Brussels reshapes telecoms. Who wins?

Why Now

On October 21, 2026, the Financial Times revealed that Michał Kobosko — the Polish MEP from the Renew (liberal) group and the European Parliament's rapporteur on the draft Digital Networks Act (DNA) — is tabling a draft report calling for stricter “sovereignty” criteria in satellite spectrum licensing (widely read as aimed at curbing SpaceX's expansion into direct-to-device connectivity), longer-term mobile spectrum licenses, and a mandatory timeline for switching off copper networks. On October 26, Table.Briefings confirmed that industry lobbies are already sharply divided over the text: Connect Europe (the big telcos) and Breko (alternative/“altnet” operators) are defending opposing positions.

Behind these headlines, though, lies something bigger than a lobby dispute. The DNA is the most sweeping reform of the EU's telecom regime in two decades — proposed by the European Commission on January 21, 2026, it would replace the European Electronic Communications Code (EECC), the BEREC Regulation and the Open Internet Regulation with a single, directly applicable regulation. The Commission's stated goal: ending a fragmented market of 27 national regimes. The idea is already meeting organized resistance from a group of member states — more on that below.

What the Act Actually Proposes

The Digital Networks Act draft bundles four practical changes:

A single “passport” for notification. Under Article 10.1 of the draft regulation, an operator that wants to offer electronic communications networks or services in more than one member state files a single notification with the regulator in just one of those states — the “Single Passport procedure.”
Longer-duration spectrum rights. License terms become indefinite (with exceptions), in exchange for spectrum-sharing obligations and “use it or lose it” rules.
Mandatory copper switch-off. Member states must submit a national fiber-transition plan by October 31, 2029, and copper networks must be decommissioned by December 31, 2035, with limited exceptions.
A standalone regime for satellite operators. A single EU-level authorization for satellite services and spectrum, with licenses running up to 40 years and coordination of filings with the International Telecommunication Union (ITU) — this is precisely where Kobosko wants to add “sovereignty and resilience” criteria, to leave room for vetting access by players like SpaceX.

For businesses like NoveSIM, and for mobile operators generally, the most intriguing line is the first one — the claim that “27 licenses become one.” That claim deserves a closer look — below.

Fact-Check: “27 Licenses Become One” — True, But With Important Caveats

Today. Mobile operators in the EU — including virtual operators (MVNOs) and eSIM/roaming resellers — operate under the so-called “general authorisation” regime of the EECC: no license is required in the classic sense, but a separate notification must be filed in every member state where the operator wants to offer service, and the operator must comply with national rules that vary by country (what practitioners sometimes call “gold-plating” on top of common EU law). In that sense, “27 licenses” is journalistic shorthand: these aren't licenses in the strict sense, but 27 separate administrative doors — each with its own set of conditions.

Under the draft regulation. Article 10.1 introduces the so-called “Single Passport procedure”: one single notification to the regulator in just one member state grants the right to offer service across the entire Union, instead of 27 separate notifications. National regulators will no longer be able to impose additional conditions (“gold-plating” is removed), and a new “Office for Digital Networks” will coordinate the process. Legally speaking, the claim holds — and nothing suggests MVNOs or eSIM players are excluded from this regime: the text refers broadly to “providers of electronic communications networks or services,” a category that, under current legislation, already includes virtual operators.

“Single notification” lowers the entry-level red tape, not the substantive obligations. The text is explicit: providers remain subject to national enforcement in every member state where they operate — one passport to get in, not one market once you're inside.
BEREC has already warned of “forum shopping” risk — a concentration of oversight responsibility in whichever state receives the first notification, with a risk of uneven supervision afterward.

Bottom line: the original claim holds directionally, but overstates the effect — what gets simplified is the door into the EU market, not the market itself.

The Catch: the Passport Comes With a New Burden That Falls Specifically on MVNOs

In parallel with simplifying market entry, the DNA interacts with the revised Cybersecurity Act, which introduces restrictions on “high-risk” suppliers of key ICT components. Components sourced from such suppliers must be replaced within three years of the law entering into force. For full MVNOs that control core network functions and virtualized network functions, this is a direct risk: failure to replace non-compliant components in time could let regulators withdraw their right to provide services — and in the worst case, bar them from operating in the EU altogether.

This is precisely why Jeroen Schouten, a lawyer at Pinsent Masons, describes the combination of the DNA and the new Cybersecurity Act as an “existential threat” to MVNOs — largely because of their often legacy sourcing arrangements for critical infrastructure. As he puts it, today's basic principle in telecoms is “you don't need a license to operate” — but the DNA and Cybersecurity Act together effectively introduce a licensing requirement through the back door of cybersecurity compliance.

And there's a second wrinkle: the very passport that makes market entry easier could also let mobile operators “shop” for the most lenient regulator for that first notification — precisely the risk BEREC calls “forum shopping.” This doesn't invalidate the passport, but it shows that “single entry” isn't pure simplification — it also shifts where the supervisory burden sits.

The Political Reality: None of This Is Law Yet

The legislative path is long and contested: on November 29, 2025, six member states — Austria, France, Germany, Hungary, Italy and Slovenia — sent a joint position to the Council of the EU, insisting on retaining control over their national spectrum policy. At the Telecoms Council on June 9, 2026, member states again flagged concerns over “excessive centralization” of powers at EU level, even as they broadly supported the reform's goals.

In Parliament, the process is at the “rapporteur's draft report” stage — Kobosko's proposals from October 21–26 are his personal position, which still has to clear a vote in the ITRE committee, then a plenary vote, and negotiations with the Council. Given that member states are already asking for more negotiating time, a realistic timeline for final adoption is no earlier than 2027. The single passport itself isn't among the publicly named flashpoints (spectrum control sits at the center of the resistance), but the broader mood of “less Brussels, more sovereignty” could easily trim it too.

What This Means for MVNO/eSIM Players and Bulgarian Telecoms

For alternative operators looking to grow across borders, the effect would be real but modest — not radical:

Upside: one notification instead of 27 cuts the time and cost of entering a new market — directly relevant for a travel-eSIM business whose natural audience is the whole EU, not a single country.
Caveat: substantive rules (data, security, law-enforcement access) stay national — a single passport doesn't exempt anyone from a 27-country compliance map.
Risk: if an MVNO relies on suppliers later classified as “high risk,” the three-year mandatory replacement window could cost more than the passport saves on market entry.

For telecoms in Bulgaria, the practical story is the mandatory transition to fiber infrastructure: the national plan is due by the end of 2029, and copper must be decommissioned by the end of 2035. That's a capital-spending question as much as a regulatory one, and it sits first and foremost with A1, Vivacom and the country's other network operators.

My reading

“27 licenses become one” sounds great on a conference panel, and at its core it's accurate: Bulgarian and other small operators will genuinely be able to enter the French or Greek market without filling out French or Greek paperwork — just a Bulgarian notification. That's a real win for anyone thinking cross-border in this business — NoveSIM included.

But the right question for anyone in the MVNO/eSIM business isn't “will it be easier to get in,” it's “who gets to shut you down once you're in.” While the press and the Commission's own messaging sell “one EU market,” BEREC is openly debating how much supervisory power will remain with whichever regulator happens to host the first notification, and lawyers are already warning of an “existential threat” from a completely different direction — supplier cybersecurity. Brussels isn't hiding the fact that it's opening the door with one hand and half-closing it with the other — it's just that nobody puts it that way in the press releases.

And finally — none of this is regulation yet. At best it becomes law no earlier than 2027, with transposition deadlines on top of that. If you work in this sector in Bulgaria or a neighboring country, now is the moment to track Kobosko's report and your own country's position — not to wait for the final text.