A €200 Million Fine, Now a Compliance Test
August 28, 2026 was the deadline for Temu to hand the European Commission something harder to write than a check: a plan proving it can actually assess the risks its own platform creates. The deadline stems from a €200 million fine the Commission imposed on May 28, 2026 — the largest Digital Services Act (DSA) penalty issued to date — after finding that Temu "failed to diligently identify, analyse and assess" the systemic risk of illegal products being sold to EU consumers (European Commission).
Under Article 75 of the DSA, once the Commission finds an infringement of the systemic-risk obligations that apply to Very Large Online Platforms, the platform must submit a remediation action plan on a set timeline. The Digital Services Board then has one month to issue an opinion, after which the Commission has a further month to decide whether the plan is adequate and to set an implementation period (EUR-Lex, Regulation (EU) 2022/2065). Miss the mark, and periodic penalty payments follow. Temu is now the second platform to be walked through this pipeline, after X's €120 million fine in December 2025 for its verification, ad-transparency and researcher-access failures (The Register).
The Case for the Commission
The regulator's underlying complaint is not abstract. Commission testing found that a very high share of phone chargers sold on Temu failed basic electrical safety standards, and that numerous baby toys carried medium-to-high safety hazards from excess chemicals or small detachable parts (Tech Policy Press). Temu's own 2024 risk assessment — filed after it crossed the 45-million-user VLOP threshold in May 2024 and swelled to roughly 92 million EU users by that September (ppc.land) — reportedly leaned on generic e-commerce sector data rather than evidence specific to its own marketplace, and did not examine how its recommender systems or influencer-affiliate program might amplify the spread of unsafe listings.
That is a fair complaint to take seriously. Risk assessments are the DSA's foundational mechanism precisely because they're supposed to force a platform to look honestly at its own product, not benchmark against industry averages. EU Commission Executive Vice-President Henna Virkkunen made this argument explicitly, calling risk assessments "the backbone" of DSA compliance rather than a box-ticking exercise. A platform selling suffocation-hazard toys to European toddlers because it never bothered to test its own supply chain is not a hypothetical harm — it is the exact failure mode systemic-risk rules exist to catch, and a fine plus a mandated correction plan is a proportionate response to a genuine, checkable failure.
Where the Standard Gets Slippery
Where this gets harder to defend is in how "adequate" risk assessment is actually defined. The DSA does not specify a methodology threshold platforms can test their work against in advance; the Commission's finding effectively sets the bar after the fact, through enforcement rather than published guidance. For a marketplace listing hundreds of millions of third-party SKUs, the line between "appropriately specific risk assessment" and "impossible obligation to audit every product category to Commission satisfaction" is not obvious, and it will only become clearer case by case, fine by fine. That is a slow and expensive way for the industry to learn the rules, and it disproportionately burdens the platforms — often not the largest incumbents — that don't have Brussels compliance teams built for iterative regulatory guesswork.
The Article 75 process itself, to its credit, builds in a negotiation rather than a unilateral ultimatum: Temu gets to propose its own remedy, the Board opines, and the Commission adopts a final implementation timeline rather than dictating specifics up front. That structure is more proportionate than a blunt penalty-and-walk-away model, and it's worth crediting the DSA's designers for building in that off-ramp. But it only works if the Commission is transparent, quickly, about what satisfied the standard in Temu's case — otherwise every subsequent VLOP risk assessment is written in the dark, guessing at a bar that keeps moving with each new enforcement action.
What Comes Next
The Board's opinion is due roughly a month after August 28, with a Commission decision to follow. Whether that becomes a template other marketplaces can actually build compliance programs around, rather than a one-off case study, is the real thing to watch — not the size of the fine, which has already been paid and reported. Enforcement that stops at "be more diligent" doesn't help the next platform navigating the same threshold; enforcement that publishes what "diligent" looked like in practice does. The Commission has the tools to make Article 75 a genuine compliance roadmap. It should use this case to show its work.