TikTok's risk report is self-graded, not independently audited

The test

Under Article 34 of the EU's Digital Services Act, TikTok, as a designated very large online platform, must assess systemic risks its service poses and publish the results. TikTok's own document, titled 'DSA Risk Assessment Report 2024', dated 28 August 2024 and updated 2 October 2024, states that it is 'TikTok's second annual systemic Risk Assessment Report within the framework of the Digital Services Act,' following a first report TikTok says it 'submitted... to the European Commission in September 2023.'

What the evidence says

The report names its own recommendation system, the For You Feed, as one of two priority risk factors running across most of its risk categories, the other being AI-generated content. It states that the feed 'takes account of user interactions, content information, and user information' and that concentrated exposure to similar content is 'a relevant risk that has been widely documented by civil society,' citing an outside footnote rather than an independent finding of its own. The report describes its scoring approach as an internally built framework: a five-level scale in its first year, and in year two, a version that 'incorporat[es] elements of the ISO31000 risk scoring methodology,' a general international risk-management standard, not a DSA-specified or independently applied test.

The sample and the variance

Every risk score, mitigation description and effectiveness claim here is TikTok's own self-assessment; no external auditor's opinion is included in the material reviewed, and TikTok frames the report as one input among several, stating it 'welcome[s] feedback on our approach from regulators, researchers and civic society.' The mitigation measures it lists for the recommender system are concrete and checkable in principle, such as excluding under-16 content from recommendation and manually reviewing videos past an unspecified view-count threshold, but the report publishes no external verification that these measures work as described, and its scope is TikTok's EU service, not its global product. Separately, the European Commission's own supervision page confirms TikTok's formal designation as a very large online platform and lists a continuing timeline of proceedings toward TikTok running well past this report's publication date.

What to try next

A reader citing this report should describe it as TikTok's own risk assessment, not an independently audited finding, and should check whether a described mitigation is still verifiable in the current app rather than assuming the 2024 description still applies. This is an editorial caution: continuing Commission proceedings after publication are evidence the regulator did not treat the self-assessment as closing the question.

• Is a given claim about TikTok's recommender system risks TikTok's own self-assessment, or an independent regulatory finding?
• Does the cited mitigation measure specifically apply to TikTok's EU service, and is it still in effect as described?
• Has the European Commission taken any subsequent action on the risks this report describes, and does that change how 'resolved' the risk should be considered?

Publishing a systemic risk assessment is itself a notable disclosure of algorithmic design considerations, but a company grading its own recommendation system does not carry the same evidentiary weight as an outside audit of it.