On 2 July 2026 the second annual report on the systemic risks of very large online platforms and very large online search engines was published, adopted the previous day by the European Board for Digital Services pursuant to Article 35(2) of Regulation (EU) 2022/2065, the Digital Services Act (European Commission). The Commission’s press release highlighted its part on minors (European Commission), but the document devotes a section, 3.4.1, to gender-based violence (European Commission). On 26 January 2026 the Commission had opened formal proceedings against X to establish, among other things, whether the provider diligently assessed and mitigated the negative effects in relation to gender-based violence stemming from the integration of Grok into the platform (European Commission). We examine the regime that links these acts.
Risk assessment: gender-based violence as an autonomous category
Providers of very large online platforms and search engines “shall diligently identify, analyse and assess any systemic risks in the Union stemming from the design or functioning of their service and its related systems, including algorithmic systems, or from the use made of their services”, at least once every year and in any event prior to deploying functionalities that are likely to have a critical impact on the risks. Among the risks to be assessed, Article 34(1)(d) lists “any actual or foreseeable negative effects in relation to gender-based violence, the protection of public health and minors and serious negative consequences to the person’s physical and mental well-being” (EUR-Lex).
The adjective “serious” refers to the consequences for well-being, not to gender-based violence: for the latter any negative effect is relevant, while severity operates as a criterion of proportionality, because the assessment is carried out “taking into consideration their severity and probability”. The dissemination of illegal content is a distinct category, in point (a). In our view it follows that gender-based violence must be assessed even when the content conveying it is not unlawful, as in coordinated harassment or the use of features of the service to control a person. Recital 87 calls on providers, in particular those used primarily for the dissemination of pornographic content, to diligently meet their obligations in respect of illegal content constituting cyber violence, ensuring for victims of the non-consensual sharing of intimate or manipulated material the rapid processing of notices and removal without undue delay.
The Board’s second report: sources, limits and risk factors
Article 35(2) entrusts the Board, in cooperation with the Commission, with publishing “comprehensive reports, once a year” on the most prominent and recurrent systemic risks and on best practices for mitigation. The second report covers the period from 17 February 2025 to 16 February 2026 and is based on the published risk assessments of 23 platforms and 2 search engines, on the audit reports and on input from civil society and national authorities. It warns that it constitutes neither guidance for compliance nor an assessment of the compliance of providers, and that it does not present the measures described as best practices (European Commission).
For gender-based violence the services most concerned are social media and pornographic platforms. The risk factors identified are recommender systems driven by user engagement, which may amplify gender-based violence and misogynistic content; gaps in moderation, which prolong the presence of content online; generative artificial intelligence, which lowers the threshold for producing non-consensual synthetic images, including those obtained through nudification; features such as messaging or location-sharing, used to control victims, especially in domestic violence; and harassment coordinated by several actors or accounts. Women in politics are identified as a disproportionate target, with effects of self-censorship or leaving the platform. In the report gender-based violence is described as an effect of the design of services, not only of individual pieces of content.
A contribution from the German federation of women’s counselling centres observes that risk assessments often analyse abusive behaviour within the boundaries of the individual platform, whereas the centres see technologies being used to extend patterns of abuse already under way. The finding converges with what emerged from the research of the European Institute for Gender Equality (EIGE) that we presented with regard to online violence against girls: incidents do not remain confined to a single service.
Mitigation measures: the practices declared by providers
Article 35(1) requires “reasonable, proportionate and effective mitigation measures, tailored to the specific systemic risks identified”. For gender-based violence particularly relevant are the adaptation of content moderation, with the expeditious removal of notified content “in particular in respect of illegal hate speech or cyber violence” (point (c)), the adaptation of algorithmic systems (point (d)) and prominent markings for generated or manipulated content that falsely appears authentic (point (k)).
The report records, among the declared practices, hash matching tools to intercept material before it becomes searchable, channels through which affected persons report non-consensual material, specialised moderation queues and, for search engines, procedures for removing non-consensual intimate images and sexual deepfakes from search results. The list describes what providers declare they do, not what has proved effective. Commission guidelines on this risk, possible under paragraph 3, do not appear on the official pages we consulted.
The Grok proceedings: gender-based violence in a formal investigation
The Commission is examining whether X diligently assessed and mitigated the risks connected with Grok’s functionalities, including the dissemination of manipulated sexually explicit images, and whether it transmitted an ad hoc risk assessment before deploying them; the suspected infringements concern Articles 34, 35 and 42, and the opening of proceedings does not prejudge their outcome (European Commission). On the Commission’s supervision page, updated to 31 August 2026, the only subsequent act concerning X is the acceptance, on 15 July 2026, of the action plan on advertising transparency and data access, which follows the non-compliance decision of December 2025 and does not concern Grok (European Commission). The risk of gender-based violence is thus the subject of a formal investigation, no longer merely of description.
Should the Grok proceedings also close with a non-compliance decision, the enhanced supervision of Article 75 would follow, with an action plan, a commitment to an independent audit and an opinion of the Board: the scheme we described in observing that under the Digital Services Act a fine is a stage, not the finish line.
Independent audit and publication: the annual verification cycle
Article 37 requires providers to be subject, at their own expense and at least once a year, to independent audits of compliance with the obligations of Chapter III, which includes Articles 34 and 35. The audit opinion may be “positive”, “positive with comments” or “negative”; if it is not positive, the provider adopts an audit implementation report within one month. Delegated Regulation (EU) 2024/436 specifies the methodology: for Article 34 the auditor verifies, among other things, “whether and how the audited provider tested assumptions on risks with groups most impacted by the specific risks”; for Article 35 it assesses the reasonableness, proportionality and effectiveness of the measures, including by comparing how the risks were addressed before and after they were put in place. The information to be analysed includes, “where available, reports referred to in Article 35(2)” (EUR-Lex). The section of the Board’s report on gender-based violence thus becomes one of the elements that auditors must consider.
Article 42(4) requires the publication, within three months of receipt of each audit report, of the risk assessment, the mitigation measures, the audit report and the audit implementation report. According to the Commission’s questions and answers, the redactions permitted by paragraph 5 are exceptional, must be justified one by one, and confidentiality cannot be claimed for an entire report (European Commission). The same cycle will apply to the services designated on 31 August 2026, which we discussed in commenting on the designations of ChatGPT, Reddit and Roblox: their first assessment, due within four months of notification, will have to include gender-based violence.
Critical aspects: indicators, service boundaries and the national dimension
The first aspect concerns measurement: the section on gender-based violence gathers observations, not indicators. In our view without shared indicators the before-and-after comparison required of auditors remains dependent on the metrics chosen by the provider, and audit opinions are not comparable across services. For the protection of minors, the proposal for an EU KIDS Act regulation of 17 September 2026 (COM(2026) 681) requires very large online platforms to monitor, test and evaluate the effectiveness of the measures adopted, as part of the risk assessment under Article 34 (EUR-Lex): a logic which, as Nicola Fabiano observes, requires providers to demonstrate and not merely to declare (NicFab). For gender-based violence, in the texts we examined, there is no equivalent rule.
The second concerns scope. Article 34 relates the assessment to “their service”, and abuse that moves from one platform to another partly escapes individual assessments. We consider that the annual report, which reads all the assessments together, should explicitly account for this dimension.
The third concerns the national dimension. Article 35(2) requires risks to be presented broken down by Member State and for the Union as a whole, “as applicable”; in the section on gender-based violence we did not find this breakdown. Supervision of the obligations in Section 5 lies exclusively with the Commission (Article 56(2)), while the Italian Communications Regulatory Authority (AGCOM), the Digital Services Coordinator for Italy, is the authority to which users located in Italy may lodge a complaint (European Commission). Without data by Member State the national authority does not have a picture of the risk in its own territory.
Conclusions
For very large providers, gender-based violence is a mandatory item of the risk assessment, to be addressed beyond unlawful content as well, with measures whose effectiveness can be demonstrated; for auditing organisations, the Board’s second report is a document to be considered in the audit. It falls to the Commission to conclude the Grok proceedings; to the Board, in future editions, to break the data down by Member State and to account for common indicators. We consider that providers, including those recently designated, should document this risk with their own metrics in their next assessment, without waiting for dedicated guidelines.
Author: Valentina Grazia Sapuppo
