Commission accepts Temu’s DSA corrective plan; implementation and audit still ahead
The European Commission has accepted Temu’s DSA corrective plan, but implementation and independent audit remain ahead. The case highlights the difference between approving measures and verifying their effectiveness.
Source published: 2026-10-26
Audience / jurisdiction: European Union; the enforcement action directly concerns Temu, with practical relevance for marketplace compliance teams, risk owners and internal auditors.
What changed, and who is affected
The European Commission announced on 26 October 2026 that it had accepted Temu’s corrective measures addressing a Digital Services Act risk-assessment infringement concerning illegal products. The development is an enforcement follow-up: an accepted plan now has to be implemented and tested. It is not a new regulation or a change to an ISO standard.
Temu is the direct subject of the action. For other marketplace compliance teams, risk owners and internal auditors, the announcement offers a practical illustration of the evidence expected behind risk assessment and corrective action. It does not extend Temu’s company-specific plan to every marketplace.
Sources: [1]
The plan focuses on service-specific risk and effectiveness
The accepted measures cover five connected areas. Temu is to assess risks using reliable, current information specific to its service and establish metrics for evaluating whether mitigation measures work. The plan also addresses limitations in content moderation, the potential for recommender systems and other algorithms to amplify risks, and intentional manipulation, including sellers exploiting platform features.
Together, those areas connect the risk assessment to how the marketplace actually operates. A description of a control is different from evidence that the control reduces exposure. Similarly, an assessment of illegal-product risk needs to consider not only the products themselves but also how platform features and seller behaviour can increase their visibility or weaken safeguards.
Sources: [1]
Publication, implementation and audit dates are different
The source publication date is 26 October 2026. That date should not be presented as a new general legal effective date. The Commission’s detailed account gives Temu four months to implement its plan and separately requires an interim assessment covering a six-month period ending 30 November 2026.
Temu has also committed to an external, independent audit. The audit report is due within four months after implementation of the measures. If the audit produces recommendations, Temu must report to the Commission on their implementation within one month.
These are distinct milestones, not a single completion deadline. Without the underlying decision’s operative date, converting the implementation period into a calendar deadline would introduce an unsupported assumption. Compliance reporting should keep implementation, assessment coverage, audit delivery and recommendation follow-up separate.
Sources: [1]
What remains unconfirmed
Acceptance does not establish that the measures have been completed or that their effectiveness has been verified. The European Board for Digital Services considered the proposed changes partially adequate but insufficiently detailed for a full assessment. The Commission says it clarified key requirements and will closely supervise implementation.
The next evidence therefore matters: what Temu implements, what the interim assessment demonstrates and what the independent audit finds. Describing the announcement as the final closure of the infringement would go beyond the available evidence. For management-system practitioners, the useful distinction is between approving a corrective plan and confirming that it has delivered its intended result.
Sources: [1]
Practical next steps for marketplace teams
As editorial suggestions rather than additional legal requirements, marketplace teams can use the case to review four aspects of their own arrangements: whether material risks are linked to service-specific evidence; whether recommendations, promotions and seller behaviour are considered; whether controls have effectiveness indicators; and whether corrective actions have named owners and clear closure evidence.
A hypothetical review could take one illegal-product risk and trace it from initial identification through moderation controls, visibility in recommendations, mitigation results and independent challenge. The purpose would be to identify missing evidence before declaring an action complete, not to reproduce Temu’s plan without considering the organization’s own circumstances.
Teams should also distinguish implementation evidence from outcome evidence. Recording that a measure was introduced answers a different question from demonstrating that it reduced the assessed risk. Keeping those questions separate can make management review and audit follow-up more useful.
Sources: [1]
Sources
Your experience
What evidence would your organization require before closing a corrective action intended to reduce illegal-product risk?
Worth sharing?
Pass this on to a colleague or your community.
Questions, experience & feedback
Join with an email-verified AdviseISO account to share your perspective. Reader comments are reviewed before publication. Your email address will not be displayed.
Be the first to share a question or experience.
Join the discussion
Create an account and verify your email, or sign in to your existing account.
Sign in Create accountYour draft stays in this browser tab for up to 24 hours. Avoid confidential information.