Commission gives Bulgaria two months to complete DSA enforcement framework

The European Commission has given Bulgaria two months to address gaps in enforcement of the Digital Services Act (DSA). The Commission says two national authorities remain undesignated and unempowered. It also says the national rules do not always follow the Regulation’s limits and penalty requirements.

What must Bulgaria complete?

The DSA requires Member States to designate Digital Services Coordinators, national authorities responsible for enforcing the Regulation within their jurisdictions. Those coordinators must be fully operational for the rules to take effect and to provide legal certainty for companies. The Commission says Bulgaria has not designated and empowered the Personal Data Protection Commission and the Electronic Media Council. It considers these authorities necessary to complete the national enforcement framework.

The Commission says Bulgaria has already adopted legislation empowering one authority that acts as a Digital Services Coordinator. That step followed an earlier letter of formal notice and a reasoned opinion sent in May 2025. The additional letter of formal notice therefore concerns shortcomings the Commission says remain after those earlier actions. The new response period gives Bulgaria two months to address the issues raised.

What prompted the Commission’s action?

The procedure concerns alleged non-compliance with the Digital Services Act, Regulation (EU) 2022/2065. Under the Regulation, each Member State must have authorities able to enforce the rules within its territory. The Commission says full operation of those authorities supports users’ ability to benefit from the rules and gives companies legal certainty. Its view is that the framework in Bulgaria remains incomplete despite the legislation empowering one authority.

The Commission has also raised concerns about how national law provides for sanctions. It says the law does not always respect the maximum fine limits set by the DSA. It further says the penalties are not ensured to be effective, proportionate and dissuasive in every case. The Commission also points to a distinction between natural and legal persons that it says the Regulation does not establish.

What happens after the response period?

Bulgaria now has two months to reply and address the shortcomings identified by the Commission. The Commission has not said in the supplied information whether Bulgaria will take specific legislative or administrative steps during that period. Its next procedural move depends on the response and whether it considers that response satisfactory. No outcome of the new notice is stated in the available account.

The Commission may issue an additional reasoned opinion if it does not receive a satisfactory response. The earlier reasoned opinion was sent in May 2025, before Bulgaria empowered one authority through legislation. The current notice says the Commission still considers two authorities and the sanctions framework unresolved. The account does not give a later deadline or describe any decision beyond the possible next opinion.

Key points

• The Commission’s notice gives Bulgaria two months to respond.
• The Personal Data Protection Commission and Electronic Media Council are the two authorities identified.
• The Commission says national rules do not always respect maximum fine limits or ensure qualifying penalties.
• An additional reasoned opinion may follow if the response is unsatisfactory.

The notice records the Commission’s assessment, while Bulgaria’s response is not included in the supplied material. Whether the two authorities will be empowered within the response period remains unknown. The Commission’s next stated option is another reasoned opinion if it finds the reply unsatisfactory.