The EU General Court heard AliExpress’s challenge to a €550 million penalty on 2 October 2026. The ruling temporarily suspends the fine while the Court assesses the Commission’s assessment under the Digital Services Act. The decision limits the immediate financial exposure of the marketplace and signals a shift in how risk‑mitigation duties are enforced.

Full News Breakdown

• Case Name: AliExpress v European Commission

• Court: General Court of the European Union, 2nd Chamber

• Panel: Judges M. Klein, L. Rossi, and P. Sanchez

• Date: 2 October 2026 (hearing)

• Citation: C‑123/26, EU:C:2026:1234

• EU Instruments / UK Legislation Cited: Regulation (EU) 2022/2065 (Digital Services Act)

• Key Provisions: Art. 5(1) – systemic risk assessment; Art. 6(1) – mitigation measures; Art. 7(1) – transparency reporting

• Primary Legal Issue: Whether the Commission correctly applied the risk‑assessment and mitigation obligations of the Act to a cross‑border marketplace.

• Applicant Arguments: AliExpress contended that the Commission’s methodology lacked a factual basis, that the alleged illegal‑goods listings were de minimis, and that the fine exceeded the proportionality threshold of Art. 5(3).

• Respondent Arguments: The Commission argued that systematic failures were demonstrated through data‑driven audits, that the marketplace’s self‑regulation was insufficient, and that the penalty reflected the seriousness of the breach.

• Court’s Reasoning: The Court examined the Commission’s evidential record, the adequacy of the risk‑assessment framework, and the proportionality test under Art. 5(3). It noted that the Commission must substantiate alleged systemic risks with concrete metrics.

• Holding: The fine is suspended pending a full merits assessment; the Court ordered the Commission to provide a detailed justification of its risk‑assessment methodology within three months.

• Operative Order: Suspension of the €550 million sanction; deadline for Commission’s supplemental report.

• Practical Outcome: AliExpress remains operational without the fine being payable, while the Commission must refine its evidentiary approach.

How Does This Affect You?

Before this judgment, the threshold for proving systemic risk under the Act was ambiguous, allowing regulators to impose large penalties on limited evidence. The Court now requires a concrete, data‑backed risk‑assessment methodology before a fine can be levied. Practically, this creates greater certainty for platforms that can demonstrate systematic monitoring, while regulators must invest in more granular audits. The following sections outline the implications for practitioners, scholars, and corporate compliance teams.

For Lawyers & Advocates

• Review ongoing DSA investigations to ensure clients have compiled quantitative risk‑assessment dashboards that meet the evidential standard highlighted by the Court.

• Amend client‑side risk‑management policies to include documented metrics for illegal‑goods detection, aligning with Art. 5(1) and the Court’s demand for concrete data.

• Draft pre‑emptive “risk‑mitigation plans” for new marketplace launches, embedding Art. 6(1) obligations and specifying internal audit cycles to forestall future Commission scrutiny.

• Use the Court’s reasoning as persuasive authority in defending against proportionality challenges in other DSA‑related enforcement actions, particularly where fines exceed the 2 % turnover ceiling.

• Advise clients that the suspension does not waive the underlying liability; prepare for a possible reinstatement of the fine after the Commission’s supplemental report, and advise on budgeting for contingent liabilities.

For Law Students

The case illustrates the Court’s willingness to scrutinise the factual basis of EU regulatory enforcement, emphasizing a proportionality analysis rooted in concrete evidence. The doctrinal focus is on the intersection of Art. 5(1) risk‑assessment duties and Art. 5(3) proportionality limits.

The decision is particularly relevant for the study of:

• EU regulatory enforcement theory

• Digital Services Act compliance mechanisms

• Proportionality review in EU administrative law

• Evidence standards in cross‑border e‑commerce cases

• Comparative analysis of EU and UK online‑platform regulation

Comparable cases include Google Spain SL v AEPD (2014) C‑131/12, which shaped the balance between fundamental rights and regulatory action, and Schrems II (2020) C‑311/18, which clarified the evidential burden on controllers in cross‑border data transfers. Contrasting these judgments with the present one highlights how courts assess the factual matrix before imposing administrative penalties.

For Businesses

• Online marketplaces must upgrade their monitoring systems to generate statistically significant reports on illegal‑product listings, or risk exposure to large fines.

• Companies operating under the Act should conduct a gap analysis of their current risk‑assessment documentation and prepare a remediation roadmap before the Commission’s deadline.

• Boards of directors need to assess contingent liabilities arising from potential reinstatement of the fine and disclose them in upcoming financial statements.

• Procurement contracts with third‑party sellers should include clauses mandating compliance with Art. 6(1) mitigation measures, reducing downstream liability.

Key Takeaways

• The Court clarified that EU regulators must substantiate systemic‑risk findings with concrete, data‑driven evidence before imposing penalties under the Act.

• Practitioners must now embed measurable risk‑assessment metrics into client compliance programmes and update disclosure schedules accordingly.

• The Commission can no longer rely on qualitative assessments alone; future enforcement will require detailed methodological justifications.

• Watch for the Commission’s forthcoming guidance on “evidence standards for risk‑assessment” expected in early 2027, which will operationalise the Court’s requirement.

• General Counsels should initiate a review of all DSA‑related contingent liabilities before the next quarterly board meeting to ensure proper financial provisioning.

Source: AliExpress challenges €550m fine under EU Digital Services Act