Systemic risk assessment

Article 34 requires designated providers to diligently identify, analyse and assess the systemic risks stemming from the design, functioning and use of their service in the Union. This is the obligation the entire asymmetric tier is built around: everything downstream — mitigation, audit, transparency — is measured against it.

Four headings are named in the article: the dissemination of illegal content; actual or foreseeable negative effects on fundamental rights; actual or foreseeable negative effects on civic discourse, electoral processes and public security; and actual or foreseeable negative effects in relation to gender-based violence, public health, minors, and serious negative consequences for a person’s physical and mental wellbeing.

The assessment must consider how the provider’s own design choices contribute — recommender systems, content moderation systems, terms and conditions, advertising systems and data practices are all named. This is not a threat report about bad actors; it is an assessment of the service as designed.

It runs at least annually, and in any case before deploying functionality likely to have a critical impact on the risks identified. That second trigger is what makes product launches a compliance event for designated services.