In short. A host must promptly notify the relevant authorities when information gives rise to suspicion of a criminal offence involving a threat to life or safety.
Definition: A hosting service stores information supplied by a user at that user's request. Under Article 18 of the Digital Services Act (DSA), it must promptly notify the relevant law enforcement or judicial authorities when it becomes aware of information giving rise to suspicion of a criminal offence involving a threat to a person's life or safety.
Key facts
- DSA Article 18(1) covers suspected offences that have occurred, are occurring or are likely to occur, and requires all relevant available information to accompany the notification.
- The European Commission's announcement of reporting good practices, adopted on 25 September 2026, lists murder and bodily injury among the offences covered.
- As of 17 October 2026, the Commission maintains a national contact-point list for these notifications, with instructions for obtaining contacts where a national entry is unavailable.
What information triggers the duty?
Article 18(1) of the DSA makes awareness of information giving rise to suspicion the trigger. The offence must involve a threat to life or safety. Recital 56 explains that a host can become aware through a notice from another party or through its own voluntary measures, taking account of the relevant circumstances it knows. It gives incitement to terrorism as an example of a threat to the public.
Article 2(1) covers intermediary services offered to recipients established or located in the EU, regardless of the provider's place of establishment. Article 93(2) sets the DSA's general application date at 17 February 2024. Article 18 sits in the section for hosting services, including online platforms. Article 19's exemption for micro and small platforms concerns the following section's additional platform duties.
What must the host send?
Article 18(1) requires prompt notification and all relevant information available. Recital 56 specifies the content concerned where relevant, its publication time and time zone if available, an explanation of the suspicion, and information needed to locate and identify the relevant user.
The European Board for Digital Services' September 2026 good-practices document is a nonbinding practical resource. It recommends including the content and its exact URL or another available location format, an assessment of whether the threat is imminent or ongoing, and identifiable victims or locations where available, necessary and relevant. The same document states that removing or disabling access to content leaves the applicable notification obligation in place.
Which authorities receive the notification?
Article 18(2) identifies the Member State concerned by the suspected offence's location, the suspected offender's residence or location, or the victim's residence or location. Article 18(1) requires notification to the law enforcement or judicial authorities of the Member State or Member States concerned.
If the host cannot identify the Member State with reasonable certainty, Article 18(2) requires it to inform law enforcement in its state of establishment or where its legal representative resides or is established, or Europol, or both.
The Commission's contact-point page says that, where contacts are unavailable, providers may first approach the national Digital Services Coordinator or relevant law enforcement authority to obtain the details.
Related terms
- When can a website with user content be a hosting service under the DSA?
- What must an illegal-content notice mechanism contain under the DSA?
- Does DSA Article 8 require a host to monitor every user submission?
FAQ
Does a small hosting business have an exemption?
Article 18 contains no size exemption. Article 19 limits its micro and small enterprise exemption to the separate section on additional online-platform duties.
Must you monitor every user's content to find offences?
Article 8 prohibits imposing a general obligation to monitor stored or transmitted information or actively seek facts indicating illegal activity. Article 18 applies when you become aware of information meeting its suspicion threshold.
Does deleting the content complete the reporting duty?
The Board's good-practices document states that removal or disabled access leaves the applicable Article 18 duty intact, including transmission of the relevant available information.
Sources
- EUR-Lex, "Regulation (EU) 2022/2065 (Digital Services Act)", 19 October 2022
- European Commission, "European Board for Digital Services adopts good practices to notify suspected criminal offences under the Digital Services Act", 25 September 2026
- European Board for Digital Services, "Notification of suspicions of criminal offences under Article 18 DSA: Good practices", September 2026
- European Commission, "Points of Contact for notifying suspected criminal offences", 30 September 2026
Check how a page reads to answer engines. Open the GEO score analyzer