Bulgaria transposed NIS2 by amending its existing Cybersecurity Act rather than writing a new law, and the obligations applied from entry into force with no general grace period for compliance. The National Assembly adopted the amendments on 5 February 2026 and they were published in State Gazette (Държавен вестник) no. 17 of 13 February 2026. The amended Act (Закон за киберсигурност) replaces the old designation of operators of essential services with sector and size based scope, sets minimum and maximum fines in euro, and leaves the detail of entity identification and minimum security requirements to the Council of Ministers. This guide covers scope, authorities, the register, the Article 22 measures, incident reporting, penalties, the implementation timetable and what the regime means for service accounts, API keys and AI agents. It is for CISOs, compliance leads and auditors with Bulgarian operations. The Directive itself is covered in the NIS2 Directive Guide and cross-country status in the NIS2 Transposition Tracker.
Sources and status, checked 14 November 2026: article numbers, amounts and deadlines come from the consolidated text of the Cybersecurity Act, including the amendments in State Gazette no. 17/2026 and no. 55/2026. The adoption date is from CMS, DPC and Wolf Theiss. The entry into force date of 17 February 2026 relies on a single secondary source (Chambers and Partners) and is attributed in the text. The Council of Ministers decision on competent authorities, the identification methodology and the ordinance on minimum requirements were each due within set months of entry into force: confirm in the State Gazette whether each has been adopted before relying on the interim position described here. This page is not legal advice.
Key takeaways
- An amended Act, not a new one: the 2018 Cybersecurity Act was rewritten through State Gazette no. 17/2026, and a June 2026 amendment (no. 55/2026) moved the lead ministerial role to the Minister of Innovation and Digital Transformation.
- Scope is automatic, identification follows: Articles 4 and 4a apply by sector and size, while competent authorities formally identify essential and important entities within five months of the Council of Ministers decision under transitional § 48.
- Twelve measure areas: Article 22(2) lists twelve areas, including multi-factor or continuous authentication, change management and a policy for assessing whether measures work.
- Reporting runs 24 hours, 72 hours, one month to the sectoral CSIRT: Article 23(5) sets the clocks, with 24 hours for trust service providers' notifications.
- Fines have floors as well as ceilings: at least EUR 25,000 for essential entities and EUR 12,500 for important ones under Article 29, plus personal fines of EUR 500 to 5,000 for management body members who breach Article 21; fines for violations up to 1 June 2026 are halved (§ 51).
Legal framework and timeline
| Date | Event | Source |
|---|---|---|
| 13 November 2018 | Cybersecurity Act first promulgated, State Gazette no. 94 (the NIS1 law) | Consolidated Act |
| 5 February 2026 | National Assembly adopts the NIS2 amendments | CMS; DPC; Wolf Theiss |
| 13 February 2026 | Amending law published, State Gazette no. 17 | Consolidated Act; CMS |
| 17 February 2026 | Entry into force, according to Chambers and Partners, which also reports no transitional compliance period | Chambers |
| 1 June 2026 | Last date of violations that attract fines reduced by 50% (§ 51) | Consolidated Act |
| 16 June 2026 | State Gazette no. 55 reassigns ministerial functions to the Minister of Innovation and Digital Transformation | Consolidated Act |
| 6 months after entry into force | Council of Ministers designates competent authorities under Article 16(1) and adopts the methodology under Article 16(3)(8) (§ 47) | Consolidated Act |
| 8 months after entry into force | Council of Ministers adopts the ordinance on minimum requirements under Article 3(3) (§ 47); Schoenherr also gives eight months | Consolidated Act; Schoenherr |
| 9 months after entry into force | New National Cybersecurity Strategy (§ 47) | Consolidated Act |
| 5 months after the § 47 decision | Competent authorities identify essential and important entities and notify the minister (§ 48) | Consolidated Act |
Taking the Chambers entry into force date, the six-month and eight-month deadlines fall in August and October 2026, and entity identification roughly 11 months after entry into force if each step runs to time. Until the Article 3(3) ordinance takes effect, § 50 keeps the existing minimum security rules made under Article 243(3) of the Electronic Communications Act in place. Wolf Theiss describes the change as expanding coverage from 8 to 18 sectors.
Scope: essential and important entities
Article 4 covers administrative bodies and public and private entities in the sectors of Annex I and Annex II, with size measured against the medium enterprise definition in Article 3(1) of the Small and Medium-Sized Enterprises Act. Article 4(3) lists size-independent exceptions.
| Category | Who (Article 4a) |
|---|---|
| Essential | Annex I entities above the medium enterprise ceiling; qualified trust service providers, TLD registries and DNS service providers regardless of size; public electronic communications providers that are medium enterprises; entities identified as critical under Directive (EU) 2022/2557; operators of essential services as at the law's entry into force |
| Important | Annex I or Annex II entities that are not essential (Article 4a(2)) |
| Annex | Sectors |
|---|---|
| Annex I | Energy (electricity, district heating and cooling, oil, gas, hydrogen), transport (air, rail, water, road), banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management (managed service and managed security service providers), space ground infrastructure |
| Annex II | Postal and courier services, waste management, chemicals, food production and distribution, manufacturing (medical devices, electronics, electrical equipment, machinery, motor vehicles, other transport equipment), digital providers (online marketplaces, search engines, social networks), research organisations |
Because essential status also covers anyone already designated as an operator of essential services, entities from the NIS1 regime keep their higher tier. Banks and financial market infrastructures are also in DORA scope; see the DORA and NIS2 Overlap Mapping Guide.
Authorities and the register
- Council of Ministers: designates the national competent authorities (Article 16) and adopts the identification methodology and the minimum requirements ordinance.
- Ministry of Innovation and Digital Transformation: competent authority for administrative bodies and for entities under Article 4(7) and (8), host of the National Single Contact Point (Article 17) and keeper of the register (Article 6).
- Sectoral CSIRTs: set up at the national competent authorities (Article 18), with a National CSIRT (Article 19). Significant incidents go to the sectoral CSIRT.
- Crisis management: the Cybersecurity Council (Article 17a). The State Agency for National Security runs an incident monitoring centre (Article 15) and the Ministry of Interior a cybercrime centre (Article 14).
- Personal data: CMS notes that breaches involving personal data also engage the Commission for Personal Data Protection, and that a cybersecurity fine should not be added where the data protection authority has already fined the same infringement.
The register under Article 6(1) holds name, contact details, IP ranges, sector and the member states where services are provided, and Article 6(5) keeps it non-public. Certain digital providers must notify their main EU establishment within two months (Article 6(2)), and every entity must report changes within two weeks (Article 6(3)). Chambers points out that the Directive's Article 27 allows three months for changes, so the Bulgarian window is much tighter.
Cybersecurity measures and management duties
Article 22(1) requires appropriate and proportionate technical, operational and organisational measures. Article 22(2) lists the minimum areas, and Article 22(4) requires corrective measures when gaps are found. The detail will sit in the Article 3(3) ordinance; where an entity is a digital provider covered by EU implementing rules, see the NIS2 Implementing Regulation 2024/2690 Guide.
| Article 22(2) area | What evidence typically looks like |
|---|---|
| 1. Risk analysis and information system security policies | Approved policy, risk register, asset scope |
| 2. Incident handling | Runbooks mapped to the Article 23 clocks, CSIRT contact tested |
| 3. Business continuity, backups, disaster recovery, crisis management | Restore test records, crisis roles |
| 4. Supply chain security | Supplier inventory, contract clauses, Article 22(3) supplier vulnerability review |
| 5. Secure acquisition, development and maintenance, vulnerability handling | Secure development standard, patch and disclosure records |
| 6. Policies to assess effectiveness of measures | Control testing plan, metrics, internal audit |
| 7. Cyber hygiene and training | Training records for all staff |
| 8. Cryptography and encryption | Crypto policy, key management records |
| 9. HR security, access control, asset management | Joiner-mover-leaver records, access reviews, asset inventory |
| 10. Multi-factor or continuous authentication, secured communications | MFA coverage report, exceptions register |
| 11. Change management | Change records and approvals |
| 12. Reporting obligations | Reporting procedure and log of notifications |
- Management body: approves the risk measures and oversees their implementation (Article 21(1)).
- Training at a fixed interval: members complete cybersecurity training every two years (Article 21(2)) and offer similar training to staff (Article 21(3)). Chambers notes the Directive only asks for regular training. See the NIS2 Management Liability Executive Briefing.
- High-risk technology: where coordinated risk assessments restrict a technology, Article 27(2) allows up to three years to stop using it, shorter where national security risk is high.
Incident reporting to the sectoral CSIRT
The Act defines a significant incident as one that has caused or could cause serious operational disruption or financial loss to the entity, or that has affected or could affect others by causing significant material or non-material harm.
| Stage (Article 23(5)) | Deadline | Content |
|---|---|---|
| Early warning | Within 24 hours of identifying the incident (item 1) | CMS: whether unlawful or malicious acts are suspected and whether cross-border impact is possible |
| Incident notification | Within 72 hours (item 2); 24 hours for trust service providers | CMS: initial assessment of severity and impact, with technical information |
| Intermediate report | On request of the CSIRT (item 3) | Status update |
| Final report | Within one month of the notification (item 4) | Full account of the incident |
| Ongoing incident | Intermediate report at one month, final report within one month of resolution (item 5) | Progress, then final account |
The CSIRT replies to the early warning within 24 hours where possible (Article 23(6)). Personal data breaches run separately under GDPR Article 33; see the GDPR Compliance Guide for Security Teams.
Supervision and penalties
CMS reports that authorities can issue binding instructions, order security audits and require public disclosure, and for essential entities can seek a court order temporarily suspending licences or authorisations and barring individuals from management functions.
| Provision | Who | Amount |
|---|---|---|
| Article 29(2) | Essential entity breaching Article 22 or 23 | EUR 25,000 up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher (turnover cap not applied to administrative bodies, Article 29(5)) |
| Article 29(3) | Important entity breaching Article 22 or 23 | EUR 12,500 up to EUR 7 million or 1.4% of worldwide annual turnover, whichever is higher |
| Article 29(4) | Managers and management body members breaching Article 21 | EUR 500 to 5,000 |
| Article 28 | Entity failing an enforcement measure under Article 27и(1)(2) to (7) | EUR 2,500 to 12,000; repeat EUR 5,000 to 25,000 |
| Article 30(1) and (2) | Officials committing other Chapter Two violations | EUR 500 to 10,000; repeat EUR 750 to 15,000 |
Under § 51 fines for violations committed up to 1 June 2026 are reduced by 50%. That relief has now passed, so any breach of Article 22 or 23 from June 2026 onwards attracts the full range.
What it means for AI agents and non-human identities
- Area 10 covers machines too: Article 22(2) asks for multi-factor or continuous authentication. Workloads cannot use a second factor, so record the equivalent controls (short-lived tokens, workload identity federation, certificate binding) as the evidence. See the NHI Authentication Guide.
- Area 9 needs an inventory: access control and asset management evidence is incomplete without service accounts, API keys and agent identities, each with an owner.
- Log for the 24-hour clock: an early warning needs attributable logs of what a machine identity did. See Detection Engineering for Non-Human Identities Guide.
- Give agents their own identity: scoped identities per AI agent make the change management and access review areas testable. See AI Agent Identity vs Service Account.
- Supplier tokens are supply chain risk: integration credentials held by MSPs and SaaS vendors belong in the Article 22(3) supplier review. See the NIS2 Supply Chain Security Guide.
- Keep evidence for audits: rotation records, access reviews and secret scanning results answer an audit order quickly. See Audit Readiness for AI Agents and NHIs.
Framework mapping
| Bulgarian obligation | NIST CSF 2.0 | NIST SP 800-53 Rev 5 |
|---|---|---|
| Management approval and oversight (Article 21(1)) | GV.RR-02 | PM-2 |
| Risk analysis (Article 22(2) item 1) | ID.RA-05 | RA-3 |
| Asset management (item 9) | ID.AM-01 | CM-8 |
| Supply chain security (item 4, Article 22(3)) | GV.SC-07 | SR-6 |
| Multi-factor or continuous authentication (item 10) | PR.AA-03 | IA-2(1) |
| 24-hour, 72-hour and one-month reporting (Article 23) | RS.CO-02 | IR-6 |
| Two-yearly management and staff training (Article 21(2) and (3)) | PR.AT-01 | AT-2 |
Implementation approach
- Classify now: map activities to Annex I or II and test size against the SME Act, without waiting for the authority's identification under § 48.
- Prepare register data: assemble the Article 6(1) data, including IP ranges, and set up a process to report changes within two weeks.
- Gap assess against the twelve areas: use the Article 22(2) table, then refine against the Article 3(3) ordinance once it is in force; until then apply the § 50 interim rules where relevant.
- Train the management body: schedule training on a two-year cycle and record attendance.
- Rehearse reporting: identify your sectoral CSIRT and run a tabletop exercise against the 24-hour and 72-hour clocks.
- Measure: track MFA and equivalent coverage, percentage of non-human identities with an owner, time from detection to early warning, register update lead time and training currency.
Common failure patterns
- Waiting for identification: Chambers reads the law as having no transitional compliance period, so obligations do not start on the day the authority writes to you.
- Missing the two-week change window: teams used to the Directive's three months will report register changes late.
- Treating training as one-off: the two-year interval is fixed in Article 21(2).
- Counting on reduced fines: the 50% reduction only covers violations up to 1 June 2026.
- Leaving machine identities out of area 10: MFA evidence that covers only people leaves the authentication area half-documented.
Practitioner checklist
- Confirm Annex I or II sector, size and essential or important status.
- Check whether you were an operator of essential services under the 2018 law.
- Prepare Article 6(1) register data and a two-week change process.
- Identify the competent authority and sectoral CSIRT for your sector once designated.
- Gap assess the twelve Article 22(2) areas, including service accounts, API keys and agents.
- Schedule management body training every two years and staff training.
- Drill the 24-hour, 72-hour and one-month reporting clocks.
- Watch the State Gazette for the Article 3(3) ordinance and the Article 16 decision.
Standards and references
- Communications Regulation Commission: Cybersecurity Act, consolidated text
- CMS Bulgaria: Bulgaria adopts NIS2-aligned cybersecurity law
- Chambers and Partners: Bulgaria's long road to NIS2 is over
- Schoenherr: Bulgaria implements NIS 2 Directive, key changes to the Cybersecurity Act
- Wolf Theiss: Bulgaria's implementation of NIS 2, what businesses need to know
- DPC: Bulgaria adopts NIS2, key changes businesses need to know
Related NHI Mgmt Group resources: NIS2 Directive Guide, NIS2 Transposition Tracker, Romania NIS2 Implementation Guide, Greece NIS2 Implementation Guide, NIS2 Readiness Checklist. This guide summarises Bulgaria's NIS2 implementing law and is not legal advice.