The European Union has significantly advanced its digital regulatory framework in recent years, and by May 2025, several cornerstone legislative acts are entering full force or nearing full implementation. The Digital Services Act (DSA) and the Digital Markets Act (DMA) have already begun to reshape obligations for online platforms and digital gatekeepers. Meanwhile, other key regulations — including the AI Act, Data Act, and the European Digital Identity Framework — are establishing new compliance expectations across sectors. For businesses operating in or targeting the EU market, it is now essential to monitor and adapt to this evolving digital legal landscape.
Digital Services Act (DSA):
The DSA, which fully applies from 17 February 2024, focuses on accountability and transparency for online platforms, especially those hosting third-party content. It introduces due diligence obligations for intermediaries and stricter rules for Very Large Online Platforms (VLOPs) and Very Large Online Search Engines (VLOSEs). Businesses offering online services in the EU must ensure proper notice-and-action mechanisms, clear terms of service, and risk assessments for systemic harms. This marks a shift from soft-law standards to enforceable duties, with potential liabilities and enforcement by national Digital Services Coordinators (DSCs). In Bulgaria, the designation of a Digital Services Coordinator is still pending, however Tashev Legal closely monitors all legislative developments to keep clients informed and prepared for upcoming national implementation measures.
Digital Markets Act (DMA):
The DMA, enforced since May 2023, targets dominant digital players designated as “gatekeepers” — such as large tech firms controlling core platform services. It imposes obligations to maintain fair competition, such as preventing self-preferencing and ensuring data portability. While the DMA directly targets large platforms, its ripple effects extend to businesses that rely on them. Companies should re-examine their digital distribution strategies and contractual arrangements in light of potential changes in platform behavior mandated by the regulation.
AI Act:
Looking ahead, the AI Act — the world’s first horizontal AI regulation — will apply in stages. Some bans on ‘unacceptable risk’ AI systems (such as social scoring and untargeted facial recognition scraping) take effect from 2 February 2025. By 2 May 2025, providers must have codes of practice ready, while the core provisions for high-risk systems become fully applicable on 1 August 2026. Businesses developing or using AI must begin classifying their systems and preparing for conformity assessments, transparency disclosures, and human oversight safeguards.
Data Act:
The Data Act will apply from 12 September 2025, for most provisions. It governs access to and use of non-personal data generated by connected products and services, aiming to foster data sharing while protecting trade secrets and ensuring contractual fairness. In short, it clarifies who can access what data and under which conditions. Obligations for the design, manufacture, and provision of connected devices will apply from September 2026, and some provisions on unfair contractual terms will apply from September 2027 for certain long-running contracts. Companies that manufacture smart devices or offer digital services will need to review their data-sharing practices and B2B or B2G data access arrangements.
European Digital Identity Regulation:
The European Digital Identity Regulation (eIDAS 2.0) entered into force on 20 May 2024. Member States must provide EU Digital Identity Wallets to citizens within 24 months of the adoption of implementing acts, with technical standards to be established by November 2024. By 2026, citizens and businesses should be able to use secure digital identities, and private entities will be required to accept them under certain conditions. This development will affect onboarding, authentication, and electronic signatures across industries — especially financial services, legal services, and regulated professions.
For businesses and legal advisors, the digital rulebook is no longer theoretical. These instruments collectively represent a broad regulatory shift in how digital services, data, and technologies are governed in the EU. Legal guidance is becoming indispensable not only for compliance but also for aligning operations with strategic opportunities created by the digital single market. Tashev Legal is here to support your business at every stage of the digitalisation process, offering clear and practical guidance on all related questions and compliance matters.
