European fact-checking and media literacy organisations are being urged to follow a standardised crisis-response playbook whenever a significant wave of disinformation breaks out, regardless of whether it is triggered by a natural disaster, public health emergency, war, election, or any other major news event. The guidance, detailed in a set of recommended activities circulated among the European Digital Media Observatory (EDMO) network, sets out a clear sequence of actions designed to help member hubs detect, analyse, and counter harmful false narratives quickly and coherently. At the centre of the protocol is the figure of the Crisis Disinformation Coordinator, a designated person within each hub who acts as the first point of contact and principal organiser for the initial response. According to the protocol, the coordinator is expected to immediately alert the EDMO Taskforce by sending an email both to the member from the same hub and to the chair of the taskforce. This notification should be more than a simple warning: it must contain a structured situational report covering the triggering event, the disinformation narratives identified so far, the main actors spreading them, and preliminary impact or engagement data. The emphasis on speed and detail reflects a broader recognition that the first hours of an information crisis are critical, as false narratives can solidify into widely shared beliefs before fact-checkers have time to respond. By centralising this information at the European level, the EDMO network hopes to coordinate its response, avoid wasted effort, and ensure that national and cross-border lessons are shared.
Within the initial notification, the protocol asks for four specific categories of information. First, the coordinator must describe the crisis event itself, including date, place, kind of event, any entities involved, and any other relevant details. This establishes the factual baseline against which disinformation can be measured. Second, the coordinator should list the main disinformation narratives that have already been detected in the early stage, using EDMO’s definition and methodology. This ensures that all partners are speaking the same language and that false claims are not classified inconsistently across borders. Third, the notification must identify the principal actors and channels contributing to the crisis, such as accounts on specific social media platforms, private groups, Telegram channels, influencers, media outlets, or politicians from particular parties. It should also note any signals of coordination among these actors, for example if pages are sharing identical content, using similar hashtags, or posting in synchronised patterns. This kind of network-level intelligence is crucial for understanding whether a crisis is genuine grassroots confusion or the product of organised manipulation. Fourth, the coordinator is asked to provide impact, engagement, and other relevant statistics if they are already available, including reach, likes, shares, comments, and the speed of spread. Even partial data can help the taskforce assess the severity of the crisis and decide whether an escalated response is necessary. The inclusion of these categories shows that the protocol is designed not just to track individual false claims but to produce a comprehensive operational picture, one that can guide both immediate interventions and longer-term resilience-building.
Once the notification has been received, the EDMO Taskforce commits to convene a meeting with the Crisis Disinformation Coordinator as soon as possible, in order to discuss the issue and plan follow-up activities. This rapid meeting is intended to move the network from detection to action. At the same time, the hub directly interested in the crisis is encouraged to begin publishing analyses and articles on its own website immediately. These publications should aim to create public awareness about the main disinformation narratives and the actors and channels responsible for circulating them. The protocol specifically advises hubs to focus on content and behaviour that are potentially the most dangerous for individuals or societies, meaning that editors should prioritise clear harms such as health misinformation, incitement to hatred, or interference with democratic processes. The pieces should be evidence-based, clearly sourced, and transparent about what is known and unknown at that stage. If the content is relevant to the broader European public rather than only to one country or language community, the hub should flag it to the chair of the EDMO Taskforce during regular meetings or via email, so that it can be translated or adapted and published in English on Edmo.eu, the network’s central website. This arrangement creates a two-tier publication strategy: local hubs serve their national audiences with timely cultural and linguistic specificity, while the central platform amplifies stories that have cross-border significance. The guidance also implies a strong ethical commitment: while speed is important, the focus on dangerous content rather than all false claims helps prevent undue amplification of trivial or harmless inaccuracies.
The protocol also looks beyond the acute phase of an information crisis. After the peak has passed, and if prebunking or media literacy content has previously been published in connection with the event, the hub is recommended to publish follow-up articles evaluating the effectiveness of those inoculation efforts. Prebunking, a technique that involves exposing audiences to weakened versions of manipulative techniques before they encounter the real disinformation, has gained increasing attention as a resilience-building tool. By publicly evaluating whether this content protected audiences, the network can learn what works and what does not, and refine future campaigns. Then, after the crisis has fully ended, the hub is recommended to publish an ex post analysis that covers the entire arc of the crisis, from the first signals to the final resolution. This after-action review should provide detailed information about the content and actors involved, as well as the impact of both the disinformation and the response efforts. Such analyses are valuable not only for internal learning but also for the broader community of researchers, journalists, and policy-makers interested in understanding how disinformation functions in different contexts. They can also serve as a historical record, allowing observers to compare one crisis to another and identify recurring patterns or evolving tactics. Taken together, these post-crisis steps transform the protocol from a simple emergency manual into a continuous learning loop, in which every crisis produces evidence that strengthens the network’s capacity for the next one.
An additional layer of the protocol addresses situations in which an information crisis affects more than one hub. Cross-border disinformation events are increasingly common, as false narratives can travel quickly through international social media networks and be adapted by local actors to fit different languages and political contexts. In such cases, the EDMO Taskforce is instructed to make every effort to ensure effective coordination among all involved hubs, using both formal meetings and offline or asynchronous communication. The goals of this coordination are explicitly detailed: exchange of information and content, avoidance of duplication, creation of synergies, implementation of joint projects, and any other relevant and useful activities. Exchange of information means that hubs should share raw data, leads, and analysis in real time, rather than working in silos. Avoiding duplication is especially important in a network of independent organisations, because two hubs might otherwise spend time fact-checking the same viral claim while ignoring other aspects of the crisis. Creating synergies involves combining complementary strengths, such as one hub’s language skills and another hub’s data analytics expertise. Joint projects could include shared investigations, cross-published articles, coordinated monitoring of platforms, or co-authored reports. The mention of offline communication is notable, as it acknowledges that effective crisis response often depends on informal relationships and direct personal contact, not just official channels. By making this coordination an explicit responsibility of the taskforce, the protocol institutionalises a collaborative culture and reduces the risk that the network will respond in a fragmented way.
Overall, the recommended activities reflect a maturing of the field of disinformation response, moving from ad hoc fact-checking to a more systematic, professional, and learning-oriented approach. The protocol recognises that an information crisis can be triggered by any kind of event and that the exact nature of the trigger matters less than the speed and quality of the response. It places heavy responsibility on the Crisis Disinformation Coordinator, but also embeds that role in a wider network of support and peer coordination. It emphasizes the importance of publishing open, transparent analyses throughout the lifecycle of a crisis, from early warnings to final evaluations, and it explicitly connects the emergency response with longer-term prebunking and media literacy activities. The requirement to assess the effectiveness of inoculation efforts is particularly important, because it moves the network beyond basic monitoring and into the realm of evidence-based intervention. Similarly, the requirement for an ex post analysis after the crisis has ended ensures that lessons are recorded and shared rather than lost. The multi-hub coordination mechanisms, finally, are a practical answer to the reality of cross-border disinformation, and they reflect a commitment to European solidarity in defending the information environment. While the protocol is necessarily detailed and technical, its underlying message is straightforward: disinformation is a threat that can be managed, but only through rapid notification, structured information sharing, focused public communication, honest evaluation, and close cooperation across borders. For citizens and policymakers alike, the existence of such a protocol is a reassurance that the infrastructure for defending against information crises is being taken seriously and continuously improved. As new technologies and new crisis events emerge, this kind of structured response will be essential to preserving trust in democratic institutions and public discourse.
