A practical DMA compliance guide for designated gatekeepers and teams reviewing core platform service obligations.
Use it to scope listed core platform services, map Articles 5, 6 and 7 obligations, build Article 11 evidence, test anti-circumvention risk, and prepare interoperable access records.
Structured answer sets in this page tree.
Cited legal and guidance references.
Digital Markets Act compliance attaches to undertakings designated as gatekeepers and to each listed in the Commission designation decision. Start with that decision, then trace each listed service through the obligations in Articles 5, 6 and 7, the Article 11 compliance report, the anti-circumvention rule in Article 13, and any Commission specification or enforcement process that affects the service.
A DMA control should be opened only after the team can name the designated undertaking, the listed , and the business-user or end-user journey affected by the control. The legal text defines core platform services to include online intermediation services, online search engines, online social networking services, video-sharing platform services, number-independent interpersonal communications services, operating systems, web browsers, virtual assistants, cloud computing services, and online advertising services provided by an undertaking that provides one of those services.
The designation analysis also matters after designation. Article 3 uses quantitative presumptions for turnover or market value, Union user reach, and durable position, but the Commission can designate under a qualitative assessment as well. The compliance record should therefore separate designation metrics from service-level obligation evidence.
The DMA has applied since 2 May 2023, but the operational compliance date is service-specific: Articles 5, 6, and 7 generally apply six months after the service is listed. A later decision can add or remove a service, and Article 4 reviews do not suspend existing duties unless the Commission changes the designation.
Articles 5, 6 and 7 are the compliance backbone. Article 5 contains direct obligations such as limits on combining or cross-using personal data without consent, anti-steering restrictions, communication and contracting rights for business users, access for end users to externally acquired content, complaint freedom, tying restrictions for identification, browser engine and payment services, and advertising transparency for advertisers and publishers.
Article 6 adds obligations that may be further specified by the Commission. The operational controls typically touch non-public business-user data, uninstall and default-choice flows, third-party app stores and software installation, ranking fairness, switching, interoperability with operating system or virtual assistant features, ad measurement access, end-user data portability, business-user data access, search-data access, FRAND access conditions, and termination terms.
Article 7 is narrower but technically demanding. It applies where a gatekeeper provides a listed number-independent interpersonal communications service and requires requested interoperability for specified basic functionalities while preserving security, including end-to-end encryption where applicable.
Article 11 requires a gatekeeper to provide the Commission, within six months after designation, with a detailed and transparent report describing the measures implemented to ensure compliance with Articles 5, 6 and 7, plus a . The report and summary must be updated at least annually.
The Commission template makes the evidence burden practical. For each listed and applicable obligation, it asks for a compliance statement, an exhaustive explanation of measures, supporting data and internal documents, pre-designation or post-designation status, implementation timing, product and geographic scope, technical or engineering changes, customer-journey changes, terms and remuneration changes, consultation, alternative measures considered, testing, indicators, monitoring tools, and access procedures for third parties.
A request for specification dialogue does not remove the reporting obligation for the obligations covered by that request. Teams should therefore keep the Article 11 evidence file current even when they are also discussing specifications with the Commission.
Article 13 turns weak implementation into enforcement risk. It prohibits segmenting or splitting core platform services to avoid designation thresholds, requires full and effective compliance with Articles 5, 6 and 7, and bars contractual, commercial, technical, behavioural, or interface-design behaviour that undermines those obligations.
The practical test is whether the implementation preserves the right in substance. A compliant-looking flow can still be risky if it degrades service quality for users who exercise DMA rights, makes choices unduly difficult, uses non-neutral interface design, burdens business users more than the gatekeeper's own services, or relies on security, privacy or integrity restrictions that are broader than necessary.
Article 6(7) requires free and effective interoperability with, and access for interoperability to, the same operating-system, virtual-assistant, hardware, and software features available to the gatekeeper's own services or hardware. Any integrity measure must stay within the paragraph's strictly necessary, proportionate, and duly justified boundary. Article 7 is a separate request-based regime for listed number-independent interpersonal communications services.
The Commission's Developer Portal records completed Article 6(7) specification proceedings for Apple in March 2025 and Alphabet in July 2026. A specification decision sets binding implementation measures but does not itself find non-compliance or impose a fine; a separate non-compliance decision may do so.
The Commission can adopt non-compliance decisions, require the gatekeeper to cease and desist, and impose fines for intentional or negligent failures to comply with Articles 5, 6 or 7, Commission-specified measures, systematic non-compliance remedies, interim measures, or binding commitments. The DMA also allows periodic penalty payments to compel compliance with specified measures, remedies, information requests, inspections, interim measures, commitments, and non-compliance decisions.
The compliance function should therefore keep management reports, risk assessments, decisions, replies from the management body, monitoring outputs, and remediation status together with the Article 11 evidence. A product team cannot close a DMA control merely by showing that a feature shipped; it must show that the measure is effective for the relevant obligation and that risks of non-compliance were escalated and addressed.
Article 9 suspension and Article 10 exemption are narrow Commission-decision routes, not self-declared defences. Article 9 concerns exceptional circumstances beyond the gatekeeper's control that endanger the economic viability of its Union operation. Article 10 permits exemption only for public health or public security. Unless and until the Commission grants relief, keep the obligation in the compliance register.
DMA evidence should have both an operational owner for the listed and an independent compliance-function owner. The Commission Article 11 template asks for the role of the head of the compliance function, reporting lines, monitoring activities, management reports on non-compliance risk, and management-body replies.
For each listed and each applicable Article 5, 6 or 7 obligation, keep the compliance statement, implementation explanation, supporting data, internal documents, pre-change baseline, implementation date, product and geographic scope, engineering changes, user-journey changes, terms or fee changes, consultation, testing, indicators, monitoring tools, feedback, and non-confidential-summary text.
A specification decision is not itself a non-compliance decision and does not attach fines merely because it is adopted. It can still create practical enforcement risk because it specifies measures the gatekeeper is expected to implement, while separate non-compliance proceedings can lead to cease-and-desist orders and fines if the Commission later finds an infringement.
No. An internal concern does not suspend an obligation. Article 9 relief requires a Commission suspension decision based on exceptional circumstances beyond the gatekeeper's control that endanger the economic viability of its Union operation. Article 10 exemption requires a Commission decision and is limited to public health or public security. Obligation-specific security, privacy, or integrity measures must separately satisfy the conditions written into the relevant article.
Sorena can help convert this DMA compliance guide into obligation matrices, Article 11 evidence requests, interoperability request records, anti-circumvention checks, and management-ready compliance summaries.
Ask questions tied to cited sources about gatekeeper scope, Articles 5, 6 and 7 obligations, Article 11 reports, interoperability, and enforcement exposure using the cited sources on this page.
Check whether your DMA controls, report annexes, interoperability request records, and anti-circumvention evidence match the cited obligations.
"compliance function and monitoring"
"Core platform services"
"implementation of the obligations"
"Resources for businesses"
"non-compliance decision"