Digital Services Act, Article 37 (independent audit of very large online platforms and search engines)
Regulation (EU) 2022/2065, Article 37, supplemented by Commission Delegated Regulation (EU) 2024/436
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 25 August 2023.
An AI governance rule binding private bodies.
As of 15 September 2026.
What it requires
- If you are a Commission-designated very large online platform or very large online search engine, commission an independent audit, at your own expense and at least once a year, of your compliance with Chapter III's due diligence obligations, including the systemic-risk mitigation measures for generated and manipulated content, and with any codes of conduct or crisis protocols you have joined.
- Select an auditing organisation that is independent of you and free of conflicts of interest: it must not have supplied you non-audit services in the twelve months before or after the audit, must not have audited you for more than ten consecutive years, and must not be paid on a result-contingent basis.
- Cooperate with the auditing organisation: give it access to the data, premises, and personnel it needs, and do not hamper, unduly influence, or undermine the audit.
- Where the audit report's opinion is not positive, adopt an audit implementation report within one month describing the measures you took, or explaining why you did not and what you did instead.
- Transmit the audit report and the audit implementation report to your Digital Services Coordinator of establishment and the Commission without undue delay, and make them public, with confidential information removed where necessary, within three months of receiving the audit report.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Article 74(1): the Commission may fine a very large online platform or search engine up to 6% of its total worldwide annual turnover for a Section 5 systemic-risk infringement, which includes non-compliance with the Article 37 independent-audit duty, with no fixed sum stated. Article 52(3) sets the same 6% ceiling for a Member State's own civil penalty against a provider of intermediary services outside the Commission's exclusive jurisdiction.
- Rule
- Turnover pct only
- As of
- 15 September 2026
- Currency
- EUR
- Turnover percentage cap
- 6
Who enforces it
Enforcement body
The European Commission, which holds exclusive power to supervise and enforce this obligation for a designated very large online platform or search engine. Digital Services Coordinators of the Member States enforce the Regulation's other obligations for other providers of intermediary services.
What it reaches
Obligation class
Governance, Reporting
Who checks it
Audit expectation
periodic
Who audits it
Independent third party
Where the report goes
Filed with regulator, Published
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 37 requires a Commission-designated very large online platform or very large online search engine, one with 45,000,000 or more average monthly active recipients in the Union, to commission an independent audit, at its own expense and at least once a year, of its compliance with the whole of Chapter III's due diligence obligations, not only the AI-relevant systemic-risk mitigation measure for generated and manipulated content in Article 35(1)(k), and with any codes of conduct or crisis protocols it has undertaken.
Article 37 is not itself an AI-facing duty; it is the audit machinery that sits over a body of obligations that happens to include the AI-relevant ones.
The auditing organisation must be independent of the provider and free of conflicts of interest, must not have supplied non-audit services to the provider in the twelve months before or after the audit, must not have audited the same provider for more than ten consecutive years, and may not be paid on a result-contingent basis; Commission Delegated Regulation (EU) 2024/436 supplements Article 37 with procedural rules on selecting and cooperating with the auditor, scoping the audit period, and drawing up the audit report and audit implementation report on the Regulation's own templates.
The audit report must name the provider and the auditor, describe the elements audited and the methodology, summarise the findings, list third parties consulted, and reach an audit opinion of 'positive', 'positive with comments', or 'negative'; where the opinion is not positive, the provider must adopt, within one month, an audit implementation report describing the measures it took or its reasons for not taking them.
The provider must transmit both reports to its Digital Services Coordinator of establishment and the Commission without undue delay, and make them public, in a version stripped of confidential information where necessary, at the latest three months after receiving the audit report.
Article 37 sits, like Article 35, in Chapter III Section 5 (Articles 33 to 43), so Article 92's anticipated-application rule applies to it too: the obligation binds a designated very large online platform or search engine from four months after the Commission's notification of that designation, where that date precedes the Regulation's general application date of 17 February 2024.
The Commission's first designations took effect on 25 April 2023 for platforms including Facebook, Instagram, TikTok, and X, so the audit duty began applying to that cohort from 25 August 2023.
When LexLint raises it
aggregates_contentgenerates_contenthigh_risk_decisionsoperates_social_platformserves_minors