On 26 October 2026 the European Commission accepted Temu's action plan to remedy its Digital Services Act (DSA) breach. The plan follows a May 2026 non-compliance decision that found Temu failed its risk-assessment obligations and imposed a €200 million fine. This is the first full cycle of the DSA's enforcement ladder: a finding, a fine, a remedy plan and supervised implementation. It is worth judging on its design, not only on the headline fine.
The strongest case for the Commission
The case for strict enforcement here is strong. According to the Commission's 28 May 2026 press release, Temu's 2024 risk assessment "seriously underestimated how often EU consumers are likely to encounter illegal items." The release adds that the Commission's mystery-shopping exercise found that "a very high percentage of the selected chargers failed basic safety tests, while a high percentage of tested baby toys posed safety risks of medium to high severity." Those are physical products with real injury potential, sold at scale to EU consumers. A risk assessment that rests on generic sector data rather than platform-specific evidence is not a harmless paperwork lapse. If systemic-risk duties are to mean anything, regulators must be able to say that a large platform did not look hard enough at its own system.
Slaughter and May's analysis of the decision notes that this was the second DSA fine and the largest so far. The first was the €120 million fine on X in December 2025. That makes the Temu remedy phase a precedent. It sets the template for how every later non-compliance decision is turned into operational change.
What the five measures actually require
The plan has five elements, per the Commission. Temu must carry out a platform-specific risk analysis. It must adopt reliable metrics to measure whether its mitigation measures actually reduce the spread of illegal content. It must assess the limits of its content moderation. It must analyse whether and how its recommender systems amplify illegal goods. And it must examine the influence of intentional manipulation, including sellers who exploit Temu's features to spread potentially illegal listings.
The plan is concrete about process. Temu has four months to implement it, with an interim risk assessment covering a six-month period to 30 November 2026. According to the Commission's page, an independent external audit is due within four months after the measures are implemented, and any auditor recommendations must be followed up within one month. The Commission says it will "closely supervise" the work.
This structure is better than a fine alone, because it converts a penalty into a testable obligation. The plan also reflects a principle that favours innovation: the DSA asks platforms to understand their own systems rather than prescribing a fixed technical fix. That keeps the rules adaptable as recommender systems and seller tools change.
Where proportionality needs watching
The risk is vagueness. The Commission's page says the Board for Digital Services found Temu's plan only "partially adequate" on 24 September, and that it lacked a sufficient level of detail. The Commission accepted the plan anyway. That is defensible, since waiting for perfect text would delay the fix. But it puts more weight on the next stages. The phrase "reliable metrics" does the heavy lifting in the plan, and the DSA does not define it. If the interim assessment reports figures that no outsider can check, the exercise becomes a more sophisticated version of the same problem: self-reported comfort.
A second concern is scope. Illegal products are the harm that the DSA aims at, and the evidence on unsafe chargers and toys is persuasive. But the measures that follow, such as recommender audits and detection of coordinated seller manipulation, are generic tools. Regulators should resist extending them into judgments about lawful but unpopular speech or listings. The pro-innovation reading of the DSA is that it should target demonstrable illegality and measurable consumer harm, not the mere existence of risk on a large platform. The Temu case is a good model on that test because the harm is product safety, which is well-defined in EU law.
A third concern is consistency. The first DSA fines were levied on very different platforms for very different failures. If the Commission wants this system to be predictable, it should publish what "reliable" metrics look like once it has reviewed them. Smaller marketplaces and new entrants will otherwise have to guess at the standard.
What to watch next
Three milestones will show whether the model works:
- The 30 November 2026 interim assessment. Does it contain platform-specific data, and does it show measured reductions in illegal-product exposure rather than lists of actions taken?
- The external audit. Independent review is the main check against self-grading, and the Commission should make the audit's key findings public.
- Periodic penalty payments. The decision warned that failure to comply may lead to periodic penalty payments. Whether the Commission uses them, or accepts a revised plan instead, will signal how seriously it treats follow-through.
Temu can also appeal the decision to the EU General Court, as Slaughter and May note, and a judgment on what Article 34 requires would be valuable for every platform.
Bottom line
The acceptance of Temu's plan shows the DSA working as designed: evidence of harm, a proportionate-looking financial penalty, a defined remediation process and independent audit. The test is no longer whether a platform will promise to do better. It is whether regulators and auditors can measure, with published numbers, that illegal products reach fewer EU consumers. If the answer is yes, the DSA will have shown that systemic-risk regulation can be evidence-based. If the metrics stay opaque, the criticism that enforcement is theatre will gain force.