EU AI Act vs Digital Services Act: Which Applies?

The EU AI Act and the Digital Services Act (DSA) are separate regulations, and for a given AI service, both can apply simultaneously—but they govern different aspects. The AI Act regulates the AI system itself (its risk level, transparency, and data governance), while the DSA regulates the platform or intermediary that hosts or distributes the service (its content moderation, user safety, and due diligence obligations).

Formula

The calculator estimates the number of compliance obligation areas based on your AI service’s risk level under the AI Act and its intermediary type under the DSA. It uses simple mappings:

• AI Act risk level (t): 1 = Minimal (no obligations), 2 = Limited (transparency), 3 = High (full requirements), 4 = Unacceptable (prohibited). Formula: max(0, t - 1) gives 0, 1, 2, or 3 obligation areas.
• DSA intermediary type (d): 1 = Hosting (basic), 2 = Online platform (additional), 3 = VLOP/VLOSE (extra systemic risk duties). Formula: max(0, d - 1) gives 0, 1, or 2 areas.
• Total: sum of both, representing the combined regulatory areas you must address.

This is a simplified model—the actual obligations are detailed and not strictly countable as “areas,� but the calculator helps visualize the layering.

Worked Example

Using the defaults: t = 2 (Limited AI risk) and d = 2 (Online platform).

1. AI Act obligations: max(0, 2 – 1) = 1 (transparency duties)
2. DSA obligations: max(0, 2 – 1) = 1 (platform due diligence)
3. Total = 1 + 1 = 2 compliance areas

The result shows that a limited-risk AI on an online platform faces two distinct sets of obligations.

Background: Two Laws, Two Purposes

The EU AI Act (Regulation (EU) 2024/1689) is the world’s first comprehensive AI law, adopted in 2024, with phased application starting in 2025. It classifies AI systems by risk: unacceptable (prohibited), high, limited, and minimal. High-risk systems face strict data quality, transparency, human oversight, and conformity assessment requirements.

The Digital Services Act (Regulation (EU) 2022/2065) came into force in 2022 and applies to all online intermediaries, from cloud providers to social media platforms. It imposes transparency, accountability, and content moderation duties, with extra obligations for “very large online platforms� (over 45 million monthly users in the EU).

Neither law was written with the other in mind, but they overlap in practice: an AI chatbot on a social media platform is both an AI system and a platform feature.

How They Overlap and Interact

For an AI service, the two laws operate on different layers:

• AI Act looks at the model’s development, training data, and intended purpose. For example, an AI resume-screening tool is high-risk and must meet data governance and auditing standards.
• DSA looks at the service’s distribution and user interaction. If the same tool runs on a platform, the platform must comply with DSA notice-and-action, transparency reporting, and risk mitigation.

Compliance is not either/or. A company offering an AI service must assess both regulations. The AI Act’s risk classification determines AI-specific duties; the DSA’s intermediary type determines platform duties. They can conflict—for instance, the AI Act may require withholding certain content to prevent bias, while the DSA mandates freedom of expression. In practice, the AI Act includes provisions that defer to the DSA on intermediary liability.

How to Determine Which Rules Apply

Follow these steps to map your service:

1. Identify if you are an AI provider or deployer under the AI Act. Providers (developers) face the most duties; deployers (users) have fewer but still must use systems lawfully.
2. Classify your AI system’s risk using Annexes I and III of the AI Act. High-risk includes critical infrastructure, education, employment, and law enforcement. If it’s not high-risk, it’s limited or minimal.
3. Determine your intermediary role under the DSA: mere conduit, caching, hosting, online platform, or very large platform. Hosts that merely store data have fewer duties than platforms that moderate content.
4. Check for overlap: If you are a platform using AI to moderate content, both laws apply. The DSA requires transparency about content moderation, while the AI Act requires transparency about AI use.
5. Consult a legal professional for definitive compliance—this article is informational only.

Common Problems and Misconceptions

A frequent misconception is that the AI Act “covers� everything AI-related, so the DSA is irrelevant. That is false: the DSA applies to any online intermediary, regardless of AI. Another misconception is that the AI Act only affects large tech companies—in fact, it applies to any provider selling into the EU, including startups.

Another problem is the timing. The AI Act’s prohibitions on unacceptable risk apply from February 2025, but high-risk obligations phase in through 2026 and 2027. The DSA’s obligations applied from February 2024 for large platforms and from February 2024 for all others. Companies often miss that they must comply with the DSA now, even if their AI Act obligations are not yet due.

Also, the AI Act’s definition of “AI system� is broad, covering machine learning, logic-based, and statistical models. A simple rules-based chatbot might fall outside, but a generative model clearly falls inside. The DSA’s definitions are equally broad, so even a small forum with AI features is covered.

Practical Compliance Tips

To manage both regulations efficiently:

• Inventory your AI systems and classify each by risk level. Document your reasoning.
• Map your user-facing features to DSA categories. If you moderate content, you are a platform.
• Implement a compliance calendar because the AI Act’s deadlines vary by risk level.
• Keep transparency records—both laws require logging and reporting, but the specifics differ.
• Design for interoperability—for example, an AI system that flags illegal content must satisfy both the DSA’s notice-and-action and the AI Act’s human oversight.

Frequently Asked Questions

Does the AI Act replace the DSA for AI services?

No. The AI Act and DSA are complementary. The AI Act regulates the AI system itself, while the DSA regulates the platform or intermediary. Both apply simultaneously, and you must comply with both.

If my AI service is open-source, do I still need to comply?

Yes, but with some exemptions. The AI Act exempts open-source models from certain transparency duties, but not from high-risk obligations. The DSA applies to any intermediary, regardless of open-source nature.

What are the penalties for non-compliance?

The AI Act sets fines up to 7% of global annual turnover for prohibited practices, 3% for other violations. The DSA fines up to 6% of global turnover. These are separate, so you could face both.

How does the AI Act define “high-risk� AI?

High-risk includes AI used in critical infrastructure, education, employment, essential services, law enforcement, and migration. The full list is in Annex III of the AI Act, with criteria for exclusion.

Is my AI chatbot on a website a “platform� under the DSA?

If the website merely hosts the chatbot and does not moderate user content, it is likely a hosting service, not a platform. But if users interact with each other or post content, it may become a platform.

When do I need to start complying?

The DSA has applied since February 2024 for all intermediaries. The AI Act’s prohibitions apply from February 2, 2025; high-risk obligations from August 2, 2026, and then 2027 for certain products. Start now to avoid gaps.

Related

• Does iCUE Need to Stay Open? What Works Without It
• Telnet vs SSH: Key Differences Explained
• EaseUS Disk Copy vs Clonezilla: Which to Use?

in t | AI Act risk level | 1=Minimal, 2=Limited, 3=High, 4=Unacceptable | 2 | 1 | 4
in d | DSA intermediary type | 1=Hosting, 2=Online platform, 3=VLOP/VLOSE | 2 | 1 | 3
out compliance | AI Act obligations (0-4) | - | max(0, t - 1) | 0
out dsa_oblig | DSA obligations (0-3) | - | max(0, d - 1) | 0
out total | Total compliance areas | - | compliance + dsa_oblig | 0