By Inès Gentil (EU DisinfoLab), ATHENA partners and ARM project partners.
On 16 October 2025, partners from across Europe met in Ljubljana for the ATHENA FIMI Cluster Meeting, hosted by EU DisinfoLab as part of its annual conference #Disinfo2025. Around the table were researchers, fact-checkers and analysts from LAUREA, EOS, UCD, Maldita, the ARM project (CMO) – all working, in different ways, on the issues of foreign information manipulation and interference (FIMI) and democratic resilience.
The goals were to:
- compare notes on what we are seeing in the information space;
- connect that experience to current EU policy debates;
- sketch joint recommendations that can create synergy from our various projects.
This blogpost builds on our recent conversation and offers an early preview of the policy direction that we intend to take together.
From “bad content” to attacks on democratic systems
FIMI cluster partners underlined a shared premise: disinformation / FIMI are not about “wrong posts” but about strategic, coordinated operations (often foreign-led, but not always) aimed at eroding trust, distorting public debate and undermining democratic processes. These campaigns are fundamentally different from individual opinions or isolated mistakes. They exploit structural vulnerabilities in the information ecosystem, including opaque recommender systems, fragile media landscapes, targeted harassment of journalists and researchers, and weak enforcement of existing legislative and non-legislative obligations to spread disinformation and suppress information.
More precisely, these risks are compounded by platform design and functions – algorithms, advertising systems, and moderation infrastructures – that amplify, facilitate, reward and protect coordinated disinformation. Despite new obligations, structural barriers to the fight against disinformation / FIMI such as algorithmic opacity, linguistic gaps, and inconsistent enforcement persist. The distinction between simply bad content and coordinated attacks on democratic processes is essential: it puts the emphasis on regulation and platform accountability as tools to defend systemic resilience, not the policing of individual speech.
This framing matters. It shapes how we think about regulation, platform responsibility and what ultimately democratic resilience should look like.
Attribution in the age of GenAI: harder, but still essential
Unsurprisingly, generative AI was one of the meeting’s important themes. Partners from ARM and Maldita illustrated how AI is now used to scale up manipulation – from deepfaked public figures to synthetic newsrooms. EOS and UCD highlighted how these tools complicate attribution: even when a campaign’s intent is obvious, tracing it back to a specific actor is increasingly difficult.
The discussion turned to:
- developing checklists, frameworks and indicators that help identify FIMI campaigns even when attribution is incomplete;
- arming technical tools (AI-assisted forensics, network analysis) with strong ethical safeguards;
- facilitating attribution using regulatory tools such as DSA systemic risk assessment or sanctions regimes.
Whether it is long-running operations like Doppelganger or Storm-1516 that continue despite being exposed, the use of algorithmic manipulation obscures who is behind influence efforts. Platform business models still profit from harmful content. These are, at their core, challenges of attribution that remain unresolved partly due to a lack of enforcement of existing legislations.
The Digital Services Act: great on paper, fragile in practice
A second big theme was the DSA, which many around the table described as the main tool we currently have to deal with platforms’ role in FIMI.
Ironically and unsurprisingly, misinformation about misinformation abounds. Despite the siren voices arguing to the contrary, the DSA is not about asking platforms to be “the Ministry of Truth”. It is about making their systems transparent and accountable:
- It creates new obligations for platforms and especially for Very Large Online Platforms and Very Large Online Search Engines (VLOPs/SEs)
- It requires them to identify new and mitigate new and existing systemic risks – including those affecting our information ecosystem
- And it requires data access for researchers under Article 40.
In the room, everyone agreed: if properly enforced, the DSA can help ensure:
- the deletion of illegal disinformation
- a harmonised system for acting on illegal content
- a way to empower DSCs, national regulators that understand their own information ecosystems
- real transparency on how content is recommended, amplified or buried.
But we also know what can go wrong:
- Transparency without consequences: reports and audit documents that sit on a shelf
- Platforms defining their own “systemic risks” in ways that are convenient for them
- Fines treated as a cost of doing business, appealed for years while nothing changes on the ground.
This is why enforcement – not just new texts – is the real battlefield.
Data access: without it, everything else is theory
Almost every project brought forward the same challenge: we cannot study FIMI if we cannot see it.
Under the DSA, data access should be a cornerstone of accountability. Yet today:
- APIs are restricted or paywalled
- scraping remains legally ambiguous
- timelines for access are unpredictable
- many requests of the tech platforms simply go unanswered.
Researchers often have less usable data today than before the DSA entered into force. This severely limits the ability of civil society and academia to detect systemic risks, assess whether risk thresholds have been crossed, document harm, or inform enforcement.
A functional Article 40 should provide:
- meaningful datasets
- clear and timely procedures
- reasonable technical standards
- no barriers for basic transparency.
Without this, systemic risk regulation becomes guesswork.
At the same time, the Commission’s preliminary findings against Meta and TikTok for failing to grant access offer an opportunity: they show that the problems are systemic, not platform-specific, and reinforce the need for a harmonised and enforceable approach to data access across the board.
Democracy Shield, codes of conduct, and the “voluntary trap”
The conversation also touched on the emerging EU Democracy Shield and the broader trend towards voluntary measures: codes of practice / conduct, self-regulation, “voluntary assistance”, voluntary influencer networks, voluntary resilience centres…
Our shared view is simple:
- Voluntary frameworks can sometimes be useful as sources of evidence – they show how platforms present their commitments and where there are gaps or inconsistencies
- But they cannot be the backbone of Europe’s defence against FIMI. When platforms are not even fully complying with the law, asking them to go further “voluntarily” is wishful thinking.
The same goes for the Democracy Shield: we welcome the political signal, but we see a gap between the diagnosis (we need an “assertive, strategic, whole-of-society approach”) and the solutions (a patchwork of new and old initiatives, many of them voluntary, and unclear funding for civil society).
If the EU wants a real shield for democracy, it needs to:
- enforce existing laws (DSA, Transparency of Political Ads, AI Act, EMFA where relevant)
- create a permanent funding instrument, modelled on the European Endowment for Democracy, to support long-term monitoring, investigative capacity, and rapid-response analysis across Europe.
Where we go from here
This blogpost reflects our shared commitment to strengthen Europe’s ability to confront FIMI with coordinated, evidence-based and strategic action. Our goals are to:
- present a unified voice from the research and civil society community to EU institutions
- advocate for the robust and consistent enforcement of existing legislation, in particular but not only the DSA
- reinforce cross-project collaboration and alignment
- contribute to the development of a coherent and realistic European strategy for democratic resilience
The stakes are high: FIMI operations are accelerating, adapting, and exploiting vulnerabilities in our information ecosystems and institutional responses. Over the coming months, the FIMI Cluster projects will release concrete proposals, organise joint events, and publish coordinated outputs to better understand, document, and counter FIMI threats. Through shared intelligence, aligned policy messaging and sustained advocacy, we can ensure that Europe moves from fragmented reaction to systemic resilience.
.
Posted by: Nayara Güércio (Trilateral Research)