Not legal advice. This page summarizes EU law as we read it and describes engineering patterns. Whether a rule applies to your service, and what it requires, depends on your service and the countries you operate in. Check with counsel. Last reviewed: 12 October 2026.

Not legal advice. This page summarizes EU law as we read it and describes engineering patterns. Whether a rule applies to your service, and what it requires, depends on your service and the countries you operate in. Check with counsel. Last reviewed: 12 October 2026.

If your service lets users upload audio or video and makes it available in the EU, two sets of rules shape how you handle music in those uploads. Article 17 of the Copyright in the Digital Single Market Directive (Directive (EU) 2019/790) sets the copyright liability regime for large upload platforms. The Digital Services Act (Regulation (EU) 2022/2065) sets procedural duties for almost every hosting service: how notices come in, how users are told about decisions, how they complain, and what gets reported.

Music recognition helps with a specific part of this: finding out which recordings are in an upload. The rest (licences, policy, notices, complaints, reports) is the platform’s job. This page walks through the rules, then maps each duty to what an AudD integration can and can’t do.

TL;DR

Article 17 applies to online content-sharing service providers (OCSSPs): services whose main purpose includes hosting a large amount of user-uploaded copyright material that they organise and promote for profit.
Without a licence, an OCSSP avoids liability only by showing best efforts: to get a licence, to keep unavailable the works rights holders gave it the relevant and necessary information for, and to take down notified works and keep them down.
Newer, smaller services (under 3 years in the EU and under €10 million turnover) have lighter duties. Above 5 million monthly unique visitors they also have to prevent re-uploads of notified works.
Lawful uploads must not be blocked. Quotation, criticism, review, caricature, parody, and pastiche are protected. The CJEU (C-401/19) upheld Article 17 on the condition that filtering doesn’t block lawful content.
The DSA adds notice handling, statements of reasons, complaint handling, and transparency reports. Copyright-specific rules in Article 17 take precedence; the DSA fills gaps.
AudD identifies recordings and returns metadata. It doesn’t hold licences, decide what’s lawful, or handle notices. Using AudD does not make a platform compliant.

Is your service an OCSSP?

Article 2(6) of the Directive defines an OCSSP as a provider of an information society service “of which the main or one of the main purposes is to store and give the public access to a large amount of copyright-protected works or other protected subject matter uploaded by its users, which it organises and promotes for profit-making purposes.”

The same article lists services that are not OCSSPs:

not-for-profit online encyclopedias
not-for-profit educational and scientific repositories
open source software development and sharing platforms
electronic communications services (as defined in Directive (EU) 2018/1972)
online marketplaces
business-to-business cloud services
cloud services that let users upload content for their own use

If you are an OCSSP, Article 17(1) treats you as performing the act of communication to the public yourself when users upload protected content, so you need authorisation from rights holders, for instance a licence. Article 17(3) removes the hosting safe harbour of the e-Commerce Directive for those situations. A licence you obtain also covers users who are not acting on a commercial basis or whose activity doesn’t generate significant revenue (Article 17(2)).

What Article 17(4) requires without a licence

Where no authorisation is granted, the OCSSP is liable unless it shows it has:

Article 17(5) makes this proportional: the type, audience, and size of the service, the type of works uploaded, and the availability and cost of suitable and effective means all count.

The Commission’s 2021 guidance adds two points that matter for engineering. First, for stay-down, a notice alone may not be enough: “if a service provider uses fingerprinting technologies to avoid future uploads of notified works, receiving as information only the information provided in a notice would be insufficient”, and rights holders “would need to provide the service providers with fingerprints or content files.” Second, fingerprinting is common among major services for audio and video but “should not be necessarily considered as the market standard, notably for smaller service providers.”

The new-service regime (Article 17(6))

Both conditions (age and turnover) must hold. The Commission’s guidance says visitors across all Member States count toward the 5 million, and that less can be expected from a new service’s stay-down efforts than from an established one: “It would be proportionate for them to rely on less complex and less costly solutions.”

User safeguards

Article 17 limits the measures it asks for.

No blocking of lawful uploads (17(7)). Cooperation between platforms and rights holders “shall not result in the prevention of the availability” of non-infringing uploads, including uploads covered by an exception. Users in every Member State must be able to rely on the exceptions for quotation, criticism, review, and for caricature, parody or pastiche.
No general monitoring (17(8)). Article 17 “shall not lead to any general monitoring obligation.”
Complaint and redress (17(9)). Users need “an effective and expeditious complaint and redress mechanism” for disputes over removal or disabling. Rights holders must duly justify their requests. Complaints are processed without undue delay, and decisions to disable or remove content are subject to human review. Out-of-court redress and access to courts must be available. Your terms and conditions must tell users they can rely on exceptions.

What the CJEU said in C-401/19

Poland asked the Court of Justice to annul the parts of Article 17 that, in its view, required upload filtering. On 26 April 2022 the Grand Chamber dismissed the action, and the reasoning is what platforms build against:

The obligations in 17(4)(b) and (c) “require de facto” a prior review of uploads, and depending on volume and content type, the use of “automatic recognition and filtering tools” (paras 53–54).
The legislature excluded “measures which filter and block lawful content when uploading” (para 85). A filtering system that “might not distinguish adequately between unlawful content and lawful content”, and so could block lawful communications, would be incompatible with freedom of expression (para 86).
Platforms “cannot be required to prevent the uploading” of content that, to be found unlawful, would need “an independent assessment of the content by them” in light of the rights holders’ information and of exceptions (para 90).
The complaint mechanism is an extra safeguard for when lawful content is blocked anyway (para 93). It doesn’t replace the duty not to block it.

The Commission’s guidance on automated blocking

The guidance (COM(2021) 288, 4 June 2021) is not legally binding and predates the judgment, but it is the most concrete statement of how the safeguards translate into practice:

“In the present state of the art, no technology can assess to the standard required in law whether content […] is infringing or a legitimate use.”
Automated blocking “should in principle be limited to manifestly infringing uploads.” Other matched uploads should in principle go online, with ex post human review if the rights holder objects by notice.
Suggested criteria: the length of the matched content, its proportion of the whole upload, and how much it was modified. A whole song used as background in a user video is given as an example of a manifestly infringing upload. Short extracts that are a small proportion of the work generally are not (length alone isn’t a legal test).
“Content for which the rightholders have not given a blocking instruction […] should not be considered manifestly infringing.”
Rights holders may earmark content whose availability would cause significant economic harm, such as pre-release music. For that, a rapid ex ante human review may be appropriate.
Users whose uploads are blocked should be told without undue delay and be able to contest the block.

How the DSA sits alongside

The DSA has applied in full since 17 February 2024. Article 2(4)(b) says it is “without prejudice to” Union law on copyright, and recital 11 says the copyright directives, including 2019/790, “establish specific rules and procedures that should remain unaffected.” Recital 10 adds that where other acts pursue the same objectives, the DSA applies to issues those acts leave unaddressed or not fully addressed. So Article 17 governs the copyright liability question, and the DSA’s procedural duties apply around it to the extent Article 17 and national law don’t cover them. Where exactly that line falls for your service is a question for counsel.

Two scoping notes. Article 19 exempts online platforms that are micro or small enterprises (under Recommendation 2003/361/EC: fewer than 50 staff and turnover or balance sheet total no more than €10 million) from Articles 20 to 28, except Article 24(3), unless they’re designated very large platforms. Article 15(2) exempts the same micro and small enterprises from the transparency report. Articles 16 and 17 have no such exemption. And Article 8 of the DSA, like Article 17(8) of the Directive, rules out a general monitoring obligation.

Commission Implementing Regulation (EU) 2024/2835 sets the report templates (mandatory from 1 July 2025), a calendar-year reporting period, publication within two months of the period’s end, and five years’ retention.

National variation: Germany as an example

Article 17 is a directive, so each Member State wrote its own law (the transposition deadline was 7 June 2021). The results differ, and the national law is what binds you. Germany’s Copyright Service Provider Act (UrhDaG) is the most detailed, and its approach to automated blocking is specific:

Presumed permitted uses (§ 9). Uploads that use less than half of a third-party work, combine it with other content, and either use it only minorly or are flagged by the user as legally permitted are rebuttably presumed lawful. To avoid disproportionate automated blocking, they must stay online until a complaint procedure ends.
Minor uses (§ 10). For non-commercial use or use generating only insignificant revenue: up to 15 seconds of a film or moving image, up to 15 seconds of a sound track, up to 160 characters of text, up to 125 kilobytes of an image.
User flagging (§ 11). Before an upload is automatically blocked, the user is told about the rights holder’s blocking request and can flag the use as legally permitted. If blocking happens only after upload, the content counts as presumed permitted for 48 hours even without a flag.
Complaints (§ 14). Decided within one week of filing, by impartial natural persons. A trusted rights holder can, after human review on its side, require immediate blocking of presumed-permitted content until the complaint is decided (§ 14(4)).
Size tiers (§ 2, § 7). Start-ups (under €10 million EU turnover, under three years) are exempt from the blocking duty while their monthly unique visitors stay at or below 5 million. Small providers (up to €1 million EU turnover) are rebuttably presumed not to be obliged to block.

A German rule like “15 seconds of a sound track” is the kind of threshold your policy layer has to encode per country. Other Member States have no such numeric safe zone. Check each country you serve.

Where music recognition fits, and where it doesn’t

A missing match means “not recognized”, not “cleared”. A match means “this recording plays here”, not “this upload infringes”.

Mapping the duties to building blocks

Scanning uploads

Run the enterprise endpoint on each upload’s audio. It splits the file into 12-second chunks and returns every match with its position in your file. The UGC copyright scanner recipe builds the endpoint; the essential call is:

ISRC, UPC, and score need a Startup plan or higher. You’ll want all three: ISRC to compare against licence records and rights-holder instructions, and score to keep weak matches out of automated action.

Policies that block only clear cases

The guidance’s criteria (matched length, share of the upload, modification) and Germany’s presumptions translate into inputs you can compute from an enterprise scan: seconds of each matched track and the matched share of the whole upload. From match to decision shows how to compute both and works through a decision table. For an EU Article 17 context, add these rules on top:

Block automatically only on a rights-holder instruction. A public database match tells you the recording, not that its owner asked you to block it. Key automatic blocks to instructions you hold (by ISRC or custom catalog audio_id), and treat everything else as publish or review.
Make the “manifest” threshold conservative. For example: a single recording matching most of the upload, with a high score. Short excerpts and uploads where matched music is a small share go online.
Encode country rules per region. A German minor-use rule needs the matched seconds per track and the upload’s commercial status, evaluated for German viewers.
Route earmarked works to fast human review, not to automatic blocking, unless your counsel and the rights holder’s instruction say otherwise.
Calibrate on your own uploads. AudD doesn’t publish false-positive rates. Measure how often your automated blocks get overturned and keep that number. It is also the error-rate indicator Article 15(1)(e) asks for.

The values are placeholders, and the German branch simplifies § 9 (which also requires that less than half of the work is used). The function shows the order of checks, not a legal threshold.

Review queues and complaints

Article 17(9) requires human review of removal decisions under complaint, and DSA Article 20(6) requires complaint decisions not be taken solely by automated means. Germany sets a one-week limit. Build the queue once and use it for three inputs: automated holds, rights-holder notices about uploads that are online, and user complaints about blocks. Give reviewers the matched track, the spans in the upload they can jump to, the score, the user’s stated exception (quotation, parody, licence), and the rights holder’s justification. Record the decision, the reviewer, and the time. The appeals section of From match to decision covers scoping allow-list entries after a successful appeal.

A decision log that feeds statements of reasons and reports

If every moderation action writes one record with the fields DSA Article 17(3) lists, the statement of reasons is a rendering of that record, and the yearly report is a query over the log.

Keep the raw AudD matches next to it, as in From match to decision, so a reviewer can see what was recognized. Strip personal data before submitting to the Commission’s statements of reasons database. Report figures come from the same records:

(count_by is a plain group-and-count helper.) Fill the Implementing Regulation 2024/2835 template from these numbers.

Rights-holder reference files via custom catalog

Article 17(4)(b) turns on the information rights holders give you. When a rights holder sends a file for a recording that’s in the public database, you don’t need to upload anything: record their instruction against the recording’s ISRC and match on that. When the work isn’t in the public database (pre-release music, production libraries, independent recordings that were never distributed commercially), add the file to your custom catalog. This needs special access; email [email protected].

Store the mapping from audio_id to the rights holder, the instruction (block, monitor, earmarked), and the agreement on your side. Custom-catalog matches come back with audio_id; artist and title may be null. By uploading, you confirm you have the right to send the file for fingerprinting, so get that permission from the rights holder as part of taking the file.

Stay-down for removed works

After a sufficiently substantiated notice, you remove the upload. To keep it down, you need to recognize the work in future uploads, which is the point the guidance makes about notices alone being insufficient for fingerprinting.

The work is in the public database. Add its ISRC to your notified-works list with the notice reference, plus the ISRCs of other releases the notice covers (a remaster or compilation can carry a different code). Future scans that return those ISRCs go to the same policy path as rights-holder instructions.
The work isn’t in the public database. Ask the rights holder for a reference file, add it to your custom catalog once, and list its audio_id. This is a design pattern, not a built-in AudD feature: AudD keeps the fingerprint, your database keeps the notice, the scope, and whether the rule is still active.
Retire rules on your side. There is no public list or delete call for the custom catalog. If a notice is withdrawn or a complaint succeeds, deactivate the rule in your database; re-uploads then match but trigger no action.
Stay-down still goes through the safeguards. A re-upload of a notified work inside a parody or review is a new upload with its own context. Apply the same conservative policy and complaint route.

Live streams

If users broadcast live, AudD streams can monitor channel URLs (HLS, Icecast, twitch:, youtube:) and post matches to your callback URL. The same rule holds: AudD reports the recording, and your policy and reviewers decide what happens to the stream. See identifying music in live audio streams.

A checklist

Decide, with counsel, whether you’re an OCSSP and which tier of Article 17(6) applies; recheck turnover and visitors every year.
List the countries you serve and the national rules that differ (Germany’s presumptions, complaint deadlines).
Record licences by ISRC and territory; record rights-holder instructions by ISRC or audio_id.
Scan uploads with the enterprise endpoint, with a limit on every call.
Block automatically only on clear matches to a blocking instruction; publish or review everything else.
Run one review queue for holds, notices, and complaints, staffed by people.
Log every decision with the DSA Article 17(3) fields and the policy version.
Measure your overturn rate and report it.

FAQ

Does using AudD make my platform compliant with Article 17 or the DSA? No. AudD identifies recordings in audio and returns metadata. Compliance depends on your licences, the policy you apply to matches, how you handle notices and complaints, and what you report. Recognition is one input into those processes.

Is my platform an OCSSP under Article 17? It is if one of its main purposes is to store and give the public access to a large amount of copyright-protected content uploaded by users, which it organises and promotes for profit. Not-for-profit encyclopedias and educational repositories, open source software platforms, online marketplaces, business-to-business cloud services, and cloud storage for users’ own use are excluded. Check your service with counsel.

Do new or small platforms have to filter uploads? Under Article 17(6), services available in the EU for less than three years with annual turnover below 10 million euros only need best efforts to get licences and expeditious notice-and-takedown. If their average monthly unique visitors exceed 5 million, they must also make best efforts to prevent re-uploads of notified works. National laws can add tiers, such as Germany’s small-provider presumption.

Can automated music recognition decide whether an upload is a parody or a quotation? No. Recognition tells you which recording plays and where; it can’t assess whether an exception applies. The CJEU in C-401/19 ruled out filtering that blocks lawful content, and the Commission’s guidance limits automated blocking to manifestly infringing uploads. Keep automatic blocks for clear cases and send the rest to human review.

What do I need from rights holders to keep a removed song from being re-uploaded? Information that lets your tools recognize it. If the recording is in AudD’s public database, its ISRC, plus those of other releases the notice covers, can key a rule. If it isn’t, ask for a reference file and add it to your custom catalog, which needs special access from AudD.

Does the DSA apply to copyright takedowns if Article 17 already does? The DSA is without prejudice to EU copyright law, so Article 17 and its national implementations govern copyright liability. The DSA’s procedural duties, such as notice handling, statements of reasons, complaint handling, and transparency reporting, apply to the extent copyright law doesn’t address them. Confirm the split for your service with counsel.

Sources

Directive (EU) 2019/790 on copyright in the Digital Single Market, Article 2(6) (OCSSP definition and exclusions), Article 17 (liability regime, new-service tiers, safeguards), Article 29 (transposition)
Commission guidance on Article 17, COM(2021) 288 final, 4 June 2021 (relevant and necessary information, stay-down information, manifestly infringing uploads, earmarking, Article 17(6) tiers)
CJEU, Case C-401/19, Poland v Parliament and Council, judgment of 26 April 2022, paragraphs 53–54, 85–86, 90–93, 98
Regulation (EU) 2022/2065, Digital Services Act, recitals 10–11, Articles 2(4), 8, 15, 16, 17, 19, 20, 24, 93
Germany, Urheberrechts-Diensteanbieter-Gesetz (UrhDaG), §§ 2, 7, 9, 10, 11, 14 (English translation)
From match to decision: designing allow, block, and review policies
Build a copyright scanner for user-uploaded content
AudD for video platforms and UGC moderation
AudD for music lawyers and licensing investigators
Public database vs your custom catalog

EU Article 17 and the DSA: where music recognition fits for upload platforms