Governments are establishing new rules for how digital services must operate. Platforms are being asked to demonstrate that they comply with those rules. Regulators are developing processes to assess whether they do. 

As explored in the previous blog, establishing regulation and demonstrating compliance are critical steps in this process. But what happens when a regulator determines that a platform is not complying? 

That question is becoming increasingly important as digital regulation moves from broad principles toward specific requirements, deadlines and obligations. Creating a regulation is one step. Establishing compliance is another. Turning a regulatory finding into a practical outcome is where enforcement begins. 

From Compliance to Consequences 

The proposed EU KIDS Act provides a clear example of how this process is being structured. The legislation would build on the existing enforcement architecture of the Digital Services Act and AI Act. Very large online platforms would be required to submit a compliance plan to an independent auditor, who would assess the new service, feature or functionality.  This speaks directly to the weakness of self-assessment.   The European Commission could then request corrective measures if it identified shortcomings based on the auditor’s report.  

The proposal also places responsibility for demonstrating compliance on the operators themselves. This creates a more defined path from regulation to accountability: platforms must implement controls, demonstrate that those controls meet the requirements, and provide evidence that can be assessed by independent parties and regulators.  

The important point is not simply the size of a potential fine. It is the chain of activity that has to happen before a regulator can act. Requirements must be defined, platforms must implement controls, evidence must be produced, compliance must be assessed, and a regulator must determine whether the requirements have been met. 

A regulatory decision is therefore not the same thing as enforcement. It is the point at which a finding of non-compliance can begin to produce consequences. 

What Enforcement Requires 

Enforcement requires more than identifying that a platform is falling short. Regulators need a way to establish what the obligation is, determine whether it has been met and take action when it has not. 

At a practical level, that means enforcement depends on several connected elements: 

  • A clear legal obligation: The requirement must define what a provider is expected to do. 
  • Evidence: Regulators need sufficient information to establish whether the requirement has been met. 
  • Authority: The regulator needs legal powers to investigate, require information and take action. 
  • A mechanism for action: There must be a defined way for a regulatory finding to result in a corrective measure, penalty or other consequence. 

The EU KIDS Act reflects this approach by placing compliance obligations on service providers while building enforcement into the wider EU regulatory framework. The proposal identifies strong enforcement as one of its four core pillars and builds on existing DSA and AI Act structures. 

What Australia Shows About Enforcement in Practice 

Australia’s Social Media Minimum Age framework provides a useful example of what happens between a regulation coming into effect and a regulator taking enforcement action. 

Since 10 December 2025, age-restricted social media platforms have been required to take reasonable steps to prevent Australians under 16 from creating or keeping accounts. Australia’s eSafety Commissioner has powers to obtain information from service providers and enforce compliance. A court can order civil penalties of up to AUD $54.6 million for corporations that fail to take reasonable steps.  

The early enforcement process illustrates an important distinction. eSafety has not simply looked at whether individual children remain on platforms. Its assessment focuses on whether platforms have implemented appropriate systems and processes and taken the reasonable steps required by the law. 

In March 2026, eSafety reported that it had issued 23 legally enforceable information-gathering notices to 10 platforms and had significant compliance concerns involving Facebook, Instagram, Snapchat, TikTok and YouTube. The regulator stated that it was continuing to gather evidence to inform potential enforcement action.  

This is important because having enforcement powers is not the same as immediately exercising them. A regulator still needs evidence that can establish non-compliance against the legal standard. 

Australia therefore provides a useful illustration of the process from regulation to investigation to potential enforcement, rather than evidence that penalties have already been imposed. eSafety’s March 2026 compliance report specifically states that enforcement action requires sufficient evidence and that the evidence must establish that a platform has not taken the reasonable steps required by the law.  

The Internet Does Not Stop at the Border 

 The challenge becomes more complicated when the service being regulated operates globally. 

A government or regulator may establish requirements within its jurisdiction, but the service itself may be delivered through platforms, infrastructure and providers operating across multiple countries. A regulatory decision may identify what must change without necessarily determining how that change will be implemented across the wider digital environment. 

The EU KIDS Act reflects this broader challenge. Its proposal establishes a common EU framework while building on existing regulatory and supervisory structures. The European Commission would have responsibilities for services within its direct supervision, while the wider enforcement framework would also involve national authorities. 

The challenge, therefore, is turning regulatory requirements into effective enforcement, particularly when non-complying websites and services operate outside a country’s borders and have no local representatives. By establishing a country-level compliance ring, governments can use technical controls to restrict access to services that fail to meet national requirements, helping enforce local rules regardless of where those services are based. Indonesia provides a practical example: the country has used blocking measures against illegal online gambling websites and, more recently, Grok AI. These cases demonstrate how country-level technical enforcement can be applied to different types of online services to support national regulatory objectives. 

From Policy to Practical Action 

This raises an important question for regulators: once non-compliance has been established, what happens next? 

The answer will depend on the regulation, the jurisdiction and the service involved. In some cases, enforcement may take the form of a corrective measure, a legally binding undertaking or a financial penalty. In others, governments may need mechanisms that affect how a service is accessed or operates within a particular jurisdiction. 

That could involve different parts of the digital ecosystem, including platforms, regulators, app stores, identity and age-assurance providers, payment systems, network providers or other infrastructure. 

Identifying a breach is only part of the process. Regulators also need a way to ensure their decisions have an impact in practice, particularly when services operate across borders and are beyond their direct reach. 

A Broader Regulatory Challenge 

The same question extends beyond children’s online safety. 

Governments are introducing or considering rules around age-restricted services, online gambling, scams, illegal or unauthorised digital services and other areas where access or availability may be subject to legal requirements. 

Across these different areas, the regulatory process increasingly raises the same questions: 

  • What is the rule? 
  • Who is responsible for complying? 
  • How is compliance demonstrated? 
  • Who determines whether the requirements have been met? 
  • What happens when they have not? 
  • How is that decision enforced? 

As digital regulation becomes more specific, the final question becomes increasingly important. Without a practical mechanism for enforcement, a regulatory requirement can remain separated from the digital environment it is intended to govern. 

Closing the Enforcement Gap 

The evolution of digital regulation is creating a broader conversation about the relationship between regulation, compliance and enforcement. 

The EU KIDS Act is an important example because it moves beyond establishing principles for child online safety and places greater emphasis on demonstrable compliance, independent assessment and regulatory oversight. Its proposed enforcement structure shows how governments are beginning to build a more complete path from rules to accountability. But the path does not end with a regulatory finding. 

The next challenge is connecting that finding to practical action within a digital environment that is global, dynamic and difficult to control through traditional jurisdictional boundaries. 

The challenge is no longer simply creating the rules. It is building the path from regulation to compliance to enforcement. 

This is Part 3 of our series exploring the evolving relationship between digital regulation, compliance and enforcement. In Part 4, we will look at what happens when regulatory decisions need to be translated into practical, country-level enforcement.