EU Digital Markets Act

EU Regulation 2022/1925 - gatekeeper obligations, interoperability, prohibited self-preferencing.


Short name	DMA
Region	Europe
Country or scope	European Union
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers DMA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for DMA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for DMA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`EU-DMA-6-INTEG` Integrity-Protection Measures	Gatekeepers permitting third-party software and app stores may apply only measures strictly necessary to protect the integrity of their hardware, operating system and software, which presupposes verifiable integrity evidence such as component hashes (Regulation (EU) 2022/1925 Art. 6(4))	Scan
`EU-DMA-6-INTEROP` Interoperability Through Standard Formats	Gatekeepers must provide effective interoperability with the same hardware and software features they use themselves, which favours documenting systems in standard machine-readable formats (Regulation (EU) 2022/1925 Art. 6(7))	Scan
`EU-DMA-8` Demonstrable Compliance	Gatekeepers must ensure and be able to demonstrate compliance with their obligations, which requires a documented inventory of the software making up each core platform service (Regulation (EU) 2022/1925 Art. 8(1))	Scan
`EU-DMA-11` Compliance Reporting Records	Gatekeepers must submit reports describing measures taken to comply with the regulation, requiring dated, identifiable technical documentation to substantiate them (Regulation (EU) 2022/1925 Art. 11)	Scan
`EU-DMA-28` Compliance Function Provenance	Gatekeepers must maintain an independent compliance function, and technical artefacts supporting compliance must record which tool or organisation created them (Regulation (EU) 2022/1925 Art. 28)	Scan
`EU-DMA-VER` Maintained Core Platform Software	Ongoing compliance with security and interoperability duties across gatekeeper services requires knowing the version of each deployed software component (Regulation (EU) 2022/1925 gatekeeper obligations, Arts. 5-7)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`DMA-Art5`	Gatekeeper Core Platform Obligations
`DMA-Art6`	Additional Gatekeeper Obligations
`DMA-Art7`	Interoperability for Number-Independent Interpersonal Communications
`DMA-Art14`	Gatekeeper Designation Notification
`DMA-Art15`	Compliance Audit for Gatekeepers
`DMA-Remedies`	Structural and Behavioural Remedies
`DMA-DataPortability`	Data Portability for Business and End Users
`DMA-Transparency`	Transparency and Reporting to Commission

Policy templates

Written for DMA:

DMA Compliance Programme

And 22 from the standard set, adapted to DMA.