies yet existed in its jurisdiction to test against. YouTube's Cycle 2 finding, by contrast, is substantive: EY inspected the service's public-facing site and confirmed it links to the list of certified out-of-court dispute settlement bodies and their contact details, and that this information is "easily accessible… clear, and user friendly" (Google Ireland Limited, 2025c, p. 55). This is a tested mechanism, though what was tested is narrower than it appears. EY's positive conclusion on Article 21(2), the duty to engage in good faith, was measured against YouTube's own definition of good faith: maintaining a process to consider each dispute and respond to the body (Google Ireland Limited, 2025c, p. 56). Over a largely overlapping period, Appeals Centre Europe reported that YouTube had shared no content with it, and 13 of its 29 YouTube decisions were default decisions (Appeals Centre Europe, 2025, p. 48). The audit confirmed that a process exists. However, it did not establish that the process gives a dispute body what it needs to decide. The score is unaffected, since the indicator is already capped at 1 on scope, but the case shows the gaps the Depth of verification and Methodological concurrence indicators are built to register: a control confirmed to exist rather than shown to work, measured against a benchmark the platform wrote. It still caps at band 1 rather than 2, for the same structural reason as Meta and X: Article 21 bodies rule on individual disputes, not on the governing logic that produced the decision.
Independence (1). EY, the same auditor in both cycles, formally declares its engagement under ISAE 3000 (Revised) (Google Ireland Limited, 2024b, p. 6; 2025c, p. 6), as the Delegated Regulation's Annex I, Section B.5 requires. That declaration is auditor-attested rather than independently confirmed, and, as noted under Methodological concurrence, the standard is applied against benchmarks YouTube itself defines. EY is nominally external, but it was appointed by Google Ireland Limited in both cycles and the audit is conducted at the provider's "own expense" (Google Ireland Limited, 2025a, p. 3). This is the same funding-and-selection method that holds Meta at band 1. YouTube avoids X's additional problem, a change of firm and standard between cycles, but does not clear band 2, which requires governance by parties other than the regulated entity.
System access (1). Primary Transparency Database evidence, drawn from YouTube's full July 2026 submissions (4,582,544 statements of reasons, retrieved 3 September 2026; dataset YT726.csv, see footnote 2 and Data), shows decision_facts taking 359 distinct values of explanatory prose that distinguish violation types. In the incompatible_content_explanation field, 4,184,859 of YouTube's 4,582,544 July statements (91 percent) link to a specific policy page; almost all of these (4,148,118) link to Google's advertising policies. The richer explanation is therefore concentrated in advertising decisions, including all 20,375 statements categorised as negative effects on civic discourse or elections. The remaining 434,426 statements carry policy-level rather than case-level explanations, with three standard texts accounting for almost half of them. This is a substantially different pattern from Meta's fixed sentences or X's bare policy codes. It still falls short of band 2. The underlying data remains a grouped export by violation type, not an account of why this particular item was actioned over another matching the same template. A second area of evidence supports the same score: Article 40(12), researcher data access, returned Positive, no comments, in both cycles (Google Ireland Limited, 2024b, p. 117; 2025c, p. 132). YouTube is the only platform with a clean, consistently tested record on this obligation across the analysis. Its Peer score is 1, the same as for Purpose and Petition.
Meta's headline result. Purpose, Petition and Peer each floor at 0, through Independent verification and Depth of verification under Purpose, Enforceability, Accessibility and Outcome reporting under Petition, and System access under Peer. Because the headline Harm Index score is the minimum across all three indices, not their average, Meta's overall result is 0. This is not an averaging approach or a single weak indicator dragging down an otherwise adequate record. All three indices fail independently, on different obligations and for different reasons.
X's headline result. Purpose, Petition and Peer each resolve at 0 : through Independent verification and Depth of verification under Purpose, Enforceability and Accessibility under Petition and Independence and System access under Peer. The headline Harm Index score is the minimum across all three indices, the same headline figure as Meta, though reached through a different evidentiary path. Where Meta's failures concentrated on obligations that were never independently tested at all, X's failures are drawn substantially from obligations that were tested and found wanting: a disputed legal interpretation (Enforceability), a run of genuine accessibility deficiencies rather than a single caveat (Accessibility) and an auditor replaced after adverse findings (Independence). X also shows the one clean instance of the audit mechanism working as designed anywhere in either platform's record, Outcome reporting, a genuine failure in Cycle 1 independently verified as resolved in Cycle 2. As with Meta, any one of the three failing indices would have been sufficient on its own to produce this result; the minimum rule confirms a finding that holds under several different ways of reading the same record.
YouTube's headline Harm Index score is 1. Each of its three indices scores 1: no indicator falls to 0, but none clears the top band across a whole index. It is the first result across any platform in this study that moves from the lowest score.
Thirty-six scored indicators across three platforms, twelve indicators * three platforms, were drawn from primary audit reports, implementation reports and Transparency Database information for July 2026. This provides a set of data which combines third party auditors, platform responses, raw data and DSA Articles.
The result of the Harm Index model is aggregated as follows:
Table 4.4. Aggregated Results
| Table | Meta | X | YouTube |
|---|---|---|---|
| Purpose | 0 | 0 | 1 |
| Petition | 0 | 0 | 1 |
| Peer | 0 | 0 | 1 |
| Harm Index | 0 | 0 | 1 |
Two platforms output the minimum score the model can produce, Meta and X, with YouTube scoring 1. I have shown that the model has scope for variation, not just at the headline level (0, 0, 1) but within it. Across the thirty-six scored indicators, individual scores span the full 0–2 range. Where platforms score poorly or at the top range, this is driven by the evidence base.
How the two 0s are reached provides further evidence of where and how platforms do not achieve the goals of the DSA. Meta's failure is concentrated. The same Articles used in Independent verification and Depth of verification under Purpose and System access under Peer are disclaimed identically across both audit cycles. Nothing was independently tested on the platform's recommender logic and systemic risk in either audit year. X's failure is distributed differently. Articles were tested, and either actively disputed, Enforceability, via a competing legal reading of Article 14(4), or found repeatedly lacking, Accessibility, together with an auditor replaced after adverse findings, Independence. Meta's verification did not reach the target. X's verification functioned procedurally but was defeated substantively. The audit mechanism worked. FTI reached unfavourable findings: a Positive with comments on Article 14(4), qualified by 'insufficient evidence of objectivity' in enforcement (FTI Consulting, 2024, pp. 21, 77) and Negatives on the systemic-risk obligations, Articles 34(2) and 35(1) (FTI Consulting, 2024, pp. 35–36). How X reacted to this is the core problem. X did not accept or decline these findings, it supplied a competing legal reading of the obligation itself, arguing the very conduct FTI flagged was what the law required. On Article 26(2), X declined a recommendation to improve commercial-content detection, citing the auditor's own positive conclusion as its justification for not acting (Annabell, 2025). Where the findings were most problematic, on systemic risk, now under formal Commission proceedings (BDO LLP, 2025, p. 5), X replaced the auditor (Albert, 2025). In each instance, a finding was reached and X's response was not correction but reinterpretation, justification or discontinuation. Verification happened, surfacing non-compliance, but X's response neutralised the finding rather than acting on it. Meta and X achieve the same score through different routes. This is the model's evidence of two structurally distinct ways an accountability mechanism can fail. Similarly, YouTube provides a control case for the model. Each indicator in the three tables clears band 1 resulting in none scoring 0. Its Independent verification score is the strongest recorded for any platform on any indicator in my analysis. This is tested and disclaimer-free in both cycles. These are the systemic-risk Articles (34, 35) where Meta and X failed. YouTube's score of 1, rather than 2, illustrates that the model does not have an automatic-fail risk embedded. A pass is possible under the same rules that produced Meta's and X's 0s.
This pattern is not confined to the three platforms scored here. Two independent studies, each covering different obligations and different platforms, reach the same underlying conclusions. On Methodological concurrence specifically, the self-authored-benchmark problem this model identifies from what is present or absent in individual findings has been stated directly by an auditor. Auditing Facebook's recommender-system obligations under Articles 27 and 38, EY noted that many obligations required supplementing with the audited provider's own legal determination, benchmark or definition of terms (Chapman, 2025; see also Ernst & Young LLP, 2024, p. 11). EY's YouTube reports carry the same statement in both cycles: "many of the obligations needed to be supplemented by the audited provider's own legal determination, operational benchmarks and/or definition of ambiguous terms" (Google Ireland Limited, 2024b, p. 10; 2025c, p. 172). The same auditor applies the same caveat to different clients, so even a shared auditor does not produce a shared benchmark. EY also notes that "the professional standards applied prohibit the auditing organization from developing its own criteria" (Google Ireland Limited, 2025c, p. 172). The benchmarks are therefore authored by the platforms, not the auditors. This correlates with my findings and raises issues of comparability across platforms. Where each platform authors the benchmark it is audited against, consistency across platforms becomes even more difficult to achieve. On the problem of what an auditor's "compliant" verdict establishes, a comparative study of eight platforms' Article 26(2) audits, found all of them rated compliant despite inconsistency in audit methodology: no defined sample sizes in most reports, auditors using different procedures on the same obligation and at least one instance of an auditor's report omitting a disclosure feature the platform itself publicly advertises (Annabell, 2025). Uniform positive findings are achieved by inconsistent means. This raises an increased risk of legitimising the gap the DSA's audit mechanism is in place to close.
The above studies support the same methodological choice my model makes. An auditor's headline verdict, Positive, Positive with comments, compliant, is not treated as the final acceptance. The evidence underlying the audit is re-examined against my model's twelve indicators. Even with the audit process and the DSA being in its early stages, the emerging literature and my Harm Index find the same credibility gap in DSA audit practice.
Returning to my model's underlying claim, outlined in Sections 1 and 2. Democratic erosion via online platforms does not require force or acknowledged denial. It happens when the space of reasons in which citizens could contest a platform's exercise of power is structurally occupied. This is, within the scope of the DSA, exhibited under the formal appearance of accountability in the form of published audits, implementation reports and statements of reasons. I provide the evidence of where and how this can be located. Meta's and X's 0s are not demonstrations that erosion is occurring but demonstrations that the mechanism, DSA, built to verify whether harm is occurring did not, or could not operate on the Articles that work on the edge of democracy. These focus on systemic risk, recommender logic, researcher access to the platform's own account of its conduct. The disclaimer pattern, an auditor declining to reach any conclusion where an investigation is live, is not an abstract, governance-design flaw. It is one with a direct, measurable consequence. This is the reason Meta's Purpose score is 0 for the same two Articles, using the same commentary in consecutive years.
YouTube's 1 is equally important to my conclusions. This shows that the erosion my model detects is not an inherent property of internal platform governance, although this could feature, nor of the DSA's architecture. It is contingent, at least partially, on how a given platform's audit relationship is conducted. The same regulatory instrument and indicators concluded a different, better scoring result for a platform whose auditor tested the highest-stakes obligations, in both cycles, without disclaiming them. This supports the need for independent oversight of the audit process itself, with power to inspect individual source material. The gap identified in Meta's and X's records is not inevitable. Disclaimers need not be used as a default. Currently that is a choice left entirely to the audited platform and its chosen auditor. This is the disclaimer functioning as a risk. Not that it wrongly says a platform is compliant, but that it lets an auditor avoid ever having to say it is not.
Continue to Sections 5, 6 & 7 →
References, data and footnotes for the full paper are on the Eroding the Edge of Democracy page.