Together with the European Partnership for Democracy (EPD) under their Digital Democracy Watch initiative, the Civil Liberties Union for Europe (Liberties) published a joint paper evaluating the progress of the second set of DSA risk assessment and mitigation reports that came out in November of 2025. Following Liberties’ recommendations for improvement after the first set of reports was published in 2024, our latest paper looks at the progress made in the newly published second set. Comparing both sets of reports allows us to evaluate whether regulation and civil society feedback influenced these developments. However, we found no meaningful evolution in how online platforms and search engines describe and address threats to civic discourse and electoral processes.
What are these reports under the DSA?
The EU’s Digital Services Act (DSA), sometimes referred to as “the constitution of the internet”, requires Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOPSEs) to identify and mitigate risks to democracy caused by their services, such as threats to civic discourse and electoral processes. Large tech companies are then required to publish their risk assessment findings and take measures to mitigate risks in the future. Since 2024, reports on risks and mitigation strategies have been published annually.
Why are they so important?
The idea behind making these reports public is that it places the responsibility on tech companies to be accountable and transparent about their own design and the risk it poses to users. Moreover, it is supposed to provide information to civil society actors on how companies safeguard their platforms and dedicate their services towards this aim.
Change between reports is measured in four categories:
These are borrowed from the DSA and focus on the role of civic discourse and electoral processes. Categories assess:
1. How platforms reflect on the risks caused by their own structure/features
2. How detailed/encompassing the reports define civic discourse
3. How well independent actors can evaluate measures taken by platforms based on the information they provide
4. How transparent platforms are about how they engage with internal and external actors
For each of these, we made some key observations:
1. Platforms largely fail to reflect on the risks caused by their own structure. Instead, they continue to portray systemic risks as caused by external “bad” actors. According to this view, threats to civic discourse and electoral integrity on platforms are mainly caused by disinformation, foreign interference, etc. This suggests that the functioning of the platforms themselves is not problematic, but lays the blame solely on the behaviour of bad actors who misuse them. This narrative allows companies to avoid accountability, change little on their platform design and continue running their profit machines.
2. Civic discourse continues to be treated as relevant only when connected to elections. This restrictive notion limits the true meaning of civic discourse as a continuous and consistent pillar that upholds the functioning of our democracies, due to its role in protecting minority voices, facilitating pluralism, etc.
3. It remains difficult for external actors (like Liberties) to verify the effectiveness of the measures taken by platforms to minimise risks. Indicators that could be used to do this have still not yet been made available by operators. Particularly, the functioning of platforms’ recommender systems (algorithms) is very hard to assess for outside actors.
4. Platforms remain very intransparent over who they, internally and externally, consult for improvements. Neither have they demonstrated that teams working on such risks are sufficiently resourced to tackle these challenges. While they do mention that stakeholders have been engaged, how or whether the outcome of this engagement affects measures taken is not stated.
To sum up, our findings showcase that companies see these reports more as a box-ticking exercise under the law, rather than a genuine opportunity to improve their platforms by identifying risks. The EU’s current and unchanged strategy, therefore, risks allowing platforms to continue down this path of bare minimum accountability, rather than incentivising them to redesign their platform based on a sincere commitment to democratic ideals.
We therefore ask…
…platforms to consider the risks posed by their design features, to adopt a more inclusive definition of civic discourse and to openly publish useful indicators to allow external actors to verify measures taken.
…the European Commission to be clear and explicit about its methodological expectations and make more use of its supervisory function.
…the European Board for Digital Services to stress clear normative expectations, be explicit about risks caused by platforms’ structure in future reports and guide platforms towards good stakeholder engagement.
If future reports fail to include measurable transparency and allow for independent evaluation, the systematic risk framework intended by the DSA will not be able to account for the protection against democratic risks.
