We know that the digital govtech sphere is constantly evolving and that, consequently, legislation must adapt to the pace of technological change in order to guarantee citizens' rights. In this regard, the European Commission has pushed for legislation to create safer, more transparent and fairer digital environments. However, it is often difficult for us to follow them and understand how these can affect our business or scope of work, and if you are a startup (or a public administration that wants to buy their services), it is especially relevant for you!  ‍We have selected three of the recent regulations that we consider most relevant for startups and government agencies working in govtech: the Digital Services Act (DSA), the Digital Markets Act (DMA) and the Artificial Intelligence Regulation (AI Act).

We have selected three of the recent regulations that we consider most relevant for startups and government agencies working in govtech: the Digital Services Act (DSA), the Digital Markets Act (DMA) and the Artificial Intelligence Regulation (AI Act).

As a brief introduction, the DSA and the DMA aim to create a safer digital space in which the fundamental rights of users are protected and to establish a level playing field for businesses (you can learn more about both here and here). Meanwhile, the AI Act, which is still in the process of final approval, seeks to regulate the uses of AI at the European level, to limit the risks arising from them.‍

As they are extensive and intricate laws, from Gobe we want to give a few brushstrokes of each one, focusing on its objective, who it is aimed at, how it affects startups and when it comes into force. Let's take a look at each one of them!

Digital Services Act

The Digital Services Act (DSA) seeks to provide a safer online experience for everyone. The DSA is part of a broader effort by the European Union to uniformly regulate digital services. Its focus is on transparency in online advertising, the fight against misinformation and the protection of users in the digital environment.

The text addresses a series of measures and obligations for technology companies. In particular, it establishes transparency requirements for digital platforms, requiring those that use online advertising to disclose their commercial practices. In addition, it addresses the responsibility of platforms in moderating illegal content, which can become a challenge for companies.

The Act also protects users' rights and data privacy, which may require a thorough review of privacy policies. Despite the challenges, the DSA establishes due diligence obligations for companies to achieve the proper functioning of the internal market for intermediation services, harmonizing rules to facilitate innovation and respect fundamental rights.

Who is affected?

The regulation will affect all companies acting as intermediaries between a user and a content or a person and a product/service. However, the levels of liability will be different depending on the services provided by the companies and the number of users they have.

These categories are 1) Intermediary services, 2) Data hosting, 3) Online platforms and search engines, 4) Online marketplaces (marketplaces) and 5) Very large online platforms and search engines (VLOPs or VLOSE - ≥ 45 million monthly active users in the EU). VLOPs/VLOSEs are designated by the European Commission and have specific due diligence obligations. Currently there are already 22 designations.

‍

How does it affect startups and when does it come into effect?

From February 2024, platforms must comply and adapt their systems and interfaces in accordance with the legislation (for VLOPs/VLOSEs this is true from August 2023). For startups, it is important to note that:

• The law applies to a wide range of digital services, including online platforms, search engines, social networks and cloud computing services. This implies that any startup operating on these platforms or using online advertising is subject to the provisions of the law.
• You must ensure transparency in all your digital operations, including algorithms, recommender systems, content moderation policies and terms of service. This is especially relevant for startups using digital advertising, where clarity in advertising strategies and business practices is crucial.
• The law establishes the need to implement effective measures to moderate and remove illegal or harmful content. As a startup, it is important that you have clear and effective protocols in place to comply with these legal obligations.
• Data protection and user rights need to be reinforced. You must ensure that you comply with data protection regulations, obtain appropriate consent and manage personal information responsibly.

For all this, you'll need to evaluate and/or adapt your business and management practices to comply with the law.

‍

Digital Markets Act

The DMA aims to ensure fair and open digital markets. Together with the DSA, it is part of what is known as the digital services package, a change in the European regulatory landscape that seeks to create a common framework on big tech.

This regulation seeks to improve the level playing field between services in the digital space through measures related to interoperability, transparency or data collection. For example, favoritism towards own services and products on digital platforms to the detriment of those of third parties (self-preference) is prohibited. In turn, explicit consent will be required for targeted advertising and freedom of choice of browser, search engine or virtual personal assistant is guaranteed.

Also, messaging services, such as Meta's WhatsApp and Facebook Messenger, or Apple's iMessage, will have to be interoperable with other smaller messaging platforms. Finally, the European Commission will closely monitor mergers and acquisitions to avoid business concentrations that reduce digital competition.

Who is affected?

The DMA applies only to companies that are considered gatekeepers. That is, those that have a strong influence within the EU market, that are considered a key service connecting companies with users and that have a stable position. Six gatekeepers have been designated: Alphabet (Google), Amazon, Apple, ByteDance (TikTok), Meta and Microsoft.

How does it affect startups and when does it come into force?

From March 2024, some large online platforms such as Amazon or Meta must already comply with the DMA. According to the regulation, this law will have an indirect impact on emerging technology companies, which will have new opportunities to compete and innovate in the online platform environment, without abusive conditions limiting your development. However, as with the DSA, it may pose challenges and costs for startups and SMEs, which will have to adapt and anticipate regulatory changes in the digital market.

‍

AI regulation

Much has been heard about the first Artificial Intelligence Regulation (AI Act), which seeks to create a common EU regulatory framework for AI. The Act has two clear objectives: to ensure that AI systems used in the EU and introduced into the European market are safe and respect the rights of citizens and to stimulate investment and innovation in the field of AI in Europe.‍

The Act will be part of an already existing regulatory framework covering various aspects of the digital economy in the EU along with the already explained DMA and DSA as well as the General Data Protection Regulation (GDPR), which has been in force since 2018.

‍

Who is affected?

The regulatory framework will apply to both public and private actors, inside and outside the EU, to the extent that the artificial intelligence system is introduced into the EU market or its use affects persons established in the EU. In other words, both suppliers, implementers, importers and distributors must ensure that the legislation is complied with. ‍

The proposed rule seeks to address specific risks created by AI applications by prohibiting unacceptable practices such as some types of biometric categorization, emotion recognition at work or in educational settings, social scoring, remote biometric identification in real time or in public access locations by law enforcement (with exceptions), etc.It also seeks to identify high-risk applications in these and other sectors. In turn, it focuses on establishing clear requirements for AI systems in these situations, defining obligations for those who implement and provide them, requiring conformity assessments before use or sale, enforcing compliance measures after market launch, and establishing governance structures at European and national levels.

‍

How does it affect startups and when does it come into force?

The Law was formally adopted by the European Parliament in March 2024 and is expected to be adopted by the Council in April 2024. Once published in the Official Journal of the EU, it will enter into force after 20 days, so work will begin on its implementation. Member States will have to designate competent national authorities to oversee its implementation in their jurisdictions, while the Commission must issue guidelines to help regulated actors interpret and apply a large number of provisions. To this end, one of the steps marked is the creation of a European Office for Artificial Intelligence, which is already underway. While it will be in force, the general rules on AI will apply from May 2025, and the obligations for high-risk systems between 2026 and 2027.

It is still too early to know the impact on startups, but especially those that are advanced in their development cycles and aim to create or use systems that can be categorized as "high risk" under the AI Act, should consider auditing their system and review whether they comply with the mandatory operational requirements.

Summary and final conclusions

To help you at the end of this article (which we know has been long!), we have prepared a table summarizing these three European laws.

We believe that this type of regulation can bring both opportunities and challenges to startups, European or not, but who want to sell their services in this territory. Therefore, we look for this to be an easy way to know them and thus, anticipate as much as possible to these legislative changes. Keep it #govtech!

‍

‍