The DSA's Recommender System Transparency Rules and AI

Regulation (EU) 2022/2065 imposes a transparency duty on ranking systems that predates most of the current generation of models and is written to survive them. The duty is narrower than it is usually described, and the part that is usually described — a switch to turn off personalised ranking — is in a different article that binds a much smaller set of companies.

What counts as a recommender system

The Digital Services Act entered into force on 16 November 2022 and has applied in full since 17 February 2024, with the designated very large platforms and search engines carrying their additional obligations from late August 2023. The definition that decides whether these rules touch your product is Article 3(s): a recommender system is a fully or partially automated system used by an online platform to suggest in its online interface specific information to recipients of the service or to prioritise that information, including as a result of a search initiated by the recipient or otherwise determining the relative order or prominence of information displayed. The text is at EUR-Lex.

Three things follow from that wording and each of them surprises somebody. First, it is technology-neutral: a hand-written relevance score, a gradient-boosted ranker and an LLM asked to order a list are all the same thing to the Regulation, and there is no machine-learning threshold to fall under. Second, “partially automated” catches hybrid systems where an editor curates a pool and software orders it. Third, search results are explicitly included, so a platform that reasoned it has no feed and therefore no recommender has usually reasoned wrongly.

What Article 27 requires you to publish

Article 27(1) requires providers of online platforms that use recommender systems to set out in their terms and conditions, in plain and intelligible language, the main parameters used in those systems, as well as any options for the recipient to modify or influence those main parameters. Article 27(2) says what “main parameters” has to cover: the explanation must make clear why certain information is suggested, and must include at least the criteria which are most significant in determining the information suggested, and the reasons for the relative importance of those parameters. Article 27(3) adds that where several options are available, the platform must provide a functionality allowing the recipient to select and modify their preferred option at any time, directly and easily accessible from the part of the interface where the information is being prioritised.

Notice what Article 27 does not require. It does not require you to publish the model, the weights, the feature list, the training data or the source code, and Recital 70 and the Regulation’s general approach are consistent with protecting that. It does not require per-item explanations of why one particular post appeared. And it does not, by itself, require any option at all — Article 27(3) is conditional on options already being available. A platform with a single ranking mode owes an explanation of that mode, not a new setting. That conditional structure is the most commonly misread sentence in the article.

The scope limit is Article 19: Section 3 of Chapter III, which contains Article 27, does not apply to providers of online platforms that qualify as micro or small enterprises under Recommendation 2003/361/EC — with the important carve-back that the exemption falls away for a platform designated as a very large online platform. A small platform with a personalised feed is genuinely out of Article 27, which is a rarer outcome under EU digital law than people expect.

The non-profiling option is Article 38

The requirement everyone remembers — that a user can see a feed that is not personalised — is Article 38, not Article 27, and it binds only providers of very large online platforms and very large online search engines. Article 38 requires them to provide at least one option for each of their recommender systems that is not based on profiling within the meaning of Article 4(4) of Regulation (EU) 2016/679. That cross-reference does real work: profiling under GDPR Article 4(4) is automated processing of personal data to evaluate personal aspects of a natural person — the same definition that drives the right to object to profiling — so a ranking based on the content’s own popularity or recency, with no evaluation of the individual, is not profiling and can serve as the compliant option.

If you run a platform below the VLOP designation threshold, you owe the Article 27 explanation and you do not owe the Article 38 option. If you are designated, you owe both, and Article 27(3) then has something to bite on because an option now exists. Getting this the wrong way round in either direction is expensive: a mid-sized platform that builds a chronological toggle it never needed has wasted a quarter, and a designated platform that thinks Article 27 discharged its Article 38 duty has a supervisory problem with the Commission.

Article 34 and Article 35 sit above both. Designated services must assess systemic risks stemming from the design of their recommender systems, among other things, and Article 35(1) lists adapting the design of recommender systems among the mitigation measures they may take. That is a substantive obligation about what the system does, not about what you say about it, and it is the provision under which ranking design becomes a regulatory question rather than a product one.

Where generative ranking complicates it

Article 27(2) asks for the criteria most significant in determining the information suggested and the reasons for their relative importance. That question has a clean answer for a scored ranker with named features and a much less clean one for a system where a language model is asked to select or order items given a user profile in its context. There is no feature vector to enumerate and no learned weight to report; the “parameters” are a prompt, a retrieval step and a model.

It is not settled how Article 27 applies to that architecture. The defensible reading is that the obligation is functional rather than architectural: describe what the system is actually optimising for and what inputs about the user drive it — recent interactions, declared interests, language, location, engagement signals, paid placement — in language a user understands, whether those inputs reach the model as features or as text in a prompt. A disclosure that says “an AI model selects the posts” is not a statement of main parameters and would be hard to defend under Article 27(2). What would settle the question is Commission enforcement practice against a designated service, or guidance; neither has produced a definitive line on generative ranking.

Two neighbouring rules commonly get pulled in and should not be confused with this one. Article 26(3) prohibits presenting advertising based on profiling using the special categories of personal data in GDPR Article 9(1), and Article 28(2) prohibits profiling-based advertising to recipients the platform knows with reasonable certainty to be minors. Those are advertising rules. The AI Act’s own transparency duties are a third, separate layer, and a recommender is generally not a high-risk AI system under that Regulation’s Annex III.

Who enforces this and against whom

Supervision is split. The Commission has exclusive powers over designated very large platforms and search engines for the additional obligations in Section 5, and shares competence otherwise; every other provider answers to the Digital Services Coordinator of its member state of establishment, or of the member state where its legal representative is designated if it is not established in the Union. Article 74 sets the maximum fine at 6% of the provider’s total worldwide annual turnover in the preceding financial year, with a separate lower ceiling for supplying incorrect, incomplete or misleading information.

For a company building on this ground, the practical order of work is unglamorous. Inventory every surface that determines relative order or prominence, including search and including anything an internal team calls “the algorithm” informally. For each, write down what it optimises and what user-derived inputs it uses. Then check the two separate questions in order: does Article 19 exempt you, and are you designated. The answer to those two decides whether you are writing one paragraph of terms and conditions or building a product surface.