We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

ChecklistEU DMA

EU Digital Markets Act Gatekeeper checklist

This checklist helps test whether DMA work is anchored to a designated gatekeeper, a listed , and the specific Article 5, 6 or 7 obligation being implemented.

The checks focus on scope, interoperability, data access, self-preferencing, Article 11 reporting, anti-circumvention, evidence, and governance records.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
6 sections6 primary sources
Overview

Start this Digital Markets Act checklist with the designation decision and the relevant . A control is ready for review only when it identifies the gatekeeper, the listed service, the applicable Article 5, 6 or 7 paragraph, the implemented measure, the responsible owner, and evidence that the measure works in practice. Treat security, integrity, and privacy qualifications as paragraph-specific conditions, not as a general DMA exception. This is a Sorena internal review aid, not an official Commission checklist or a substitute for the Regulation, designation decision, or case-specific assessment.

Section 1

1. Confirm gatekeeper and core platform service scope

Apply DMA obligation checks only to the core platform services listed for a designated gatekeeper. Article 3 requires the Commission designation decision to list the relevant core platform services, and Article 3(10) ties the compliance obligation to those listed services.

For internal triage, separate three questions: whether the undertaking is or may be a gatekeeper, which is listed or under assessment, and which product features or business user flows sit inside that service.

  • Record the gatekeeper name and the exact from the Commission designation or gatekeepers page.
  • Check whether the service category is a DMA , such as an online intermediation service, online search engine, online social networking service, video-sharing platform service, number-independent interpersonal communications service, operating system, web browser, virtual assistant, cloud computing service, or online advertising service.
  • If relying on the Article 3 quantitative presumption, keep evidence for Union turnover or market value, Member State presence, monthly active end users in the Union, yearly active business users in the Union, and the three-financial-year durability test.
  • Treat designation and scope as service-specific: a company may be designated for some core platform services and not for every product it operates.
  • Open a reassessment when there is a substantial change in the facts behind designation, a new listed service, a concentration involving digital services or data collection, or a Commission review of gatekeeper status.
Section 2

2. Check Article 5 obligations that apply without further specification

Article 5 controls should be tested at the level of the relevant and the affected user flow. The checklist should show whether the gatekeeper has stopped the prohibited conduct or enabled the required access, communication, pricing, complaint, and advertising transparency rights.

Do not close an Article 5 item with a policy statement alone. Keep product screenshots, terms, API behavior, consent records, ad reporting samples, or business user communications that prove the measure works in practice.

  • Personal data combination and cross-use: verify that advertising use, data combination, cross-use, and cross-service sign-in for data combination are blocked unless the required GDPR consent choice is captured, and that refused or withdrawn consent is not requested again for the same purpose more than once in a year.
  • Anti-steering and business user communication: confirm business users can offer different prices or conditions through third-party channels or direct sales channels, promote offers to acquired end users free of charge, and conclude contracts outside the gatekeeper service.
  • Access to acquired content: confirm end users can access subscriptions, features, content, or other items through a business user app even if acquired outside the gatekeeper .
  • Complaint rights: confirm contracts, support flows, and account controls do not directly or indirectly restrict business users or end users from raising non-compliance issues with public authorities or courts.
  • Tying under Article 5(7): in services provided by business users using the gatekeeper's core platform services, check that end users are not required to use the gatekeeper's identification service, browser engine, payment service, or supporting payment technical services, and business users are not required to use, offer, or interoperate with them. Separately, under Article 5(8), check that access to a listed is not conditional on subscribing to or registering with another of the gatekeeper's core platform services that is listed or meets Article 3(2)(b)'s user thresholds.
  • Advertising transparency: for online advertising services, test whether advertisers and publishers can receive daily, free-of-charge information on prices, fees, remuneration, deductions, surcharges, and calculation metrics where Article 5(9) or 5(10) applies.
Section 3

3. Check Article 6 obligations for product, data, ranking, access, and portability

Article 6 obligations often require engineering, product, marketplace, advertising, search, and data teams to produce evidence together. The record should connect the legal obligation to the affected interface, ranking system, data pipeline, API, default setting, access condition, or termination condition.

Where the specific DMA paragraph permits an integrity, security, or privacy safeguard, cite that paragraph, keep the justification, and show that the measure satisfies its necessity and proportionality conditions. Do not carry an exception from one obligation into another.

  • Business user data firewall: confirm the gatekeeper does not use non-public data generated or provided by business users, including their customers' activity data, to compete with those business users.
  • Uninstall and defaults: test that end users can easily uninstall non-essential apps and change default settings for operating systems, virtual assistants, and web browsers that steer users to gatekeeper products or services.
  • Third-party apps and stores: verify installation, effective use, alternative access, and default-setting options for third-party apps or app stores, subject only to justified, strictly necessary and proportionate integrity or security measures.
  • Self-preferencing: test ranking, indexing, and crawling so the gatekeeper's own services or products are not treated more favourably than similar third-party services or products, and keep the ranking methodology and monitoring evidence.
  • Switching and interoperability: confirm there are no technical or other restrictions on switching between, or subscribing to, different apps and services accessed through the .
  • Advertising measurement: confirm advertisers, publishers, and their authorised third parties can access performance measurement tools and the data needed for independent verification.
  • End user data portability: test free, effective portability for data provided by or generated through end user activity, including continuous and real-time access where required.
  • Business user data access: verify free, high-quality, continuous and real-time access to aggregated and non-aggregated data generated in the relevant context, with personal data shared only where directly connected to the end user's use of the business user's offering and supported by opt-in consent.
  • Search data access: for online search engines, verify fair, reasonable and non-discriminatory terms for third-party search engines to access ranking, query, click and view data, with personal data anonymised. Unlike the free-access duties in Articles 6(8), 6(9), and 6(10), Article 6(11) does not say this access must be free of charge.
  • Access terms and termination: check fair, reasonable and non-discriminatory access conditions for app stores, online search engines, and online social networking services, and confirm termination terms are not disproportionate or unduly difficult to exercise.
Section 4

4. Check Article 7 communications interoperability

Article 7 applies where the designated is a number-independent interpersonal communications service. The checklist should distinguish Article 7 communications interoperability from Article 6(7) operating-system, hardware, software, or virtual-assistant interoperability.

The compliance record should cover the reference offer, requester intake, technical interfaces or equivalent solutions, security preservation, personal-data minimisation, and the timing for making requested functionalities operational.

  • Confirm whether the designated service is a number-independent interpersonal communications service and whether the requested basic functionality is provided to the gatekeeper's own end users.
  • Verify that interoperability is available upon request and free of charge through necessary technical interfaces or similar solutions.
  • Check the Article 7 functionality sequence: one-to-one text and file sharing within the Article 3(10) six-month compliance period after the service is listed; text messaging within groups and file sharing between a group chat and an individual end user within two years from designation; and voice and video calls between two individual end users and between a group chat and an individual end user within four years from designation.
  • Confirm the reference offer publishes technical details, general terms, and security details, including end-to-end encryption where applicable.
  • Track each third-party provider request, whether it is reasonable, which functionalities it covers, and whether requested basic functionalities are made operational within three months after receipt.
  • Keep evidence that the gatekeeper preserves its own level of security, collects and exchanges only personal data strictly necessary for interoperability, and justifies any integrity, security, or privacy measures as strictly necessary and proportionate.
Section 5

5. Build the Article 11 compliance report evidence pack

Article 11 requires a detailed and transparent report on measures implemented to ensure compliance with Articles 5, 6 and 7, plus a non-confidential summary. The Commission template expects the report to be organised by each listed and each applicable obligation.

Use the template as an evidence checklist even before the reporting deadline: it shows the level of specificity needed to demonstrate effective compliance under Article 8(1).

  • For each listed and applicable Article 5, 6 or 7 obligation, include a compliance statement, the implemented measure, and whether it existed before designation or was implemented after designation.
  • Describe the prior situation, implementation date, product, service or device scope, geographic scope, technical or engineering changes, and customer experience changes.
  • Keep proof for changes to data flows, internal data use policies, security measures, metrics, APIs, operating-system functions, ranking parameters, ad auctions, choice screens, consent forms, warnings, system updates, and user journeys.
  • Document fee, revenue-share, remuneration-flow, terms-and-conditions, privacy-policy, access-condition, and interoperability-condition changes where relevant.
  • Record consultation with end users, business users or interested parties, external consultant involvement, alternatives assessed, user communications, feedback, testing, surveys, consent rates, and impact monitoring.
  • Prepare the compliance report, annexes, non-confidential summary, and underlying data in machine-readable form with searchable and recognisable text, and keep raw data ready for Commission requests.
  • Highlight differences from any previous report and disclose any retention policy for responsive documents without undue delay.
Section 6

6. Test anti-circumvention, governance, and reopening triggers

A DMA checklist should fail any control that works on paper but is undermined by technical design, contract terms, commercial incentives, degraded service quality, non-neutral choices, or interface design. Article 13 makes anti-circumvention a separate governance check.

Governance evidence should show who owns the service scope, legal interpretation, product change, engineering implementation, data access, business-user communication, reporting, and retained proof.

  • Check that services are not segmented, divided, subdivided, fragmented, or split through contractual, commercial, technical, or other means to avoid Article 3 quantitative thresholds.
  • Review whether any contractual, commercial, technical, behavioural, or interface-design practice undermines effective compliance with Articles 5, 6 or 7.
  • Confirm consent flows needed for DMA compliance are not more burdensome for business users than for the gatekeeper's own services.
  • Test whether users or business users who exercise DMA rights face degraded service conditions or quality, undue difficulty, non-neutral choice presentation, or subverted autonomy through interface design.
  • Assign accountable owners for each listed , obligation, implementation measure, evidence store, report annex, non-confidential-summary entry, requester intake process, and escalation to counsel.
  • Reopen the checklist after product releases, ranking changes, ad auction changes, access-term changes, API or data-pipeline changes, interoperability requests, new consent flows, acquisitions involving digital services or data collection, Commission specification discussions, or Article 11 report updates.
Recommended next step

Review DMA controls by gatekeeper, core platform service, and obligation

Use the cited sources listed here to verify obligations and the supporting evidence requirements.

Research workflow
Open Research Copilot for DMA questions

Check DMA scope, Articles 5 to 7 obligations, reporting, interoperability, data access, and anti-circumvention against the cited sources.

Explore next step
Talk to Sorena
Discuss DMA implementation

Review gatekeeper scope, core platform service coverage, control evidence, and report inputs for Digital Markets Act work.

Explore next step
Primary sources

References and citations

Regulation (EU) 2022/1925 (Digital Markets Act)
eur-lex.europa.eu7 citations
Referenced sections
  • Primary legal source for gatekeeper designation, core platform service listing, Articles 5 to 7 obligations, Article 11 reporting, Article 13 anti-circumvention, and Article 14 concentration notifications.
  • Article 3 defines gatekeeper designation, quantitative presumptions, notification duties, listed core platform services, and the six-month compliance point for listed services.
  • Article 5 lists directly applicable gatekeeper obligations for data combination, anti-steering, complaint rights, tying, registration, and advertising transparency.
Show 4 more
  • Article 6 supports the checklist items for business-user data use, uninstall and default settings, third-party apps and stores, self-preferencing, switching, interoperability, ad measurement, data portability, business-user data access, search data, access terms, and termination.
  • Article 7 defines interoperability obligations for number-independent interpersonal communications services, including reference offers, request handling, functionality timing, security, and data minimisation.
  • Article 11 requires the compliance report, non-confidential summary, annual updates, and publication link for the summary.
  • Article 13 supports anti-circumvention checks for service fragmentation, technical or contractual undermining of compliance, burdensome consent, degraded conditions, non-neutral choices, and interface design.
"contestable and fair markets"
More quoted passages
"The gatekeeper shall comply with the obligations laid down in Articles 5, 6 and 7 within 6 months"
"The gatekeeper shall comply with all obligations set out in this Article with respect to each of its core platform services"
"The gatekeeper shall not treat more favourably, in ranking and related indexing and crawling, services and products offered by the gatekeeper itself"
"it shall make the basic functionalities of its number-independent interpersonal communications services interoperable"
"a report describing in a detailed and transparent manner the measures it has implemented"
"The gatekeeper shall not engage in any behaviour that undermines effective compliance"
European Commission - Article 11 DMA compliance report template
digital-markets-act.ec.europa.eu2 citations
Referenced sections
  • Commission template for the detailed compliance report and supporting evidence expected for each listed core platform service and applicable Article 5 to 7 obligation.
  • Commission template specifies minimum information for each core platform service and each applicable Article 5 to 7 obligation.
"This template specifies the minimum information"
More quoted passages
"For each core platform service"
European Commission - DMA gatekeepers page
digital-markets-act.ec.europa.eu2 citations
Referenced sections
  • Commission source for designated gatekeepers, listed core platform services, compliance reports, acquisitions, and consumer profiling reports.
  • Commission page identifying designated gatekeepers and their listed core platform services.
"In total, 23 core platform services provided by those gatekeepers are currently designated."
European Commission - DMA interoperability questions and answers
digital-markets-act.ec.europa.eu2 citations
Referenced sections
  • Commission Developer Portal for Article 6(7) interoperability, completed specification proceedings, and request routes.
  • Commission Developer Portal explains Article 6(7) interoperability, completed specification proceedings, and the difference between specification and non-compliance decisions.
European Commission - DMA legislation page
digital-markets-act.ec.europa.eu2 citations
Referenced sections
  • Commission source for DMA legislation, procedural rules, notices, guidelines, and official templates.
  • Commission legislation page links the DMA text, procedural regulation, notices, guidelines, and official templates used for compliance governance.
"The DMA contains the main rules"
European Commission - DMA resources for businesses
digital-markets-act.ec.europa.eu
Referenced sections
  • Commission resource page for business-facing DMA materials, including interoperability, data portability, and data access resources.
"Resources for businesses"

Related guides

DMA Anti-Circumvention Design Review for Gatekeeper Product Changes

Review DMA Article 13 anti-circumvention risks in gatekeeper product, interface, contractual, commercial, and technical changes with obligation mapping and evidence records.

DMA Article 6 Business User Data Access Guide

Official source guide to EU Digital Markets Act Article 6 data access for business users, end users, authorised third parties, consent boundaries, and evidence handoffs.

DMA Article 6(7) and Article 7 interoperability obligations

Official source guide to DMA interoperability duties: Article 6(7) operating-system feature access, Article 7 messaging interoperability, request handling, security conditions, and compliance evidence.

DMA Articles 5, 6 and 7 obligations mapped to CPS evidence

Map EU Digital Markets Act Articles 5, 6 and 7 obligations to affected core platform services, product evidence, legal owners, and Article 11 compliance-report artifacts.

DMA compliance program and monitoring for gatekeepers

Build a DMA compliance program around Article 8 effective compliance, Article 11 reporting evidence, Article 13 anti-circumvention controls, and Article 28 compliance-function governance.

DMA Core Platform Service Scoping

Scope EU Digital Markets Act core platform services by service category, designation evidence, user thresholds, and Form GD service-boundary records.

Show all related guides (32)

DMA CPS Obligation Matrix Workflow: Articles 5, 6, 7 and Article 11 Evidence

Build a DMA core platform service obligation matrix that links each designated CPS to Articles 5, 6 and 7 duties, product owners, designation evidence, Article 11 report artifacts and review gates.

DMA designation intake workflow for gatekeeper notifications

Build an official source DMA designation intake record covering core platform service classification, Article 3 thresholds, Form GD evidence, Commission handoff, and Article 11 readiness.

DMA enforcement, penalties, and remedies: Commission powers and evidence

Follow DMA enforcement from investigation and preliminary findings to non-compliance decisions, fines, daily payments, interim measures, commitments, and remedies.

DMA Gatekeeper Compliance Checklist for Articles 5, 6, 7 and 11

A cited EU Digital Markets Act checklist for designated gatekeepers: core platform service scope, Article 5/6/7 controls, Article 11 report evidence, anti-circumvention checks, and review gates.

DMA Gatekeeper Designation Guide: Article 3 thresholds, Form GD, and Article 11 readiness

A cited EU Digital Markets Act guide for assessing Article 3 gatekeeper thresholds, scoping core platform services, preparing Form GD evidence, handling rebuttal annexes, and planning Article 11 compliance reporting.

DMA penalties and fines: caps, triggers, and enforcement evidence

Compare DMA Article 30 fine ceilings, the narrow 20% repeat test, 1% procedural fines, and Article 31 daily payments, with decision-specific examples.

DMA Product Change Review Workflow for Articles 5, 6, 7, 11 and 13

Review DMA-relevant product releases for Article 5, Article 6, Article 7, anti-circumvention, Article 11 evidence, and product-owner/legal signoff.

DMA Self-Preferencing Compliance Examples for Ranking and Display

Examples and release-review controls for DMA Article 6(5) self-preferencing checks across ranking, indexing, crawling, search results, marketplaces, app stores, feeds, and virtual assistants.

DMA vs Data Act: gatekeeper duties compared with EU data-sharing rules

Compare the EU Digital Markets Act and EU Data Act by scope, actors, data access, interoperability, reporting, evidence, and enforcement without merging distinct obligations.

DMA vs DSA: Digital Markets vs Services Act

Compare the EU Digital Markets Act and Digital Services Act by covered services, regulated actors, core duties, reporting, dates, evidence, and enforcement.

DMA vs EU competition law: gatekeeper obligations, Article 11 evidence, and enforcement

Compare the EU Digital Markets Act with EU competition law: ex ante gatekeeper and core platform service duties, Articles 5 to 7, Article 11 reports, penalties, and evidence records.

DMA vs GDPR: gatekeeper data obligations compared

Compare DMA gatekeeper duties with GDPR rules for personal-data processing, consent, lawful basis, portability, accountability evidence, and enforcement.

EU Digital Markets Act Article 11 Evidence Calendar

Build a DMA Article 11 compliance-report calendar with the correct designation trigger, service annexes, evidence owners, annual updates, and publication gates.

EU Digital Markets Act compliance: gatekeeper obligations and evidence

DMA compliance guide for designated gatekeepers: core platform service scoping, Articles 5, 6 and 7 controls, Article 11 reports, anti-circumvention checks, interoperability evidence, and enforcement risk.

EU Digital Markets Act deadlines and compliance calendar

Calculate DMA notification, designation, service-compliance, Article 11 reporting, concentration-notice, and profiling-audit deadlines from the correct legal trigger.

EU Digital Markets Act FAQ: gatekeepers, DMA obligations, reports, and enforcement

Concise FAQ on the EU Digital Markets Act for gatekeeper designation, core platform services, Articles 5, 6 and 7 obligations, Article 11 reports, interoperability, business-user data access, compliance evidence, and enforcement.

EU Digital Markets Act requirements for gatekeepers

DMA requirements for designated gatekeepers: core platform service scope, Articles 5, 6 and 7 obligations, Article 11 reporting, anti-circumvention, evidence, remedies, and fines.

EU Digital Markets Act timeline: application, designation, reporting, and review

DMA timeline separating fixed legal dates, threshold and designation clocks, recurring reports, service-specific decisions, final enforcement, and the first Article 53 review.

EU DMA Applicability Test: gatekeeper thresholds, core platform services, and evidence

Test whether the EU Digital Markets Act may apply to a platform service using the DMA gatekeeper criteria, core platform service categories, EU user thresholds, notification steps, and evidence records.

EU DMA Article 11 Compliance Reporting Guide

Official source guide to EU Digital Markets Act Article 11 compliance reports: report purpose, template evidence, non-confidential summaries, annual updates, and submission steps.

EU DMA do's and don'ts for product teams

Product release checks for designated DMA gatekeepers: Article 5, 6 and 7 obligations, anti-circumvention review, data access, interoperability, self-preferencing and Article 11 evidence.

DMA Article 11 Compliance Report Template FAQ

How gatekeepers should use the DMA Article 11 compliance report template to document obligation-by-obligation measures, evidence, updates, and non-confidential summaries.

DMA core platform services FAQ

FAQ on EU Digital Markets Act core platform services: Article 2 service categories, gatekeeper designation evidence, user thresholds, service scoping, and Article 11 reporting.

DMA gatekeeper thresholds: what counts and when to notify

Standalone FAQ on the EU Digital Markets Act gatekeeper thresholds, Article 3 notification timing, Form GD evidence, and active user-count methodology.

DMA interoperability requests: Article 7 and Commission guidance

How DMA Article 7 messaging interoperability requests work, including phased functions, the three-month operational deadline, reference offers, evidence, and safeguards.

What do DMA Articles 5, 6, and 7 require from gatekeepers?

FAQ explaining how EU Digital Markets Act Articles 5, 6, and 7 group gatekeeper obligations, what product evidence they require, and how Article 11 reporting connects.