The European Commission said on 1 October 2026 that it had sent Bulgaria an additional letter of formal notice in infringement case INFR(2024)2241 over compliance with the Digital Services Act, and it gave Sofia two months to reply. The same Commission record says Bulgaria had already received a reasoned opinion in May 2025 on the same file, making this a further step in an existing dispute rather than a new case. Commission notice DSA coordinators page
What changed, according to the Commission, is not the DSA itself but its Bulgarian enforcement framework. The Commission says Bulgaria adopted legislation empowering one authority acting as a Digital Services Coordinator after earlier infringement steps. But it also says the Personal Data Protection Commission and the Electronic Media Council still have not been designated and empowered as required to complete that framework. In the same notice, the Commission says Bulgarian sanctioning rules do not always respect the DSA's maximum fine limits and do not ensure that all penalties are effective, proportionate and dissuasive, including because Bulgarian law treats natural and legal persons differently in a way the Regulation does not establish. Commission notice
That matters because the DSA relies on a split enforcement model. The Commission's background page says every member state must designate and empower a Digital Services Coordinator, and that national coordinators can request access to data, order inspections and impose fines on providers of intermediary services established in their territory. The same page says the Commission has exclusive competence over the DSA's enhanced due-diligence obligations for Very Large Online Platforms and Very Large Online Search Engines, while competence is shared with national authorities for other obligations affecting those services. The analytical point is straightforward: an EU regulation can apply across the Union, but many day-to-day enforcement powers still depend on national authorities being properly set up. DSA coordinators page
Bulgaria's case also shows how an implementation gap can persist even after one institutional step is taken. The Commission's coordinators page associates Bulgaria with the Communications Regulation Commission, yet the infringement notice says two other Bulgarian authorities still need to be designated and empowered. The records provided do not explain that institutional division or identify which authority the Commission meant when it said one body had already been empowered. That limit matters for readers: the public record here establishes the Commission's legal complaint, but not the full national architecture or Bulgaria's defence. DSA coordinators page Commission notice
The timeline reinforces that this is about unfinished enforcement capacity, not a sudden substantive rewrite of platform rules. The background page lists a letter of formal notice on 16 December 2024, a reasoned opinion on 7 May 2025 and an additional letter of formal notice on 1 October 2026. The Commission says that if Bulgaria's reply is unsatisfactory, it may issue an additional reasoned opinion. The records do not include Bulgaria's response, so they cannot establish whether Sofia disputes the Commission's reading or plans a legislative fix. DSA coordinators page Commission notice
The broader significance is institutional. On the same date, in a separate energy-sector record, the Commission said it was referring Bulgaria to the Court of Justice over incomplete transposition of electricity-market rules and linked that action to its wider rulebook-enforcement agenda. That energy page does not mention the DSA case, so it cannot prove the contents of the digital package. But it does show the same Commission using infringement tools across sectors to press member states on implementation gaps. Energy infringements page
For platforms operating from Bulgaria, the immediate consequence is not a new DSA obligation announced on 1 October 2026. It is continuing uncertainty over whether the national bodies and penalty framework match the enforcement model required by EU law. Across the Union, that is a reminder that the DSA's uniform text is only part of the story: compliance risks depend not just on Brussels decisions about the largest platforms, but also on whether member states have built the national authorities that the Regulation expects. Commission notice DSA coordinators page
