Summary

  • On 1 October, the European Commission sent Bulgaria an additional formal notice in DSA infringement case INFR(2024)2241, alleging gaps in the powers of two national authorities and in the design of penalties.
  • The Communications Regulation Commission (CRC) describes a domestic framework assigning work to three bodies. Article 49 of the DSA allows one or more competent authorities; the case is about whether the powers and rules actually meet the Regulation, not whether Bulgaria has the “right” number of agencies.

The European Commission’s latest step is a procedural notice to the Bulgarian state, not a finding against an online platform. In its 1 October letter, the Commission says Bulgaria still has not designated and empowered the Commission for Personal Data Protection (CPDP) and the Council for Electronic Media (CEM) for their roles under the Digital Services Act (DSA). It separately challenges how Bulgarian law sets penalties, including the applicable maximum fines and the distinction it says domestic rules make between natural and legal persons. These remain the Commission’s allegations, not a court ruling. The notice gives Bulgaria two months to respond; if the response is unsatisfactory, the Commission may issue another reasoned opinion.

The case has moved through several stages. The Commission opened infringement procedure INFR(2024)2241 with a December 2024 formal notice, then sent a reasoned opinion in May 2025. Bulgaria subsequently amended its Electronic Communications Act: the National Assembly adopted the amendments on 6 November 2025, and the State Gazette published them on 21 November. The Commission acknowledges that this legislation empowered one authority acting as a Digital Services Coordinator, but says that did not resolve the remaining issues. The State Gazette text sets out the domestic allocation; the Commission’s May 2025 opinion records the earlier stage.

The national regulator’s public account presents a more complete picture. The CRC says it is Bulgaria’s Digital Services Coordinator and names the CRC, CEM and CPDP as competent authorities. It describes the CRC’s supervision of intermediary services, CEM’s role over video-sharing platforms, and the CPDP’s oversight of personal-data processing under the DSA and GDPR. The CRC also says the terms for coordination among the three bodies are to be set by a joint instruction. That account is evidence of how the regulator describes the framework; it does not show that the Commission has accepted the legal sufficiency of each designation or power. The CRC’s responsibilities page sets out its account.

The Regulation leaves room for national design choices. Article 49 requires each Member State to designate one or more competent authorities and choose one of them as the Digital Services Coordinator. A state may assign specific tasks or sectors to other authorities, while the coordinator remains responsible for national coordination. Article 52 requires rules on penalties and says penalties must be effective, proportionate and dissuasive; it also sets maximum-fine limits. Neither article requires every country to use three agencies. The operative question is whether the national law gives each assigned body the authority required for its tasks and coordinates their work without leaving gaps. The DSA text contains those provisions.

This makes the disagreement narrower than a clash over institutional form. The CRC’s account describes assigned responsibilities; the Commission says some designations or powers and parts of the penalty regime remain deficient. The public statements do not resolve that legal difference, and the Commission has not referred this case to the Court of Justice. Its published coordinator-status timeline also records the October additional notice, but does not resolve the legal dispute. The stated next step is another reasoned opinion if Bulgaria’s response is unsatisfactory. The result will turn on the statutory detail and the authorities’ practical ability to supervise providers and apply consistent penalties—not on the label attached to the national framework.