Description

A focused course, tailored for you

The Platform Regulatory Readiness Operator's Playbook

Run a defensible readiness function across DSA, DMA, AI Act and online-safety regimes when the regulator letter lands at 7am.

The next regulator letter does not give you five weeks. It gives you 48 hours, and the answer has to land across product, legal, integrity and policy without breaking product velocity.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Regulatory readiness at a very-large online platform is a coordination job that sits between four moving systems. The DSA expects a transparency report, a risk assessment, a data-access protocol for vetted researchers, and a Section 35 response capability. The DMA expects a designated-gatekeeper compliance report and an interoperability roadmap. The AI Act expects general-purpose model documentation, systemic-risk evaluation, and adversarial testing evidence. The UK Online Safety Act, the Australian Online Safety Act, the Irish Coimisiun na Mean code, the German NetzDG remnants, and the Indian IT Rules each expect their own filings on overlapping but non-identical timelines. The readiness function owns the join between all of them. When a Section 35 request lands, the answer has to be ready in 48 hours, traceable to product evidence, and consistent with what the same platform said last month to a different regulator. The artefacts that make that possible are not in the legal team's matter management system, not in product's roadmap tool, not in policy's position-paper repository. They live in the readiness function's playbook, or they do not exist.

What you walk away with

Run a single readiness calendar across DSA, DMA, AI Act, UK OSA, Australian OSA, Irish CnaM and Indian IT Rules with traceable filing artefacts.
Stand up a 48-hour Section 35 response capability with pre-built evidence templates and a named-owner matrix.
Reconcile cross-jurisdiction positions before they diverge, with a published internal-consistency log.
Run a quarterly DSA risk-assessment cycle that survives an independent auditor without product-team firefighting.
Hand the next AI Act systemic-risk evaluation to a successor with a playbook, not tribal knowledge.

The 12 modules

Module 1. The platform readiness operating model

Map the four moving systems the readiness function sits between: Legal, Product, Integrity Operations, and Public Policy. Define what readiness owns versus what each function owns, where the handoffs are, and which artefacts only the readiness function can produce. Includes a worked operating-model diagram, a RACI for the seven most common regulator requests, and the meeting cadence that keeps the join intact.

Module 2. The cross-jurisdiction readiness calendar

Build a single calendar that holds DSA transparency reports, DMA gatekeeper compliance reports, AI Act general-purpose model documentation cycles, UK OSA risk assessments, Australian OSA Basic Online Safety Expectations responses, Irish CnaM code obligations, and Indian IT Rules quarterly compliance reports. Cover dependency mapping, slack windows, owner assignment, and the escalation path when a product release threatens a filing date.

Module 3. The DSA risk-assessment playbook

Run a quarterly Article 34 systemic risk assessment that survives an Article 37 independent audit. Cover the four risk categories, the methodology choice product counsel will sign off on, the evidence trail from product telemetry to the assessment narrative, the mitigation log, and the cross-reference to the Article 35 mitigation measures. Includes the auditor question bank and the artefacts an auditor expects to see.

Module 4. The 48-hour Section 35 response capability

Stand up the response machine for a Digital Services Coordinator request, a Commission request, or a national regulator equivalent. Pre-built evidence templates, named-owner matrix per evidence type, the legal review fast-path, the product-team escalation channel, and the after-action review that updates the playbook. Includes worked examples for content-moderation, recommender-system, and advertising-transparency requests.

Module 5. The DMA gatekeeper compliance machine

Run the annual DMA Article 11 compliance report and the underlying obligations workflow. Cover interoperability roadmap maintenance, the self-preferencing audit, the third-party-fairness evidence trail, the data-portability response capability, and the change-control process when a product update touches a gatekeeper obligation. Includes the Commission's expected report structure and the audit trail behind each claim.

Module 6. The AI Act systemic-risk evidence trail

Handle general-purpose AI model obligations and the systemic-risk evaluation when a model crosses the compute threshold. Cover the model documentation requirements, the adversarial testing evidence trail, the serious-incident reporting capability, the cybersecurity-protection log, and the overlap with the DSA risk assessment so a single audit does not produce two contradictory answers. Includes the AI Office expectations and a worked evaluation report.

Module 7. Cross-jurisdiction position consistency

Build the internal-consistency log that prevents the platform from saying one thing to the Commission and a different thing to Ofcom or the eSafety Commissioner. Cover the position-repository structure, the change-approval workflow, the diff-and-review cadence, and the escalation when a national regulator asks a question the EU answer does not cover. Includes a worked example of a recommender-system position reconciled across DSA, OSA, and Coimisiun na Mean.

Module 8. Vetted researcher data access under Article 40

Operate the Article 40 vetted researcher data access protocol without breaking platform security posture. Cover the application review workflow, the data-minimisation review, the legal review fast-path, the platform-security sign-off, the access provisioning and revocation machine, and the after-access audit trail. Includes the Commission's delegated act expectations and a worked application review.

Module 9. Trust and Safety evidence the regulator actually wants

Translate Trust and Safety operational data into the evidence shape a regulator audits against. Cover content-moderation accuracy metrics with the methodology a regulator will accept, advertising-transparency evidence that survives an audit, recommender-system change logs that map to risk-assessment claims, and the appeals-data trail expected under DSA Article 20. Includes the format mismatches that cause the most audit pain and how to bridge them.

Module 10. The product-velocity-preserving change-control loop

Run a change-control process that catches product releases with regulatory impact without slowing product velocity. Cover the early-warning signal from product roadmap tools, the readiness-review fast-path, the documentation update workflow, the filing-impact assessment, and the after-launch evidence capture. Includes the four product-change patterns that most often trigger regulatory impact and the playbook entry for each.

Module 11. The annual independent audit and what survives it

Prepare for the DSA Article 37 independent audit, the AI Act conformity assessment, and the equivalent annual reviews in adjacent regimes. Cover the auditor selection criteria, the engagement letter scope, the evidence-room build, the management-letter response capability, and the remediation plan that holds up across cycles. Includes the seven most common audit findings and the readiness artefacts that prevent each.

Module 12. Succession, documentation, and the readiness function as an asset

Make the readiness function survive a team change. Cover the playbook-versioning discipline, the documentation standard for every artefact, the cross-training rotation, the handover protocol, and the operating-model review cadence. Includes a successor's-first-90-days checklist and the artefacts that prove the function is run as an asset, not held together by tribal knowledge.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Section 35 request landed at 7am, due in 48 hours, evidence has to come from three product teams and one legal review.

Quarterly DSA risk-assessment cycle starts in three weeks and the recommender-system methodology is still flagged by product counsel.

AI Act general-purpose model documentation overlaps with a DSA mitigation measure and the two narratives have to reconcile.

A national regulator asks a question that contradicts the answer the platform gave the Commission six weeks ago.

What you get with this course

Twelve written modules with downloadable templates and worked examples for every module.
A hand-built implementation playbook tailored to a platform-level readiness function, delivered alongside course access.
A readiness-calendar template covering DSA, DMA, AI Act, UK OSA, Australian OSA, Irish CnaM and Indian IT Rules.
A 48-hour Section 35 response template pack with named-owner matrix and evidence checklists.
An internal-consistency log template for cross-jurisdiction positions.
A worked DSA risk-assessment and the matching auditor question bank.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours: course access and the hand-built implementation playbook delivered.

Week 1: complete modules 1 through 3, run the operating-model and calendar templates against the current state.

Week 2: complete modules 4 through 6, stand up the Section 35 response capability draft, draft the DMA and AI Act evidence trails.

Week 3: complete modules 7 through 9, reconcile cross-jurisdiction positions, rebuild Trust and Safety evidence formats.

Week 4: complete modules 10 through 12, run the change-control loop end to end, write the successor handover document.

Before and after

Before

Regulator requests turn into all-hands fire drills, product velocity stalls when a filing deadline approaches, and the cross-jurisdiction story is held together by one person's memory.

After

Inbound regulator requests are answered from a pre-built playbook in 48 hours, the readiness calendar is visible to product and legal at all times, and the internal-consistency log proves the platform is saying the same thing in Brussels, Dublin, London and Canberra.

What happens if you do not address this

The next independent DSA audit, the next AI Office model evaluation, or the next national-regulator coordination request will arrive on the readiness function's desk regardless. Without a playbook, each one becomes a tax on product, legal and integrity teams, and the inconsistencies that build up across cycles become the finding in the audit after that.

Who it is for

A Regulatory Readiness lead at a very-large online platform, sitting between Legal, Product, Integrity Operations, Public Policy, and the Trust and Safety org. Accountable for the calendar of regulator filings, the playbook for inbound regulator requests, the consistency of cross-jurisdiction positions, and the audit trail that gets pulled when a DSA auditor or a national regulator asks for evidence. Not a lawyer. Not a product manager. A function operator.

Who this is NOT for. Not for outside counsel writing legal memos. Not for product managers who occasionally touch a compliance ticket. Not for Trust and Safety policy writers whose primary job is content rules. This course is for the function operator who owns the readiness machine itself.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Roughly four hours per module, total around 48 hours over four weeks at the recommended pace. Faster if the readiness calendar and Section 35 capability are the priority.

Why $199 is the right number

Outside counsel can write a memo on any single obligation but does not run the readiness function. A generic GRC platform tracks controls but does not produce the artefacts a DSA auditor or AI Office reviewer expects. A general compliance bootcamp covers SOC 2 and ISO 27001, not platform regulation. This course is the operator's manual for the readiness function itself, not the legal layer above it or the controls layer below it.

FAQ

Is this a legal course?

No. It is a function-operations course. Legal interpretation stays with counsel. This covers how the readiness function runs the machine that delivers what counsel and product need.

Does it cover the UK and Australian regimes as well as the EU?

Yes. The cross-jurisdiction calendar and the internal-consistency log are core to the course. UK OSA, Australian OSA, Irish CnaM and Indian IT Rules each have their own module-level coverage.

Does it cover AI Act obligations for general-purpose models?

Yes. Module 6 covers the documentation, evaluation and serious-incident reporting requirements, and the overlap with the DSA risk assessment so a single audit does not surface contradictions.

Will the implementation playbook be specific to my platform?

Yes. The playbook is hand-built after course access is provisioned, against the platform-readiness function context, not adapted from a generic template.

What happens if I do not finish in four weeks?

Course access does not expire. The four-week pace is a recommendation, not a deadline.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.