Design ReviewEU DMA

DMA Article 13 Anti-Circumvention Design Review

A focused review format for product, interface, commercial, contractual, and technical changes that could undermine a gatekeeper's DMA obligations.

Use it to map a change to Articles 5, 6, and 7, test whether rights or choices become harder to exercise, and preserve evidence suitable for Article 11 compliance reporting.

Author
Sorena AI
Published
May 9, 2026
Updated
Jul 24, 2026
Sections
5

Structured answer sets in this page tree.

Primary sources
4

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated Jul 24, 2026
Overview

DMA Article 13 prohibits service fragmentation used to avoid Article 3 thresholds and conduct that undermines effective compliance with Articles 5, 6, and 7, including contractual, commercial, technical, behavioural, and interface-design choices. Start with the listed and exact underlying obligation. The review should end with a recorded pass, conditional pass with required changes, or block decision, plus the evidence and monitoring trigger. Security, integrity, or privacy restrictions are available only where the mapped obligation permits them and their stated conditions are met.

Section 1

When an anti-circumvention design review is needed

Run this review before a designated gatekeeper changes a , adjacent support service, user interface, API, ranking system, consent flow, access condition, fee model, business-user term, interoperability process, data-access process, or enforcement workflow that implements or touches a DMA Article 5, 6, or 7 obligation.

The review should also cover changes that split a service, recategorize usage, move functionality between services, add friction to an alternative channel, or change how users exercise a DMA right. Article 13 expressly covers segmentation or fragmentation used to circumvent designation thresholds and behavior that undermines effective compliance.

Keep the pre-designation threshold branch separate from the gatekeeper-compliance branch. Article 13(1) addresses an undertaking providing core platform services that fragments them to avoid thresholds. Article 13(3) to (8) addresses a gatekeeper's full and effective compliance with Articles 5, 6, and 7.

  • Start with the Commission designation decision or current gatekeeper list: name the undertaking, designated , and affected user group.
  • Identify the DMA obligation affected by the change, such as choice screens, data use, business-user access, app-store access, interoperability, ranking, portability, or complaint rights.
  • Classify the change mechanism: contractual term, commercial condition, technical implementation, behavioral technique, interface design, service segmentation, or operational policy.
  • Escalate if the change makes a DMA right slower, less visible, more expensive, conditional on a gatekeeper service, or harder to exercise than the gatekeeper's own equivalent path.
  • Reopen the review after a material design change, rollout to another listed service or Member State, a metric deterioration, a complaint pattern, a Commission request or decision, or a changed security, privacy, or integrity justification.
Section 2

Map the design change to the protected DMA obligation

The question depends on the underlying obligation. A payment-flow change should be tested against the Article 5 and Article 6 rights it affects; an API or operating-system change should be tested against the relevant interoperability or access obligation; a consent or choice-screen change should be tested against whether the user's choice remains neutral and practicable.

Do not approve a change only because the formal obligation text is still mentioned in policy. The review has to test whether the implemented product path remains effective for the business user, end user, advertiser, publisher, developer, or third-party provider that the obligation is meant to protect.

  • Create one row per affected DMA obligation with article reference, , user group, current control, proposed change, and risk.
  • For user-interface changes, capture screenshots or click paths before and after the change and note whether choices are displayed neutrally.
  • For technical access changes, record API scope, access conditions, documentation changes, testing results, security or integrity justification, and any less restrictive alternatives considered.
  • For commercial or contractual changes, compare old and new fees, revenue-share rules, access conditions, termination conditions, complaint clauses, and business-user pricing restrictions.
Section 3

Gatekeeper controls that should stop weak designs

A design review should have stop conditions, not just comments. If a change affects a DMA right, the approver should be able to point to a test result, user journey, or technical record showing that the right remains usable and that any security, integrity, or privacy restriction is justified and proportionate.

Article 13 makes interface structure, design, function, and manner of operation relevant. That means dark-pattern testing, neutral presentation checks, friction analysis, and degradation checks belong in the product release control. A security, integrity, or privacy concern is not a free-standing Article 13 exception; the underlying obligation must permit the measure, and the gatekeeper must satisfy that obligation's necessity, proportionality, and justification conditions.

  • Block release if a protected choice becomes less prominent, more confusing, or bundled with unrelated acceptance steps without a documented basis.
  • Block release if a business user, developer, advertiser, publisher, or third-party provider loses existing practical access without an obligation-specific justification.
  • Block release if the change relies on security, integrity, or privacy reasons but the team has not documented why the measure is strictly necessary and why less restrictive options were rejected.
  • Block release if implementation evidence is not tied to the same and obligation that will appear in the gatekeeper compliance report.
Section 4

Evidence to keep for Article 11 reporting and later review

The evidence pack should let a reviewer reconstruct how the change affected a specific DMA obligation. Article 11 reporting expects detailed and transparent descriptions of compliance measures, and the Commission template asks for product scope, geographic scope, technical changes, customer-experience changes, consultations, alternatives, testing, indicators, and monitoring tools.

For , keep both approval evidence and rejected alternatives. The rejected-alternatives record is important where a gatekeeper chooses a more restrictive access path, warning, choice architecture, fee rule, or technical limitation.

  • Review header: change name, product owner, legal owner, affected , affected DMA article, launch geography, release date, and reviewer decision.
  • Implementation evidence: before-and-after user journeys, API or interface documentation, feature flags, access logs, metrics definitions, test plans, survey or A/B-test methodology, and monitoring dashboards.
  • User and business-user evidence: complaints, developer requests, advertiser or publisher feedback, consultation notes, support tickets, and changes made after feedback.
  • Control evidence: privacy, security, or integrity justification; less restrictive alternatives; approval history; compliance-function review; and links to the compliance-report annex that will describe the measure.
Section 5

Checklist for an anti-circumvention design review

Run this checklist at the release gate for DMA-relevant product and policy changes. The goal is to show that the change preserves effective compliance, not merely that the team considered DMA in general terms.

The checklist should be attached to the product-change record and reused when the same feature is localized, extended to another , or changed after user feedback.

What does DMA Article 13 add to an ordinary product design review?

Article 13 adds an test. A gatekeeper should check whether a design, interface, contractual term, commercial condition, technical measure, behavioral technique, or service split undermines effective compliance with Articles 5, 6, or 7, even if the formal product policy still refers to the DMA obligation.

Which evidence is most important for a DMA review?

The strongest evidence ties the change to a specific and DMA obligation, then shows the before-and-after user journey, technical implementation, access conditions, testing or indicators, complaints or feedback, rejected alternatives, and any security, integrity, or privacy justification.

Can a gatekeeper rely on security or integrity reasons to limit a DMA right?

The DMA allows certain strictly necessary and proportionate security, integrity, or privacy measures in specific obligations, but the gatekeeper should document the reason, the affected right, the alternatives considered, and why the chosen measure does not make the right unduly difficult to exercise.

Does DMA Article 13 apply only after gatekeeper designation?

No. Article 13(1) applies to an undertaking providing core platform services and prevents it from splitting or fragmenting services to circumvent the Article 3(2) thresholds. Article 13(3) to (8) governs a designated gatekeeper's full and effective compliance with Articles 5, 6, and 7.

  • The affected gatekeeper, , user group, and DMA article are named.
  • The change mechanism is classified as interface, technical, contractual, commercial, behavioral, segmentation, or operational.
  • Before-and-after evidence shows whether the protected right or choice remains easy to find, understand, and exercise.
  • Any restriction based on security, privacy, or integrity has a documented necessity and proportionality explanation.
  • Metrics exist to detect degradation after launch, such as completion rates, denial rates, access latency, opt-in or choice rates, complaints, and business-user request outcomes.
  • The compliance-function owner can retrieve the evidence for Article 11 reporting and annual updates.
  • The review record states pass, conditional pass, or block; lists every required change and owner; and names the event or monitoring result that will reopen the decision.
Primary sources

References and citations

digital-markets-act.ec.europa.eu
Referenced sections
  • Commission page for checking current gatekeeper undertakings and listed core platform services before scoping a design review.
"Core platform services"
digital-markets-act.ec.europa.eu
Referenced sections
  • Commission legislation page identifies the DMA as the main rules for gatekeeper designation and implementation of obligations and prohibitions.
"designation of gatekeepers and the implementation of the obligations"
eur-lex.europa.eu
Referenced sections
  • Article 13 supports the checklist focus on effective compliance, non-neutral choices, degradation, and interface-design circumvention.
"make the exercise of those rights or choices unduly difficult"
Related guides

Explore more topics

DMA Article 11 Compliance Report Template FAQ
How gatekeepers should use the DMA Article 11 compliance report template to document obligation-by-obligation measures, evidence, updates, and non-confidential summaries.
DMA Article 6 Business User Data Access Guide
Official source guide to EU Digital Markets Act Article 6 data access for business users, end users, authorised third parties, consent boundaries, and evidence handoffs.
DMA Article 6(7) and Article 7 interoperability obligations
Official source guide to DMA interoperability duties: Article 6(7) operating-system feature access, Article 7 messaging interoperability, request handling, security conditions, and compliance evidence.
DMA Articles 5, 6 and 7 obligations mapped to CPS evidence
Map EU Digital Markets Act Articles 5, 6 and 7 obligations to affected core platform services, product evidence, legal owners, and Article 11 compliance-report artifacts.
DMA compliance program and monitoring for gatekeepers
Build a DMA compliance program around Article 8 effective compliance, Article 11 reporting evidence, Article 13 anti-circumvention controls, and Article 28 compliance-function governance.
DMA Core Platform Service Scoping
Scope EU Digital Markets Act core platform services by service category, designation evidence, user thresholds, and Form GD service-boundary records.
DMA core platform services FAQ
FAQ on EU Digital Markets Act core platform services: Article 2 service categories, gatekeeper designation evidence, user thresholds, service scoping, and Article 11 reporting.
DMA CPS Obligation Matrix Workflow: Articles 5, 6, 7 and Article 11 Evidence
Build a DMA core platform service obligation matrix that links each designated CPS to Articles 5, 6 and 7 duties, product owners, designation evidence, Article 11 report artifacts and review gates.
DMA designation intake workflow for gatekeeper notifications
Build an official source DMA designation intake record covering core platform service classification, Article 3 thresholds, Form GD evidence, Commission handoff, and Article 11 readiness.
DMA enforcement, penalties, and remedies: Commission powers and evidence
Follow DMA enforcement from investigation and preliminary findings to non-compliance decisions, fines, daily payments, interim measures, commitments, and remedies.
DMA Gatekeeper Compliance Checklist for Articles 5, 6, 7 and 11
A cited EU Digital Markets Act checklist for designated gatekeepers: core platform service scope, Article 5/6/7 controls, Article 11 report evidence, anti-circumvention checks, and review gates.
DMA Gatekeeper Designation Guide: Article 3 thresholds, Form GD, and Article 11 readiness
A cited EU Digital Markets Act guide for assessing Article 3 gatekeeper thresholds, scoping core platform services, preparing Form GD evidence, handling rebuttal annexes, and planning Article 11 compliance reporting.
DMA gatekeeper thresholds: what counts and when to notify
Standalone FAQ on the EU Digital Markets Act gatekeeper thresholds, Article 3 notification timing, Form GD evidence, and active user-count methodology.
DMA interoperability requests: Article 7 and Commission guidance
How DMA Article 7 messaging interoperability requests work, including phased functions, the three-month operational deadline, reference offers, evidence, and safeguards.
DMA penalties and fines: caps, triggers, and enforcement evidence
Compare DMA Article 30 fine ceilings, the narrow 20% repeat test, 1% procedural fines, and Article 31 daily payments, with decision-specific examples.
DMA Product Change Review Workflow for Articles 5, 6, 7, 11 and 13
Review DMA-relevant product releases for Article 5, Article 6, Article 7, anti-circumvention, Article 11 evidence, and product-owner/legal signoff.
DMA Self-Preferencing Compliance Examples for Ranking and Display
Examples and release-review controls for DMA Article 6(5) self-preferencing checks across ranking, indexing, crawling, search results, marketplaces, app stores, feeds, and virtual assistants.
DMA vs Data Act: gatekeeper duties compared with EU data-sharing rules
Compare the EU Digital Markets Act and EU Data Act by scope, actors, data access, interoperability, reporting, evidence, and enforcement without merging distinct obligations.
DMA vs DSA: Digital Markets vs Services Act
Compare the EU Digital Markets Act and Digital Services Act by covered services, regulated actors, core duties, reporting, dates, evidence, and enforcement.
DMA vs EU competition law: gatekeeper obligations, Article 11 evidence, and enforcement
Compare the EU Digital Markets Act with EU competition law: ex ante gatekeeper and core platform service duties, Articles 5 to 7, Article 11 reports, penalties, and evidence records.
DMA vs GDPR: gatekeeper data obligations compared
Compare DMA gatekeeper duties with GDPR rules for personal-data processing, consent, lawful basis, portability, accountability evidence, and enforcement.
EU Digital Markets Act Article 11 Evidence Calendar
Build a DMA Article 11 compliance-report calendar with the correct designation trigger, service annexes, evidence owners, annual updates, and publication gates.
EU Digital Markets Act checklist for gatekeeper compliance
A source-grounded Sorena DMA checklist for designated gatekeepers and core platform services, covering scope, Articles 5, 6 and 7 obligations, Article 11 reporting, evidence, anti-circumvention, and governance.
EU Digital Markets Act compliance: gatekeeper obligations and evidence
DMA compliance guide for designated gatekeepers: core platform service scoping, Articles 5, 6 and 7 controls, Article 11 reports, anti-circumvention checks, interoperability evidence, and enforcement risk.
EU Digital Markets Act deadlines and compliance calendar
Calculate DMA notification, designation, service-compliance, Article 11 reporting, concentration-notice, and profiling-audit deadlines from the correct legal trigger.
EU Digital Markets Act FAQ: gatekeepers, DMA obligations, reports, and enforcement
Concise FAQ on the EU Digital Markets Act for gatekeeper designation, core platform services, Articles 5, 6 and 7 obligations, Article 11 reports, interoperability, business-user data access, compliance evidence, and enforcement.
EU Digital Markets Act requirements for gatekeepers
DMA requirements for designated gatekeepers: core platform service scope, Articles 5, 6 and 7 obligations, Article 11 reporting, anti-circumvention, evidence, remedies, and fines.
EU Digital Markets Act timeline: application, designation, reporting, and review
DMA timeline separating fixed legal dates, threshold and designation clocks, recurring reports, service-specific decisions, final enforcement, and the first Article 53 review.
EU DMA Applicability Test: gatekeeper thresholds, core platform services, and evidence
Test whether the EU Digital Markets Act may apply to a platform service using the DMA gatekeeper criteria, core platform service categories, EU user thresholds, notification steps, and evidence records.
EU DMA Article 11 Compliance Reporting Guide
Official source guide to EU Digital Markets Act Article 11 compliance reports: report purpose, template evidence, non-confidential summaries, annual updates, and submission steps.
EU DMA do's and don'ts for product teams
Product release checks for designated DMA gatekeepers: Article 5, 6 and 7 obligations, anti-circumvention review, data access, interoperability, self-preferencing and Article 11 evidence.
What do DMA Articles 5, 6, and 7 require from gatekeepers?
FAQ explaining how EU Digital Markets Act Articles 5, 6, and 7 group gatekeeper obligations, what product evidence they require, and how Article 11 reporting connects.