Article 5 Notification and independent audit of a compliance plan
Within 4 months following the notification of the decision designating them as a very large online platform pursuant to Article 33 of Regulation (EU) 2022/2065, the providers of online social networking services and video-sharing platform services that have been designated as a very large online platform pursuant to Article 33 of Regulation (EU) 2022/2065 shall notify to the Commission a compliance plan describing in a detailed manner compliance with the obligations laid down in Chapters II to V of this Regulation.
For providers referred to in the first sub-paragraph already designated as a very large online platform pursuant to Article 33 of Regulation (EU) 2022/2065, such notification shall occur within 30 days from the date of the entry into application of this Regulation.
Article 34(3) of Regulation (EU) 2022/2065 shall apply mutatis mutandis to the supporting documents of those notifications.
For the purpose of enabling the Commission to assess the compliance of providers referred to in paragraph 1 with the obligations laid down in Chapters II to V, those providers shall, at their own expense, commission an audit of the compliance plan notified pursuant to paragraph 1 by one or more independent auditors. The independent auditors shall have, or shall retain experts with proven expertise in the following areas relevant for the protection of minors:
developmental science;
the design of online interfaces and recommender systems;
data protection and security.
Article 37(2) and (3) of Regulation (EU) 2022/2065 shall apply mutatis mutandis to the audits carried out pursuant to this Article and to the independent auditors and any experts retained by them. The costs of the audit shall be borne by the provider concerned. These costs shall not exceed market rates for comparable assessments by the auditors.
The providers referred to in paragraph 1 shall cooperate with the independent auditors and shall grant them access to all information, data, documents and personnel relevant for the performance of the audit.
Providers shall ensure that any employee or contractor that has communicated with the independent auditor are protected against any adverse action by the provider.
The independent auditors commissioned by the provider pursuant to paragraph 2 shall:
assess the compliance plans submitted by the providers pursuant to paragraph 1 in view of the obligations laid down in Chapters II to V;
transmit a draft report to the provider, which may submit comments within 15 days of receipt;
issue a final report, taking into account any comments received pursuant to point (b), simultaneously to the Commission and to the provider, within two months of receipt of the compliance plan, identifying any shortcomings in the compliance measures described therein.
The provider concerned shall publish, without undue delay after its receipt, a summary of the final report referred to in paragraph 4, point (c), which shall not contain confidential information.
Where the Commission concludes by means of a decision on the basis of the final report referred to in paragraph 4, point (c) that the compliance plan contains shortcomings, the provider concerned shall submit to the Commission and to the independent auditor within 30 days of the receipt of the Commission decision report a corrective action plan identifying one or more corrective measures for each identified shortcoming.
The provider shall also identify a reasonable period, which shall not be longer than 60 days, for the implementation of each corrective measure in the corrective action plan.
The independent auditor shall verify the implementation of the corrective measures and shall report thereon to the Commission and to the provider concerned.
In assessing the compliance of the providers referred to in paragraph 1 with the obligations laid down in Chapters II to V of this Regulation, the Commission shall be entitled to consider the compliance plan referred to in paragraph 1, the final report referred to in paragraph 4, point (c) and any corrective measures communicated pursuant to paragraph 6 or any other information that the Commission may consider relevant.
Neither the final report referred to in paragraph 4, point (c), nor any action or absence thereof by the Commission in relation to that final report or to the compliance plan shall constitute a finding of compliance with the obligations laid down in Chapters II to V of this Regulation, or shall limit the powers of the Commission under this Regulation or under Regulation (EU) 2022/2065.
Providers shall, after the first notification pursuant to paragraph 1, report annually on their compliance with the obligations laid down in Chapters II to V of this Regulation as part of their annual risk assessments carried out pursuant to Article 34 of Regulation (EU) 2022/2065.
Compliance with the obligations laid down in Chapters II to V of this Regulation shall be included in the independent audits carried out pursuant to Article 37 of Regulation (EU) 2022/2065.
This Article is without prejudice to the powers of the Commission under this Regulation and under Regulation (EU) 2022/2065, including the power to adopt interim measures.
The Commission may adopt implementing acts laying down templates and methodologies for the audits carried out pursuant to this Article. Those implementing acts shall be adopted in accordance with the procedure referred to in Article 39.