Brussels Called the Audit Weak and Approved It

The Board said not good enough. The Commission signed it off.

The sequence is the story. On 15 June the Board for Digital Services delivered its opinion on X's plan to repair the transparency failures Brussels had already penalised. The Board considered the proposed changes partially adequate, but deemed X's audit measures and, as a result, the overall action plan insufficient to address the infringements. On 16 July the European Commission accepted the plan.

The backdrop is the first non-compliance decision ever taken under the Digital Services Act. In its December 2025 decision the Commission fined X 120 million euro for breaching transparency obligations. That figure is not repeated in this week's announcement, and it does not need to be. The fine is the settled fact of the case, and what happened on 16 July is the remedy stage of the same case.

The Commission's own account is careful. It said it carefully considered the Board's opinion, recognising the Board's critical role in evaluating X's proposed measures under the Digital Services Act, and that following the opinion it has clarified several points that X must consider in the implementation of the action plan. The Board is consulted and gives an opinion. The Commission decides. That is the design of the law, and this week it became visible.

What X has actually promised to build

The commitments are concrete, which is the strongest part of this. X committed to improving its advertising repository with better search features and faster response times, to publishing more information about advertisements, and to enabling access via an API. The detail page runs further than the headline: additional search filters such as those based on ad content and targeting criteria, and search results displayed directly on the interface of the ad repository rather than on separate Excels.

Two of the measures are quietly the most useful. X is to provide additional information about advertisements, including the full content of the advertisement and the URLs to which advertisements redirect users. And it is to improve the repository's response speed, reducing the response time from 200 seconds to the minimum time technically achievable. Anyone who has tried to work an ad library at 200 seconds a query knows what that changes.

Researcher access moves in parallel. X will give eligible researchers effective access to public data by improving and speeding up the screening process for applications, giving access to data free-of-charge, and updating its terms to refrain from contractually prohibiting eligible researchers to scrape public data. The last clause is the one with teeth. The contractual bar comes down, and not only the queue.

The remedy for a weak audit is an audit

Read what the Board actually objected to. It was not the search filters or the API. It was the audit measures, and because the audit was insufficient, the Board found the plan as a whole insufficient to address the infringements. The Commission accepted the plan, and the mechanism that will verify the fix is an audit which X has committed to undertake and which X submits to the Commission.

The Commission is not blind to this. X is subjected to an enhanced supervision regime, the Commission said it will closely monitor progress, in particular on the issues raised by the Board, and it attached clarifications of key implementation requirements to the acceptance. The pages name no auditor and set out no audit standard. That is the open variable, and it is the same variable the Board flagged a month before the decision.

The clock nobody has read out loud

Count the months. X has six months to implement the measures set out in its action plan, and it must then issue and submit to the Commission an audit of the measures, sent within six months after implementing them. Implementation therefore lands around mid-January 2027 at the earliest. The audit report can arrive as late as the middle of 2027.

That is up to a year from now before the first artefact exists that could tell anyone outside X whether the repair worked. The underlying conduct dates to 2025, and the fine for it was issued in December of that year. Enforcement under this law is not slow because anyone is idle. It is slow because the instrument runs on windows, and the windows are long.

The Commission's line about monitoring in particular on the issues raised by the Board is the tell. Brussels knows exactly where the weak point sits. It also has to work with the instrument it has, on the timetable the instrument allows, and it has front-loaded the pressure available to it: clarifications now, enhanced supervision throughout, and regular updates to the Board and to the national Digital Services Coordinators along the way.

What this means if you buy ads on X in the EU

The prize is real. If it ships as described, the repository becomes a genuine competitive-intelligence artefact for any European advertiser: searchable by ad content and by targeting criteria, rendered in-interface instead of dumped into spreadsheets, an order of magnitude faster than a 200-second wait, and reachable by API. Your competitors' targeting becomes inspectable. So does yours.

The caveat is the delivery path. It arrives on X's own timetable and is checked by X's own auditor. Keep X data out of the critical path of any research or compliance process you run, and set the internal expectation at mid-January 2027 at the earliest for the capability, later still for any independent confirmation that it works. Treat that date as a floor and nothing more. Note also that this is an EU regime: it does not extend to the United Kingdom, and a UK-only campaign sits outside it.

The precedent travels further than X. This is now what the endgame of an enforcement action under the Digital Services Act looks like for any very large platform in scope: a six-month self-implementation window, closed by a vendor-commissioned audit, accepted over the stated objection of the Commission's own advisory Board, with supervision as the counterweight. If your business leans on a platform that could plausibly be next, that is the shape of the year you should be modelling.

Read next: The EU Says Addictive Design Can Cost 6% of Revenue  |  All 27 Are Late. Your Deadline Did Not Move.