Digital services providers—Commission to focus on implementation phase of EU consumer protection legislation

The Digital Services Act (DSA) and the Digital Markets Act (DMA) are published in the Official Journal and the plenary vote of the European Parliament on the proposed text of the AI Act is expected once amendments are agreed by negotiators. The Commission is now turning its focus to the implementation phase of these landmark regimes. So, what does the future hold for the European tech sector and how might it differ for the UK?

Background

The main aim of the DSA is to implement a new framework of obligations applying to all digital services to keep users safe from illegal goods, content or services, and to protect their fundamental rights online. The DMA codifies many elements of prior competition enforcement cases taken by the Commission and seeks to target certain behaviours of platforms acting as 'digital gatekeepers' to the single market. See our earlier posts on the DMA and the DSA for practical pointers and key takeaways on these regulations.  

The Commission’s proposals for an EU Artificial Intelligence Act (AI Act) were published in April 2021 as a response to a request for the Commission to establish a comprehensive and future-proof European legal framework of ethical principles for the development, deployment and use of AI, robotics and related technologies. The Commission is proposing to adopt a technology-neutral definition of AI systems into EU law as well as rules based on a level of risk approach.  The levels of risk are: unacceptable risk, high-risk, limited risk and minimal risk, with harmful uses of AI such as social scoring by governments deemed as unacceptably risky and therefore banned. 

The development – a focus now on implementation  

The Autumn 2022 Consumer protection in the digital age speech of Margrethe Vestager, Executive Vice President and Commissioner in charge of competition policy, covers many bases. EVP Vestager has acknowledged that while the Commission has been active on cases against large digital platforms for years using traditional antitrust enforcement tools, 'new times call for new measures'. There is to be a focus now on implementation which the Commission plans to make as transparent as possible and there's appetite to take on board third party views on compliance solutions proposed by large digital platforms.  In this respect, EVP Vestager states that they are 'thinking about the most efficient way to do so as early as possible in the process, including by organising dedicated technical workshops'.

As 'the most far-reaching digital consumer protection law the world has ever seen' the DSA is being positioned as a gold standard for regulation worldwide, while EVP Vestager calls the AI Act the 'first of its kind' to be complemented with updated liability rules for the digital age.  The aim is to make it easier for consumers to claim compensation for damages caused by such systems.

There have been some resourcing concerns voiced by key stakeholders in the EU, with Ursula Pachl of the European Consumer Organisation commenting that the DSA must not become a 'paper tiger' and that the Commission and member states must 'allocate sufficient resources to monitor that companies are meeting their obligations and effectively enforce the law without hesitation.' Other EU consumer associations have also voiced concerns about the availability to the Commission of sufficient human and technical resources, including IT tools and digital specialist expertise to enable enforcement of the proposal digital legislation. In October 2022, the Commission provided an amending letter to its draft Annual 2023 budget to request an adjustment to cover the recruitment of additional staff to carry out preparatory work on the DSA. While no similar request was made for the DMA, EU competition officials have indicated that enforcement teams are currently being assembled and that work has started on drafting guidelines. 

Next steps

The DMA was published in the Official Journal of the EU on 12 October 2022 and is in force from 1 November 2022. Most of its provisions apply from 2 May 2023. After that, within two months and at the latest by 3 July 2023, potential gatekeepers will have to notify their core platform services to the Commission if they meet the thresholds established by the DMA. Once the Commission has received the complete notification, it will have 45 working days to make an assessment as to whether the undertaking in question meets the thresholds and to designate them as gatekeepers (for the latest possible submission, this would be by 6 September 2023). Following their designation, gatekeepers will have six months to comply with the requirements in the DMA, at the latest by 6 March 2024. With so much to achieve in such a short period of time, the Commission plans to start reaching out to the Tech sector via a series of workshops in the coming weeks, rather than months. The first of those workshops will take place on 5 December 2022 and will focus on the self-preferencing provision.

Having been published in the Official Journal on 27 October 2022, the DSA is in force from 16 November 2022 with implementing regulation planned before the year ends. It will apply from 17 February 2024 with certain provisions applying from 16 November 2022. As regards the obligations for very large online platforms (VLOPs) and very large online search engines (VLOSEs), the DSA will apply earlier—from four months after they have been designated as such by the Commission, even where this is earlier than 17 February 2024.

The draft text is undergoing final amendments with the plenary vote of the European Parliament on the proposed text of the AI Act expected to take place potentially as early as November 2022, but this might slip into the new year.

Any practical tips

The pace of implementation is quickening, and consumers, businesses and platforms affected by these EU regulations will be firming up their plans to educate themselves in more detail about what the changes will mean for them specifically.   For businesses and platforms this may require changes to their systems and practices.  

At the same time, they are likely to be monitoring closely the resource the Commission does allocate to producing implementing guidance and to enforcing the regulations. If the regulations do become 'paper tigers' as a result of limited enforcement, then their lack of 'bite' is likely to result in a lukewarm reception from proponents of the new regimes. A more proportionate and measured approach may, however, be welcomed by platforms and many within the Tech sector.

The UK forging its own path 

For its part, the UK Government has committed to a pro-innovation solution to regulate AI in its National AI Strategy. Over the summer, the Department for Culture, Media and Sports (DCMS) issued its consultation on its approach for regulating AI.

In echoes of the more flexible, risk-based and targeted regulatory proposals that were put forward for the pro-competition regime in digital markets (to be overseen by the new Digital Markets Unit), the CMA responded to DCMS' consultation last month. While it recognised the opportunities of AI, the CMA did raise concerns including that algorithms could enable self-preferencing or discriminatory personalised pricing. 
  
Overall, we are seeing a greater willingness in the UK to embrace a more agile and flexible regulatory regime than following a more codified European model. A lighter touch regulatory approach in innovative markets is seen by many as enabling the law to keep pace with rapid technological advances. 

The traditional enforcement model (with its underlying deterrence function) may simply be out-dated and ill-equipped to help derive pro-competitive solutions fast enough to allow innovation to flourish in more open and competitive markets. With novel issues in dynamic tech markets, it is arguably quicker and more efficient for digital companies to be able to road-test the efficacy of measures - working alongside regulators - rather than be faced with traditional deterrent tools which may inadvertently lead to a 'chilling' effect on innovation incentives. 

Given unprecedented political turbulence in the UK over the last few weeks, when – or even if – the CMA's DMU (currently only in 'shadow form') will be given its formal statutory powers is still uncertain while the legislative agenda remains paused. 

However, the UK is seeming to favour a more principles-based and context-specific approach with tightly targeted interventions prioritising harmful practices. Whether its chosen digital regulatory outcomes will match the EU counterparts is yet to be seen.