Design ReviewEU DMA

DMA Article 13 Anti-Circumvention Design Review

A focused review format for product, interface, commercial, contractual, and technical changes that could undermine a gatekeeper's DMA obligations.

Use it to map a change to Articles 5, 6, and 7, test whether rights or choices become harder to exercise, and preserve evidence suitable for Article 11 compliance reporting.

Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
Overview

DMA Article 13 prohibits service fragmentation used to avoid Article 3 thresholds and conduct that undermines effective compliance with Articles 5, 6, and 7, including contractual, commercial, technical, behavioural, and interface-design choices. Start with the listed and exact underlying obligation. The review should end with a recorded pass, conditional pass with required changes, or block decision, plus the evidence and monitoring trigger. Security, integrity, or privacy restrictions are available only where the mapped obligation permits them and their stated conditions are met.

Section 1

When an anti-circumvention design review is needed

Run this review before a designated gatekeeper changes a , adjacent support service, user interface, application programming interface (API), ranking system, consent flow, access condition, fee model, business-user term, interoperability process, data-access process, or enforcement workflow that implements or touches a DMA Article 5, 6, or 7 obligation.

The review should also cover changes that split a service, recategorize usage, move functionality between services, add friction to an alternative channel, or change how users exercise a DMA right. Article 13 expressly covers segmentation or fragmentation used to circumvent designation thresholds and behavior that undermines effective compliance.

Keep the pre-designation threshold branch separate from the gatekeeper-compliance branch. Article 13(1) addresses an undertaking providing core platform services that fragments them to avoid thresholds. Article 13(3) to (8) addresses a gatekeeper's full and effective compliance with Articles 5, 6, and 7.

  • Start with the Commission designation decision or current gatekeeper list: name the undertaking, designated , and affected user group.
  • Identify the DMA obligation affected by the change, such as choice screens, data use, business-user access, app-store access, interoperability, ranking, portability, or complaint rights.
  • Classify the change mechanism: contractual term, commercial condition, technical implementation, behavioral technique, interface design, service segmentation, or operational policy.
  • Escalate if the change makes a DMA right slower, less visible, more expensive, conditional on a gatekeeper service, or harder to exercise than the gatekeeper's own equivalent path.
  • Reopen the review after a material design change, rollout to another listed service or Member State, a metric deterioration, a complaint pattern, a Commission request or decision, or a changed security, privacy, or integrity justification.
Section 2

Map the design change to the protected DMA obligation

The question depends on the underlying obligation. A payment-flow change should be tested against the Article 5 and Article 6 rights it affects; an API or operating-system change should be tested against the relevant interoperability or access obligation; a consent or choice-screen change should be tested against whether the user's choice remains neutral and practicable.

Do not approve a change only because the formal obligation text is still mentioned in policy. The review has to test whether the implemented product path remains effective for the business user, end user, advertiser, publisher, developer, or third-party provider that the obligation is meant to protect.

  • Create one row per affected DMA obligation with article reference, , user group, current control, proposed change, and risk.
  • For user-interface changes, capture screenshots or click paths before and after the change and note whether choices are displayed neutrally.
  • For technical access changes, record API scope, access conditions, documentation changes, testing results, security or integrity justification, and any less restrictive alternatives considered.
  • For commercial or contractual changes, compare old and new fees, revenue-share rules, access conditions, termination conditions, complaint clauses, and business-user pricing restrictions.
Section 3

Gatekeeper controls that should stop weak designs

A design review should have stop conditions, not just comments. If a change affects a DMA right, the approver should be able to point to a test result, user journey, or technical record showing that the right remains usable and that any security, integrity, or privacy restriction is justified and proportionate.

Article 13 makes interface structure, design, function, and manner of operation relevant. That means testing for interface choices that steer or obstruct users, neutral presentation checks, friction analysis, and degradation checks belong in the product release control. A security, integrity, or privacy concern is not a free-standing Article 13 exception; the underlying obligation must permit the measure, and the gatekeeper must satisfy that obligation's necessity, proportionality, and justification conditions.

  • Block release if a protected choice becomes less prominent, more confusing, or bundled with unrelated acceptance steps without a documented basis.
  • Block release if a business user, developer, advertiser, publisher, or third-party provider loses existing practical access without an obligation-specific justification.
  • Block release if the change relies on security, integrity, or privacy reasons but the team has not documented why the measure is strictly necessary and why less restrictive options were rejected.
  • Block release if implementation evidence is not tied to the same and obligation that will appear in the gatekeeper compliance report.
Section 4

Evidence to keep for Article 11 reporting and later review

The evidence pack should let a reviewer reconstruct how the change affected a specific DMA obligation. Article 11 reporting expects detailed and transparent descriptions of compliance measures, and the Commission template asks for product scope, geographic scope, technical changes, customer-experience changes, consultations, alternatives, testing, indicators, and monitoring tools.

For , keep both approval evidence and rejected alternatives. The rejected-alternatives record is important where a gatekeeper chooses a more restrictive access path, warning, choice architecture, fee rule, or technical limitation.

  • Review header: change name, product owner, legal owner, affected , affected DMA article, launch geography, release date, and reviewer decision.
  • Implementation evidence: before-and-after user journeys, API or interface documentation, feature flags, access logs, metrics definitions, test plans, survey or A/B-test methodology, and monitoring dashboards.
  • User and business-user evidence: complaints, developer requests, advertiser or publisher feedback, consultation notes, support tickets, and changes made after feedback.
  • Control evidence: privacy, security, or integrity justification; less restrictive alternatives; approval history; compliance-function review; and links to the compliance-report annex that will describe the measure.
Section 5

Checklist for an anti-circumvention design review

Run this checklist at the release gate for DMA-relevant product and policy changes. The goal is to show that the change preserves effective compliance, not merely that the team considered DMA in general terms.

The checklist should be attached to the product-change record and reused when the same feature is localized, extended to another , or changed after user feedback.

For an operational example, suppose a proposed warning adds two confirmation screens only to a protected alternative route. The product owner records both paths and their completion data, while the legal reviewer identifies the affected obligation and tests the justification. A conditional pass should name the required redesign, its owner, and the evidence needed to close it before release; the label alone should not authorise the unresolved design.

What does DMA Article 13 add to an ordinary product design review?

Article 13 adds an test. A gatekeeper should check whether a design, interface, contractual term, commercial condition, technical measure, behavioral technique, or service split undermines effective compliance with Articles 5, 6, or 7, even if the formal product policy still refers to the DMA obligation.

Which evidence is most important for a DMA review?

The strongest evidence ties the change to a specific and DMA obligation, then shows the before-and-after user journey, technical implementation, access conditions, testing or indicators, complaints or feedback, rejected alternatives, and any security, integrity, or privacy justification.

Can a gatekeeper rely on security or integrity reasons to limit a DMA right?

The DMA allows certain strictly necessary and proportionate security, integrity, or privacy measures in specific obligations, but the gatekeeper should document the reason, the affected right, the alternatives considered, and why the chosen measure does not make the right unduly difficult to exercise.

Does DMA Article 13 apply only after gatekeeper designation?

No. Article 13(1) applies to an undertaking providing core platform services and prevents it from splitting or fragmenting services to circumvent the Article 3(2) thresholds. Article 13(3) to (8) governs a designated gatekeeper's full and effective compliance with Articles 5, 6, and 7.

  • The affected gatekeeper, , user group, and DMA article are named.
  • The change mechanism is classified as interface, technical, contractual, commercial, behavioral, segmentation, or operational.
  • Before-and-after evidence shows whether the protected right or choice remains easy to find, understand, and exercise.
  • Any restriction based on security, privacy, or integrity has a documented necessity and proportionality explanation.
  • Metrics exist to detect degradation after launch, such as completion rates, denial rates, access latency, opt-in or choice rates, complaints, and business-user request outcomes.
  • The compliance-function owner can retrieve the evidence for Article 11 reporting and annual updates.
  • The review record states pass, conditional pass, or block; lists every required change and owner; and names the event or monitoring result that will reopen the decision.
Primary sources

References and citations

eur-lex.europa.eu5 citations
Referenced sections
  • Primary legal source for DMA Article 13 anti-circumvention and the Articles 5, 6, and 7 obligations whose effective compliance must be preserved.
  • Article 13 is the legal basis for reviewing segmentation, contractual, commercial, technical, behavioral, and interface-design choices that could circumvent DMA obligations.
  • Articles 5, 6, and 7 define the obligations whose effective compliance must not be undermined by Article 13 circumvention.
Show 2 more
  • Article 13 expressly covers degradation, non-neutral choices, and user-interface design that subverts autonomy, decision-making, or free choice.
  • Article 13 supports the checklist focus on effective compliance, non-neutral choices, degradation, and interface-design circumvention.
"Anti-circumvention"
More quoted passages
"shall not engage in any behaviour that undermines effective compliance"
"The gatekeeper shall ensure that the obligations"
"structure, design, function or manner of operation"
"make the exercise of those rights or choices unduly difficult"
digital-markets-act.ec.europa.eu4 citations
Referenced sections
  • Commission template source for evidence expectations: technical changes, customer-experience changes, testing, indicators, feedback, monitoring tools, and compliance-function material.
  • Commission template asks gatekeepers to report technical and engineering changes, customer-interface changes, testing, indicators, and supporting data for each obligation.
  • Commission template supports the evidence fields for measures, user journeys, testing, indicators, raw data, monitoring systems, and assessment projects.
Show 1 more
  • Commission template supports the checklist requirement for implementation detail, testing, indicators, monitoring tools, and user or business-user feedback.
"detailed and transparent manner"
More quoted passages
"technical/engineering changes"
"internal systems and tools used to monitor"
digital-markets-act.ec.europa.eu2 citations
Referenced sections
  • Commission source for identifying designated gatekeepers and listed core platform services before scoping a design review.
  • Commission page for checking current gatekeeper undertakings and listed core platform services before scoping a design review.
"Gatekeepers"
More quoted passages
"Core platform services"
digital-markets-act.ec.europa.eu2 citations
Referenced sections
  • Commission source for DMA legislation materials, including the main DMA regulation and compliance-report template downloads.
  • Commission legislation page identifies the DMA as the main rules for gatekeeper designation and implementation of obligations and prohibitions.
"main rules for the designation of gatekeepers"
More quoted passages
"designation of gatekeepers and the implementation of the obligations"
Show all related guides (32)

DMA designation intake workflow for gatekeeper notifications

Build an official source DMA designation intake record covering core platform service classification, Article 3 thresholds, Form GD evidence, Commission handoff, and Article 11 readiness.

DMA enforcement, penalties, and remedies: Commission powers and evidence

Follow DMA enforcement from investigation and preliminary findings to non-compliance decisions, fines, daily payments, interim measures, commitments, and remedies.

DMA Gatekeeper Compliance Checklist for Articles 5, 6, 7 and 11

A cited EU Digital Markets Act checklist for designated gatekeepers: core platform service scope, Article 5/6/7 controls, Article 11 report evidence, anti-circumvention checks, and review gates.

DMA Gatekeeper Designation Guide: Article 3 thresholds, Form GD, and Article 11 readiness

A cited EU Digital Markets Act guide for assessing Article 3 gatekeeper thresholds, scoping core platform services, preparing Form GD evidence, handling rebuttal annexes, and planning Article 11 compliance reporting.

DMA penalties and fines: caps, triggers, and enforcement evidence

Compare DMA Article 30 fine ceilings, the narrow 20% repeat test, 1% procedural fines, and Article 31 daily payments, with decision-specific examples.

DMA Product Change Review Workflow for Articles 5, 6, 7, 11 and 13

Review DMA-relevant product releases for Article 5, Article 6, Article 7, anti-circumvention, Article 11 evidence, and product-owner/legal signoff.

DMA Self-Preferencing Compliance Examples for Ranking and Display

Examples and release-review controls for DMA Article 6(5) self-preferencing checks across ranking, indexing, crawling, search results, marketplaces, app stores, feeds, and virtual assistants.

DMA vs Data Act: gatekeeper duties compared with EU data-sharing rules

Compare the EU Digital Markets Act and EU Data Act by scope, actors, data access, interoperability, reporting, evidence, and enforcement without merging distinct obligations.

DMA vs DSA: Digital Markets vs Services Act

Compare the EU Digital Markets Act and Digital Services Act by covered services, regulated actors, core duties, reporting, dates, evidence, and enforcement.

DMA vs EU competition law: gatekeeper obligations, Article 11 evidence, and enforcement

Compare the EU Digital Markets Act with EU competition law: ex ante gatekeeper and core platform service duties, Articles 5 to 7, Article 11 reports, penalties, and evidence records.

DMA vs GDPR: gatekeeper data obligations compared

Compare DMA gatekeeper duties with GDPR rules for personal-data processing, consent, lawful basis, portability, accountability evidence, and enforcement.

EU Digital Markets Act Article 11 Evidence Calendar

Build a DMA Article 11 compliance-report calendar with the correct designation trigger, service annexes, evidence owners, annual updates, and publication gates.

EU Digital Markets Act checklist for gatekeeper compliance

A source-grounded Sorena DMA checklist for designated gatekeepers and core platform services, covering scope, Articles 5, 6 and 7 obligations, Article 11 reporting, evidence, anti-circumvention, and governance.

EU Digital Markets Act compliance: gatekeeper obligations and evidence

DMA compliance guide for designated gatekeepers: core platform service scoping, Articles 5, 6 and 7 controls, Article 11 reports, anti-circumvention checks, interoperability evidence, and enforcement risk.

EU Digital Markets Act deadlines and compliance calendar

Calculate DMA notification, designation, service-compliance, Article 11 reporting, concentration-notice, and profiling-audit deadlines from the correct legal trigger.

EU Digital Markets Act FAQ: gatekeepers, DMA obligations, reports, and enforcement

Concise FAQ on the EU Digital Markets Act for gatekeeper designation, core platform services, Articles 5, 6 and 7 obligations, Article 11 reports, interoperability, business-user data access, compliance evidence, and enforcement.

EU Digital Markets Act requirements for gatekeepers

DMA requirements for designated gatekeepers: core platform service scope, Articles 5, 6 and 7 obligations, Article 11 reporting, anti-circumvention, evidence, remedies, and fines.

EU Digital Markets Act timeline: application, designation, reporting, and review

DMA timeline separating fixed legal dates, threshold and designation clocks, recurring reports, service-specific decisions, final enforcement, and the first Article 53 review.

EU DMA Applicability Test: gatekeeper thresholds, core platform services, and evidence

Test whether the EU Digital Markets Act may apply to a platform service using the DMA gatekeeper criteria, core platform service categories, EU user thresholds, notification steps, and evidence records.

EU DMA Article 11 Compliance Reporting Guide

Official source guide to EU Digital Markets Act Article 11 compliance reports: report purpose, template evidence, non-confidential summaries, annual updates, and submission steps.

EU DMA do's and don'ts for product teams

Product release checks for designated DMA gatekeepers: Article 5, 6 and 7 obligations, anti-circumvention review, data access, interoperability, self-preferencing and Article 11 evidence.

DMA Article 11 Compliance Report Template FAQ

How gatekeepers should use the DMA Article 11 compliance report template to document obligation-by-obligation measures, evidence, updates, and non-confidential summaries.

DMA core platform services FAQ

FAQ on EU Digital Markets Act core platform services: Article 2 service categories, gatekeeper designation evidence, user thresholds, service scoping, and Article 11 reporting.

DMA gatekeeper thresholds: what counts and when to notify

Standalone FAQ on the EU Digital Markets Act gatekeeper thresholds, Article 3 notification timing, Form GD evidence, and active user-count methodology.

DMA interoperability requests: Article 7 and Commission guidance

How DMA Article 7 messaging interoperability requests work, including phased functions, the three-month operational deadline, reference offers, evidence, and safeguards.

What do DMA Articles 5, 6, and 7 require from gatekeepers?

FAQ explaining how EU Digital Markets Act Articles 5, 6, and 7 group gatekeeper obligations, what product evidence they require, and how Article 11 reporting connects.