On 26 October, the European Commission accepted Temu's plan to fix its illegal-product risk assessment: the EU's own board of regulators had just rated that same plan only partly adequate

Five months from fine to acceptance, with a disputed review in between

The Commission's May 2026 decision found that Temu's 2024 risk assessment, the one Article 34 of the DSA (Regulation (EU) 2022/2065) requires every very large online platform to produce, relied on generic, sector-wide information rather than evidence specific to Temu's own marketplace. The €200 million fine followed. Under Article 75 of the same regulation, Temu was then required to propose and implement measures to remedy the breach, with a deadline of 28 August 2026 to submit its plan.

The plan itself has five parts, as described by multiple outlets covering the Commission's statement: a platform-specific risk assessment built on reliable, current information rather than generic sector data; metrics and indicators to measure whether Temu's mitigation actually reduces the circulation of illegal products; a review of the limits of its content moderation; an examination of how its recommender systems might amplify illegal listings; and measures addressing manipulation by sellers. Temu has four months from acceptance to implement the measures, and the whole implementation is subject to an external, independent audit that Temu has committed to commission itself.

Accepted does not mean the regulators agree the problem is fixed

Most headlines on 26 and 27 October read as a resolution: the Commission accepts Temu's plan, case closed. The sequence of dates says otherwise. The Board for Digital Services, the body the DSA itself designates to advise the Commission, reviewed the plan roughly a month before the acceptance and found it only partially adequate, explicitly because it lacked the detail needed to establish whether the measures would actually address the original infringement. The Commission's own statement, as reported, says it accepted the plan after taking that opinion into account and clarifying requirements Temu must still meet during implementation. In other words, the bar for what counts as a sufficient risk assessment was not fully defined at the moment of acceptance. It is being defined afterwards, through the interim assessment due by 30 November 2026 and the external audit that follows.

That matters because the thing the Commission is actually testing, under both the original Article 34 obligation and this remedy plan, is whether a marketplace holds reliable, current, product-level evidence about what it sells, not generic claims that its policies address illegal goods in the abstract. Temu disputes the underlying fine, arguing the case concerns its 2024 assessment and does not reflect its current systems, and welcomed the plan's approval. Approval of the plan changes neither of those positions: it does not cancel the €200 million fine, and it does not establish that the platform's product data is now adequate, only that the Commission is willing to test that through the interim assessment and audit still to come.

Why it matters for brands

This case is about a marketplace's obligations, not a brand's own, but the data the Commission is asking Temu to produce is the same data every brand selling through a large online platform ultimately depends on being accurate: per-product evidence of compliance status, not a policy statement that products are checked. A platform-specific risk assessment built on reliable, current information means Temu's own audit trail will increasingly ask what a listing's seller can actually document, CE marking, REACH restrictions, toy safety limits, rather than accept a generic assurance. Brands and third-party sellers that cannot produce that evidence per SKU are the raw material of exactly the systemic risk the Board for Digital Services said Temu's plan had not yet proven it could measure. A marketplace under this level of regulatory scrutiny has every incentive to push that documentation burden onto sellers faster than a voluntary compliance timeline would, and the brands with clean, current, per-product compliance data are the ones least exposed when it does.

Frequently asked questions