Click, Branch, Audit: A Decision-Tree Toolkit for Assessing Fundamental Rights Impacts under the Digital Services Act of Very Large Platforms & Search Engines
The EU Digital Services Act (DSA) requires Very Large Online Platforms and Search Engines (VLOPs/VLOSEs) to assess and mitigate systemic risks, including actual or foreseeable negative effects on fundamental rights, and subjects these assessments to independent audit. Yet how such rights-relevant risks should be identified, assessed, evidenced, and documented remains methodologically under-specified. We address this gap by introducing a decision-tree-based toolkit that operationalizes Article 34(1)(b) DSA and related audit requirements into a structured assessment process. The toolkit decomposes platforms as systems-of-systems and guides assessors through DSA applicability, context definition, subsystem and stakeholder identification, risk identification, risk assessment, reporting, and visualization. A central design contribution is its treatment of vulnerability as situational and relational: rather than assigning vulnerability to fixed groups, the toolkit asks how particular platform subsystems and dependencies may place stakeholders in vulnerable positions. It further makes fundamental rights-relevant judgments traceable by recording the affected right, interference and justification analysis within the structure of a proportionality test, while also covering a perception and impact dimension including severity, scope, duration, reversibility, as well as practical consequences. We developed the toolkit iteratively through a design-science process combining literature-derived design requirements, three interdisciplinary expert workshops (N=4; N=11; N=20) testing the framework design with two DSA user persona scenarios. We contribute an extensible methodological foundation for making fundamental-rights risk assessments under the DSA more streamlined, systematic, transparent, and auditable.