substantial impact on the provision of the service. For determination of the impact, Article 16(4) lists in particular five parameters that need to be taken into account by the digital service providers. In this regard the Commission is empowered pursuant to Article 16(8) to adopt implementing acts providing more detailed descriptions of the parameters. The further specification of those parameters will be part of the implementing act specifying the security elements mentioned in point 4.4.2. which the Commission intends to adopt in the autumn. 4.4.4. Risk-based regulatory approach. Article 17 stipulates that DSPs are subject to ex post supervisory control by the national competent authorities. Member States must ensure that competent authorities take action, when provided with evidence that a DSP is not complying with the requirements of Article 16 of the Directive. Furthermore, pursuant to Article 16(8) and (9), the Commission is empowered to adopt implementing acts with respect to the notification and security requirements which will enhance the level for harmonisation for DSPs. Moreover, pursuant to Article 16(10) Member States are not allowed to impose any further security and notification requirements on DSPs than those provided in the Directive except for cases where such measures are necessary to safeguard their essential State functions, in particular to safeguard national security, and to allow for the investigation, detection and prosecution of criminal offences. And finally, taking into account the cross-border nature of DSPs, the Directive does not follow the model of multiple parallel jurisdictions but an approach based on the criterion of main establishment of the company within the EU.38 This approach allows for a single set of rules to be applied to DSPs with one competent authority responsible for supervision which is particularly important as many DSPs offer their services across many Member States simultaneously. The application of this approach minimises the compliance burden on DSPs and ensures the proper functioning of the Digital Single Market. 4.4.5. Jurisdiction. As explained above, pursuant to Article 18(1) of the NIS Directive, the Member State where the DSP has its main establishment has jurisdiction over the company. In cases where the concrete DSP offers services in the EU but is not established in the EU territory, Article 18(2) imposes on the DSP the obligation to designate a representative in the Union. In that case, the Member State where the representative is established will have jurisdiction over the company. In cases where a DSP provides services in a Member State but has not designated a representative in the EU, the Member State can in principle take actions against the DSP as the provider is infringing its obligations deriving from the Directive. 38 See in particular Article 18 of the Directive. 35