Law & Regulation

Brussels Fined the Risk Assessment, Not the Fakes

The Commission fined AliExpress EUR 550 million under the DSA. Read the findings and the infringement is about staffing and self-assessment, not only counterfeits.

Law & RegulationBy Servola Tech Desk2026-07-205 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Brussels Fined the Risk Assessment, Not the Fakes

Key takeaways

The European Commission fined AliExpress EUR 550 million on 20 July 2026, and a large part of what it fined was the company's own paperwork: the Commission found AliExpress had not properly evaluated whether it had enough people to review the risks it was required to assess.
This is the third fine issued under the Digital Services Act and by far the largest. X was fined EUR 120 million and Temu EUR 200 million. The curve is steepening much faster than the underlying harm is changing.
Overestimating your own automated detection is now part of the infringement. The Commission found AliExpress overstated how effective its system was at detecting and removing illegal listings.
The brand authorisation system meant to block counterfeits was found ineffective and understaffed, and traders circumvented it easily. A control that exists in a policy document but not in headcount is a finding waiting to happen.
The fine is the opening, not the settlement. AliExpress must propose remedial measures by 20 October, the Commission assesses compliance in December, and failure can trigger periodic penalty payments on top of the 550 million.

The number landed on a Monday morning

The European Commission announced on 20 July 2026 that it had fined AliExpress EUR 550 million for breaching the Digital Services Act. The Commission's finding is that the marketplace fell short of its obligation to diligently assess the risk of dissemination of illegal, unsafe or counterfeit products, and failed to take effective measures to reduce that risk.

Henna Virkkunen, the Commission's tech chief, framed the harm in two directions at once. The situation is "very dangerous for consumers, unfair for companies which are complying", she said. That second clause is the one most coverage skipped, and it is the one that matters to anyone who has spent money building the controls a competitor did not.

AliExpress called the fine disproportionate and said it was carefully reviewing the decision. That response sets up months of argument. It does not pause the clock the decision started.

The finding is about headcount, not takedowns

Read the findings closely and a pattern emerges that is not really about counterfeit phone chargers. The Commission found that AliExpress had not properly evaluated whether it had enough people to review the risks, and that it had overestimated the effectiveness of its own system for detecting and removing illegal products. Those are findings about a company's description of itself.

The DSA requires very large platforms to produce a risk assessment. It is easy to read that obligation as a document exercise, and easy to write the document in the confident register that internal reporting tends to reward. The Commission has now treated that document as a testable claim. If the assessment says the detection system works and the detection system does not, the gap is not a communications problem. It is the infringement.

The same logic runs through the rest of the decision. The mandatory brand authorisation system, designed to stop counterfeit sales, was found to be ineffective and understaffed, and easily circumvented by traders selling fakes. The penalty policy was ineffective, so sellers who had been penalised carried on selling illegal goods. Illegal items remained online for many weeks. Each of those is a control that existed on paper and was not resourced to work.

One hundred twenty, two hundred, five hundred fifty

Three DSA fines have now been issued. X was fined EUR 120 million. Temu was fined EUR 200 million. AliExpress has been fined EUR 550 million. The third number is larger than the first two combined by a wide margin.

It is tempting to read that curve as a measure of how much worse each case was. A more useful reading is that the Commission is calibrating upward until the fine exceeds what compliance would have cost. A penalty that lands below the price of hiring the moderation staff and building the enforcement tooling is simply a licence fee, and every platform finance team knows how to model a licence fee. A penalty that lands above it changes the build-or-pay calculation.

For operators well below the very-large-platform threshold, the direct exposure is limited. The signal is not. Enforcement priorities set at the top of the market become the template for what national regulators look for further down it, and the questions being asked here translate cleanly to any business that hosts third-party listings, reviews or user submissions.

October is the deadline that actually bites

The fine is the visible part of the decision and the least consequential. AliExpress must propose remedial measures by 20 October. The Commission will assess in December whether those measures bring it into compliance. Failure to comply with the non-compliance decision may lead to periodic penalty payments, which accrue continuously rather than arriving as a single number.

That structure is the point. A one-off fine can be absorbed, disclosed and moved past. Periodic penalty payments cannot, because they do not stop until the underlying problem is fixed, which means the company has to actually resource the fix rather than argue about the assessment of it.

The Commission also said it would continue engaging with the company to ensure compliance with the decision and with the DSA more generally. Read plainly, that means this file stays open. The EUR 550 million is the entry price for a supervisory relationship, not an exit from one.

What to change before your next risk assessment

The first change is to stop writing risk assessments in marketing voice. If your document says a detection system is effective, someone should be able to produce the measurement that supports it, including the false-negative rate. Where you do not have the measurement, write that you do not have it. An honest gap is defensible. An overstatement is now an infringement finding.

The second is to tie every named control to a number of people. The brand authorisation failure here was not a design failure, it was a staffing failure attached to a well-designed control. For each control in your compliance documentation, record who runs it, how many of them there are, and what volume they can actually process. If that arithmetic does not work, the control does not work, and writing it down is what makes the gap visible before a regulator finds it.

The third is to check what happens after you penalise someone. The Commission found that penalised sellers continued to sell illegal products, which means the sanction existed but the follow-through did not. Whatever your equivalent is, whether a suspended account, a delisted supplier or a warned user, test whether the sanction actually holds a week later. Most organisations have never checked.

Frequently asked questions

Does this decision apply to smaller marketplaces and platforms?

Not directly. The obligations breached here apply to very large online platforms designated under the DSA. But the reasoning, particularly the link between a claimed control and the staffing behind it, is what national regulators will carry into smaller cases.

Is AliExpress required to pay the EUR 550 million now?

The company has said the fine is disproportionate and that it is carefully reviewing the decision, which points toward a challenge. The separate remediation timetable, with proposals due by 20 October and a Commission assessment in December, runs regardless of how that argument develops.

What are periodic penalty payments?

They are recurring penalties the Commission can impose if a company does not comply with a non-compliance decision. Unlike the headline fine, they continue to accrue over time, which is why they tend to force remediation faster than a single large number does.

The lasting lesson of this decision is not that counterfeits are expensive. It is that the document describing your controls has become evidence. Regulators now read the risk assessment first and check it against the org chart second, and the gap between the two is where the fine gets calculated.

European CommissionDigital Services ActAliExpresscontent moderationHenna Virkkunenmarketplaces

Label Your AI Text or Give It an Editor

The Commission published the final Article 50 transparency guidelines on 20 July 2026. From 2 August, a deployer who publishes AI-generated text on a matter of public interest without human editorial review has to disclose it.

4 min read

Energy

Only Finland and Sweden Meet the New Power Ratio

The Commission's Electrification Action Plan asks member states to cut the electricity-to-gas price ratio to 2.0 for industry by 2030. Two countries already do.

5 min read