The European Commission has escalated infringement proceedings against Bulgaria over its implementation of the Digital Services Act, arguing that legislative changes made after an earlier intervention still leave gaps in the country’s ability to enforce the platform rules.

The European Commission sent Sofia an additional letter of formal notice on 1 October, returning to a case that had already progressed to a reasoned opinion in May 2025. Bulgaria has two months to respond.

Member states must designate Digital Services Coordinators with sufficient powers to enforce the DSA within their jurisdictions. Bulgaria subsequently adopted legislation empowering one of the authorities involved, but the Commission says the Personal Data Protection Commission and the Electronic Media Council still have not been properly designated and empowered.

Brussels is also challenging Bulgaria’s implementation of sanctioning powers, saying national law does not always respect the regulation’s maximum fine limits or guarantee that penalties are effective, proportionate, and dissuasive. The Commission additionally objects to different treatment of individuals and companies that is not provided for by the DSA.

European rules still rely on national regulators

The DSA created a common rulebook for online intermediaries, covering issues ranging from transparency and marketplace obligations to the governance of the largest platforms. Enforcement is divided between Brussels and national authorities rather than concentrated in a single European regulator.

The Commission directly supervises designated very large online platforms and search engines, while domestic Digital Services Coordinators handle other providers established in their jurisdiction and participate in EU-wide cooperation. Incomplete national powers can therefore leave an enforcement gap even though the regulation itself applies across the single market.

Companies operating in several European countries face the same underlying obligations, but the practical experience of investigations, sanctions, and regulatory contact depends partly on the capacity of national bodies. Differences in staffing, legal powers, and procedures can produce uneven scrutiny until national systems catch up with the common rulebook.

Bulgaria’s case shows how implementation continues long after a technology law enters into force. Domestic legislation must designate the right institutions, give them investigative and sanctioning powers, and connect them with regulators elsewhere in Europe before a nominally common regime becomes operational in practice.

Enforcement capacity is becoming the harder test

Public debate around the DSA has concentrated heavily on Commission investigations involving the largest global technology groups, but national regulators oversee a much broader collection of digital services. Their work is less visible, although it determines whether smaller providers encounter a functioning supervisory system.

The institutional challenge extends beyond the DSA as Europe implements several overlapping technology regimes. Data protection, cybersecurity, AI, digital markets, and sector regulation can apply to the same company at the same time, increasing the need for domestic regulators to know where responsibilities begin and end.

Uneven enforcement can also influence competition. A provider established in a jurisdiction with a well resourced regulator may face faster scrutiny than a comparable business elsewhere, even though both operate under the same European law. The credibility of the single rulebook therefore depends partly on the institutions behind it.

The Commission’s notice is an allegation of non-compliance within the EU infringement process rather than a court finding against Bulgaria. Sofia can respond and make further changes, after which Brussels will decide whether its concerns have been resolved.

If the response is considered inadequate, the Commission says it may issue an additional reasoned opinion, another step before a possible referral to the Court of Justice. Bulgaria has already altered part of its framework since the earlier intervention, but Brussels now says the remaining shortcomings still affect both the authorities enforcing the DSA and the sanctions available to them.

Europe’s digital legislation is moving from the politically visible phase of passing rules into the slower work of supervision. Bulgaria’s dispute is one measure of whether national systems have acquired the legal machinery needed to make those rules operate consistently once the legislative attention has moved elsewhere.