- with readers working within the Pharmaceuticals & BioTech industries
- within Consumer Protection, Corporate/Commercial Law and Environment topic(s)
On 20 July 2026, the European Commission fined AliExpress €550 million for failing to diligently assess and mitigate the systemic risk that illegal, unsafe and counterfeit products spread through its marketplace. It is the largest penalty issued under the Digital Services Act to date.
What the Commission actually found
The decision splits into two limbs.
On risk assessment (Article 34), the Commission found that AliExpress fell short of Article 34 in three respects. First, it never realistically checked if its moderation resources matched the scale of the task, “[failing] to realistically take into account the disproportion between the number of human moderators and their workload”. Second, it overlooked how its own recommender and advertising systems were compounding the problem, actively surfacing and promoting illegal products to users. Third, its analysis leaned on a single quantitative metrics one that never actually measured whether illegal listings were appearing, or resurfacing in modified form, in the first place.
On mitigation (Article 35), the findings are more operational in nature. Detection was slow: illegal listings, including counterfeits, unsafe toys, and dangerous cosmetics, stayed live for weeks after they had been flagged. The seller-penalty policy existed on paper but went unenforced, allowing penalised sellers to keep trading. Product-compliance checks could be sidestepped through mis-categorisation, because too few staff were verifying categories before listings went live. And the mandatory “brand authorisation” gate, intended to keep counterfeits out, was, in the Commission’s assessment, understaffed and easily circumvented.
Two mitigating factors reduced the fine: the infringements ran only until June 2025, when preliminary findings issued, and the novelty of the DSA framework.
Why this matters for marketplaces and beyond
Resourcing is now a legal question. The Commission treated the ratio of moderators to workload as a compliance failure, not a matter of business judgment.
A single metric may not be a metric at all. Leaning on one indicator, especially one that counts removals rather than recurrence, will not withstand scrutiny. Assessments need measures that capture reappearance, evasion, and circumvention.
Recommender and advertising systems are part of the risk surface. The Commission tested the platform itself and used the results as evidence. Assume that anything a regulator can observe from the consumer side of your product is discoverable, and assess amplification pathways explicitly.
Paper policies can be worse than none. A penalty policy that is documented but unenforced, or an authorisation gate that is mandatory but understaffed, was treated as an aggravating detail rather than a partial defence.
What happens next
AliExpress has until 20 October 2026 to submit an action plan setting out remedial measures. The European Board for Digital Services then has one month to opine, and the Commission a further month to adopt a final decision and set an implementation period. Non-compliance with that decision exposes the platform to periodic penalty payments, which is a recurring liability, distinct from the fine already imposed. DSA fines can reach 6% of worldwide annual turnover, so the current figure is not the ceiling.
Practical steps
For clients with DSA obligations:
- Re-read your last risk assessment as a regulator would. Ask whether each effectiveness claim is supported by data, and whether the metrics measure recurrence as well as removal.
- Reconcile controls as designed against controls as operated. Sample your own enforcement: are penalised sellers actually off the platform? Are categorisation checks running before publication?
- Document the resourcing analysis. Capacity versus demand, with numbers, is now an expected component of a defensible assessment.
We advise platforms, brand owners and marketplace sellers on DSA compliance, systemic risk assessment and Commission proceedings.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]