What the new rules ask of practitioners

Trust & Safety teams protect people from harm online, and they write a lot of rules to do it. In the last few years, governments started writing rules for them. The big ones are the EU's Digital Services Act (the DSA) and the UK's Online Safety Act (the OSA), and other countries have passed laws that look a lot like them.

First, the fine print: this isn't legal advice. Which laws apply to your platform, and by when, is a question for its lawyers. This guide is about what those laws change in the daily work. The names differ from country to country, but they keep asking for the same five things.

The five asks, and what they mean on a normal Tuesday

• Reasons for decisions. When you remove something, you tell the user which rule it broke and why. Your notes on each decision become the source for that message.
• Appeals that work. When a user says "you got this wrong", someone new looks at it, on time, and what they learn goes back into the rules.
• Transparency reports. These are public reports that count what the team did, sorted into categories. What you write down today is all next year's report can say.
• Risk assessment. A written look at how your product can hurt people, built from what your team already knows.
• Reporting that works. Reports from users, trusted outside groups and governments each get tracked to an answer, against a deadline.

Your notes become the product

All five share one idea: work that used to stay inside the company can now be checked by outsiders. The law didn't change what a good decision looks like. It changed who gets to read it.

Good habits like quoting the rule, explaining your reasoning and keeping a record someone else could follow used to be a point of pride. Now they're how you show you followed the law. It's easy to explain a decision from a good note. It's impossible to do it honestly from a note that just says "removed, violates guidelines". Teams that wrote good notes all along find out they were ready early. Teams that didn't find out why the laws got written.

There's an upside

It isn't all extra paperwork. The same laws help safety teams get things they already wanted. The risk assessment is a required, regularly scheduled chance to argue for more staff. Appeals data tells you which rules confuse people, which team leads used to beg for. The public reports force everyone to agree on what to measure.

And when a regulator asks for proof that the process was followed, the team with good records suddenly becomes very popular in budget meetings.

Keeping your footing

• Ask your legal team which rules actually apply to your platform, then write the answer down where the whole team can see it. Following rumors is how a team overdoes one rule and misses another.
• When a new rule arrives, ask what it changes about the records you keep. That's usually the real work.
• Send "which category does this go in?" questions to the people who write the rules, so it gets decided once instead of guessed a hundred different ways by a hundred reviewers.
• Treat deadlines for reports and appeals like any other goal you measure, except this one has a legal minimum.
• Put a date on anything you read about these laws. Official guidance changes, and how it's enforced changes faster. Last year's answer is a guess.