When the EU changed the rules of VAT on imports so that everything imported by consumers was charged VAT no matter the price paid and set up a system where foreign sellers could themselves charge the VAT on payment and then send it to the appropriate EU nation (otherwise ALL of their consignements would get stuck at customs waiting for the buyer to pay VAT) AliExpress immediatelly implemented the necessary elements and became part of that system even though they’re a Chinese company.

The point being that if the EU authorities want to, they can put the responsability for proving compliance on the entities selling those products to European customers (along with stiff penalties if they try to rig the system) and everything else just gets stuck at the border untill the proper paperwork (nowadays it would be digital documents) gets provided.

There’s already a system in place that any foreign company which wants to export to the EU must follow to certify their products (this is how they get the CE mark, using the services of TÜV Rheinland for example) so the most straightforward approach would involve the likes of AliExpress themselves having to check compliance and digitally provide the necessary documentation (or, more likely, the reference code for that documentation at a central database) to keep the stuff sold through them from being stuck on customs and risk be kicked out of the system if they let non-compliant products thorough (and all their shit then gets stuck at customs).

The point being that the whole part of the system were stuff getting imported by importers and consumers alike goes through customs is already in place, it’s just that they’re not stopping and examining everything, but they can (at the cost of every consumer order out there getting stuck in customs for months) and the last time the EU said that it was exactly what they would do if foreign sellers didn’t withold VAT at the source and send it to the EU, everybody complied, so that can probably be used for things like Regulatory Compliance (which itself also has a whole system of certification in place that’s used for products to get the CE mark that does the compliance validation part, so it’s a question of connecting both things)