EU accepts Temu action plan on illegal goods and starts four month compliance clock

Temu, the steeply discounted online marketplace owned by PDD Holdings, has spent two years at the centre of Brussels' effort to make large ecommerce platforms answerable for what third party sellers list on their pages. On October 26, 2026, that dispute moved from punishment to supervised repair, when the European Commission accepted the company's plan for fixing the failures that led to a €200 million penalty earlier this year.

The decision closes one chapter of a case that began in October 2024, when the Commission opened a formal investigation into whether Temu was meeting its obligations as a designated Very Large Online Platform under the Digital Services Act. That law requires the largest platforms to identify systemic risks flowing from their own design choices, from illegal products to disinformation, and then to show, with evidence, that the measures they deploy actually reduce those risks.

The case against Temu centred on a narrower question: whether the company's risk assessment was a genuine piece of analysis or a document assembled from generic material about online shopping. Regulators concluded it was the latter. The consequence was a fine issued on 28 May 2026, and a compliance order that obliged Temu to come back with something more rigorous.

What the Commission announced on October 26 is not the end of that order. It is the acceptance of the blueprint Temu will follow while it works through it, with a four month window and an independent audit waiting at the end.

Key Facts

The European Commission said the plan rests on five measures. Temu will carry out a risk analysis specific to its own platform rather than relying on general market data. It will adopt reliable metrics for judging whether its mitigation measures are actually cutting the spread of illegal content. It will assess the limits of its content moderation. It will analyse whether and how its recommender systems push illegal goods towards shoppers. And it will examine how sellers may deliberately manipulate Temu's features to spread potentially illegal listings.

Reuters reported on October 26 that the Commission had accepted the plan and that Temu now has four months to complete an interim risk assessment. The same report put the May penalty at €200 million, equivalent to $224.08 million at the time, and noted that Temu is owned by PDD Holdings.

The timetable is tight and unusually specific. The interim risk assessment must cover a six month period running until 30 November 2026. The Irish Examiner reported on October 26 that the measures will be subject to an external and independent audit, which Temu has committed to perform. The paper also noted that Temu's EU headquarters is in Dublin, placing the company inside the bloc's regulatory perimeter in a way that matters for enforcement.

Euronews reported on October 26 that Temu has 130 million users across the 27 member states, nearly a third of the bloc's population. That figure explains why the Commission treated the case as systemic rather than incidental: a risk assessment error on a platform of that scale translates into a very large number of exposures to unsafe goods.

Context around the case has widened since the spring. Reuters reported on October 26 that the EU has imposed €3 fees on low value ecommerce packages since the start of July, a regime that previously allowed parcels worth less than €150 to enter the bloc duty free. Euronews reported on October 26 that imports from China have slumped by 30 percent to 40 percent since those rules took effect. The Next Web reported on October 26 that the Commission fined AliExpress €550 million in July, its largest penalty under the DSA to date, and that the law allows fines of up to 6 percent of a platform's worldwide annual turnover.

Analysis

The enforcement sequence here is worth reading closely. The Next Web reported on October 26 that the Commission found Temu's 2024 risk assessment relied on general information about online shopping rather than evidence specific to its own platform, which led the company to underestimate the likelihood that EU shoppers would encounter illegal products. Test purchases by an independent laboratory found that many chargers failed basic safety checks, while several baby toys posed medium to high risks, including exposure to banned chemicals and choking hazards from small parts.

That finding is the heart of the matter, and it is a procedural one dressed as a product safety case. The DSA does not simply ban dangerous goods, which consumer law already did. It requires platforms to build a credible account of how their own systems create risk, and to test whether their fixes work. A company can pass the first test with a document full of generalities and still fail the second, which is precisely what happened to Temu in May.

What this really means is that Brussels is now regulating the quality of a company's self-knowledge. Temu is not being asked to guarantee that no unsafe charger ever appears on its marketplace. It is being asked to demonstrate that it knows where the risk comes from, that its metrics can detect change, and that its recommender systems are not quietly amplifying the problem. The acceptance of the plan is a judgement about method, not about outcomes, and the independent audit is where outcomes will eventually be tested.

There is a commercial logic to Temu accepting these terms rather than litigating. The fine is fixed and already booked. The bigger exposure sits in the 6 percent turnover ceiling and in the possibility of periodic penalties if the plan is not delivered. A supervised remediation path lets the company convert an open ended compliance failure into a bounded project with a deadline, which is easier to explain to investors than a running dispute with the Commission.

Why It Matters

The direct consumer stakes are concrete. The Commission's May decision referred to unsafe baby toys containing chemicals above legal safety limits and items posing suffocation risks, and stated that consumers in the EU are very likely to encounter illegal items on Temu. The plan's fifth measure, which looks at sellers intentionally manipulating platform features to push illegal listings, acknowledges that some of this is adversarial behaviour rather than passive oversight failure.

The wider significance is procedural. Every Very Large Online Platform under the DSA faces the same obligation to assess systemic risk. What the Commission has now produced, in the Temu file, is a template: five workstreams, a defined interim assessment period, and an independent audit. Platforms watching from the sidelines, including Shein and other low cost ecommerce operators facing the same €3 parcel fees, can expect that template to be applied to them.

For European consumers and for the sellers who compete on price with Chinese marketplaces, the credibility of the exercise depends on the audit. A plan that produces a rigorous risk assessment and measurable mitigation would justify the Commission's claim that the approved measures mark an important step towards strengthening consumer protection online. A plan that produces documents without changed outcomes would undermine the whole supervisory model, and would invite questions about why the first fine was not larger.

Next Up

The clock runs to 30 November 2026 for the interim risk assessment covering the six month period. Temu has said it welcomes the approval and described the plan as a testament to its commitment to investing in robust compliance infrastructure. Its work now moves from negotiation to execution, with the external audit as the next publicly visible checkpoint.

The Commission retains the option of further enforcement if the audit or the interim assessment falls short. For Brussels, the Temu file is also a test of whether the DSA's cooperative remediation model can deliver faster than the litigation it replaced, and whether a marketplace with 130 million EU users can be supervised closely enough to make the difference visible to the shopper.