DSA Risk Assessment Failures: Lessons From The €550M AliExpress Decision

On 20 July 2026, the European Commission fined AliExpress €550 million for failing to diligently assess and mitigate the systemic risk that illegal, unsafe and counterfeit products spread through its marketplace. It is the largest penalty issued under the Digital Services Act to date.

What the Commission actually found

The decision splits into two limbs.

On risk assessment (Article 34), the Commission found that AliExpress fell short of Article 34 in three respects. First, it never realistically checked if its moderation resources matched the scale of the task, “[failing] to realistically take into account the disproportion between the number of human moderators and their workload”. Second, it overlooked how its own recommender and advertising systems were compounding the problem, actively surfacing and promoting illegal products to users. Third, its analysis leaned on a single quantitative metrics one that never actually measured whether illegal listings were appearing, or