The European Commission on October 26 accepted Temu’s action plan to fix its breach of the Digital Services Act (DSA), the EU law that sets obligations for online platforms. The plan responds to a May decision in which the Commission fined the marketplace €200 million for failing to properly assess the risk of illegal products being sold to EU consumers.
Temu submitted the plan in August. It addresses the company’s risk assessment obligations concerning the spread of illegal products on its marketplace, according to the Commission’s announcement.
What Temu committed to
The Commission listed five measures in the accepted plan. Temu will:
- Carry out a risk assessment tailored to its own service, using reliable, up-to-date information on risks linked to the platform’s design, functioning and use.
- Use reliable metrics and indicators to judge whether its mitigation measures reduce the spread of illegal content.
- Assess and explain the limitations and shortcomings of its proactive content moderation system, and their effect on recommended products.
- Analyze how its recommender and other algorithmic systems may influence or amplify the spread of illegal content.
- Examine intentional manipulation of the service and the rapid, wide spread of illegal content, including how traders and other users may exploit its features to list illegal products.
Deadlines and oversight
Temu has four months to implement the plan. It must also carry out an interim risk assessment covering a six-month period up to November 30, 2026. Temu has committed to an external, independent audit of the measures, which must be submitted to the Commission within four months after implementation. If the auditor makes recommendations, Temu must report on how it has implemented them within one month.
The European Board for Digital Services was consulted and gave its opinion on September 24. The Board found the proposed changes partially adequate but said the plan lacked enough detail to fully assess whether it would address the infringement. The Commission said it took that opinion into account, clarified key requirements Temu must meet when implementing the plan, and will closely supervise implementation, focusing on the issues the Board found inadequately explained.
How the case got here
The Commission opened formal proceedings against Temu on October 31, 2024, after formal requests for information sent on June 28 and October 11, 2024, according to its May 28 press release. It issued preliminary findings in July 2025 that Temu was suspected of breaching Article 34 of the DSA, which covers the assessment of systemic risks.
In the May 2026 decision, the Commission found that Temu’s 2024 risk assessment relied on general information about the e-commerce sector rather than evidence specific to Temu’s service, seriously underestimated how often EU consumers would encounter illegal items, and did not properly assess how its design, including recommender systems and influencer product promotion, could amplify the spread of illegal products. The Commission said a mystery shopping exercise found that a very high share of tested chargers failed basic safety tests and a high share of tested baby toys posed safety risks. It did not publish exact percentages in the announcement.
“Risk assessments are not box‐ticking exercises,” Henna Virkkunen, Executive Vice-President for Tech Sovereignty, Security and Democracy, said at the time. The May decision gave Temu until August 28, 2026 to submit an action plan under Article 75 of the DSA, followed by one month for the Board to give its opinion and one further month for the Commission to adopt a final decision.
Why it matters
For merchants selling in the EU, the plan commits Temu to measuring how illegal products reach shoppers on its service, and how its recommender systems and the behavior of traders on the platform affect that spread. The fifth measure specifically covers traders and other users who exploit Temu’s features to list illegal products, and the Commission’s May findings singled out influencer product promotion as a design feature Temu had not properly assessed.
For other large marketplaces, the case shows how the Commission uses DSA risk-assessment duties in practice. The May decision set out what the Commission considered inadequate, including reliance on sector-wide data instead of service-specific evidence, and the October decision adds an audit and reporting timetable.
What to watch
Temu has four months to implement the plan, and its interim risk assessment covers the period up to November 30, 2026. The independent audit report is due within four months after implementation. The May press release said that failure to comply may lead to periodic penalty payments.
The caveats
This story is based on the Commission’s own announcements. The Commission’s October pages do not include a statement from Temu, and the May release’s mystery shopping results were described only in general terms.
