This paper discusses the risk-based approach of the Digital Services Act (DSA) of the European Union. By embracing open-ended standards instead of rules and by imposing broad risk-identification and mitigation obligations on private parties, the DSA pushes forward a form of managerial co-regulation that is a paradigmatic shift in platform regulation, that has already influenced other regulatory proposals around the globe. This paper argues that the move is consequential from the perspective of the role of human rights in Internet governance. We posit that the approach pose unique problems when seen from the popular three-prong test used by apex courts around the world to assess restrictions on freedom of expression. Furthermore, we argue that it pushes rights out of the center stage of Internet governance and may create a logic of “symbolic compliance” where governance role of rights is further diminished. Finally, this paper identifies opportunities to address or mitigate the challenges identified, especially in an enforcement stage that remains quite open to these kinds of efforts.