NIS2 in Bulgaria

The law

The National Assembly adopted the amendment on 2026-02-05. The State Gazette published it on 2026-02-13 (issue 17). The law sets no later start date. The Constitution says a law takes effect 3 days after publication, so on 2026-02-16. Some secondary sources give 2026-02-17. The State Gazette published a further amendment on 2026-06-16 (issue 55). The 2026 amendment keeps the 2018 Act and rewrites it to follow the Directive.

Name

Закон за киберсигурност (изм. и доп. ДВ бр. 17/2026)Cybersecurity Act, as amended in 2026

Published

2026-02-13

In force

2026-02-16

Text

Read the Cybersecurity Act

Who is in scope

Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.

Where Bulgaria differs

• Art. 4a(1) points 2 and 3 Cybersecurity Act Qualified trust service providers, TLD registries and DNS providers are essential at any size. Medium-sized public electronic communications providers are essential.
• Art. 4 point 3 Cybersecurity Act Entities in Annex I or II of any size are in scope when they are sole providers, or when a disruption would affect public safety, public health or systemic risk.
• Art. 4 point 2 Cybersecurity Act Entities that meet or exceed the medium-size limit are in scope. The size test ignores the partner and linked-enterprise rule of the SME law (Art. 4(9)).
• Art. 4 point 9 Cybersecurity Act The judiciary is in scope. Public administration and public bodies that offer e-services are also in scope.
• Art. 6a Cybersecurity Act A sector law replaces the Act when it has an equal or stronger effect.

Also note

• National competent authorities by sector name the entities. The Communications Regulation Commission is the competent authority for telecoms.
• The Act sets deadlines for several Council of Ministers acts. These are the decision on the authorities, the method to name entities, the ordinance on minimum measures and the national strategy.
• The Act uses 2 classes: essential (съществени) and important (важни) entities.

Registration

Bulgaria has no self-registration step. The national competent authorities name the essential and important entities. The Minister of Innovation and Digital Transformation keeps a closed register of them. The register is not public. The Council of Ministers had 6 months from the entry into force to name the competent authorities. The authorities then have 5 months to name the entities. DNS, TLD, cloud, data centre, CDN, managed service and online platform providers send their establishment address to the authority within 2 months. Every entity reports a data change within 2 weeks.

Portal

Register of the Minister of Innovation and Digital Transformation

Rule

The authority names the entities. There is no self-registration

You need

Name, address, contact data, IP ranges, sector and type, and the Member States where you serve. Some providers send their EU establishment address within 2 months.

Changes

Report changes to your data within 14 days

Incident reporting

1. 24 hEarly warning
2. 72 hIncident notification
3. 1 monthFinal reportafter the notification

Send the reports to the sector CSIRT (СЕРИКС), which links to the national CSIRT (НЕРИКС).

Trust service providers send the incident notification within 24 hours. An interim report follows on request. The entity files a final report 1 month after the end of an ongoing incident. Strategic sites report at once to the State Agency for National Security centre.

Measures and proof

Essential

The authority can run regular and targeted security audits, or order an independent body to run them. It can ask for evidence such as audit results from a qualified auditor. The entity pays for a targeted audit by an independent body. The law sets no audit duty with a fixed cycle.

Important

The authority can run targeted security audits only, and The entity pays for an audit by an independent body. The law sets no audit cycle.

The dates, in order

1. 2026-02-16 The amendment takes effect (3 days after publication)Derived from a rule in the law
2. 2026-06-01 The 50% fine reduction for earlier violations ends
3. 2026-08-16 Deadline for the Council of Ministers to name the authorities (6 months)Derived from a rule in the law
4. 2026-10-16 Deadline for the minimum-measures ordinance (8 months)Derived from a rule in the law

Duties of management

The management body approves the risk measures and checks how the entity applies them. Each member takes training every 2 years. The members also offer and organise training for staff. A member who breaks these rules can pay a personal fine of EUR 500-5,000.

Fines

The ceiling is the higher of a fixed amount and a share of the worldwide annual turnover of the group.

The floor is EUR 25,000 for essential and EUR 12,500 for important entities. The higher amount applies. The % applies to the undertaking the entity belongs to. Violations up to 2026-06-01 carry fines cut by 50%. A manager who breaks Art. 21 pays EUR 500-5,000. Failure to obey an enforcement measure costs EUR 2,500-12,000. Public bodies are exempt from the essential-entity ceiling.