NIS2 in Bulgaria

Key facts at a glance

Is your company in scope? Common Bulgaria scenarios

Two worked examples of how NIS2 scoping plays out in Bulgaria. Not sure where you land? Run the free NIS2 scope checker.

What Bulgaria businesses need to know

• Bulgaria transposed NIS2 by amending its 2018 Cybersecurity Act, Закон за киберсигурност. The amending act, adopted by the National Assembly on 5 February 2026 and promulgated in the State Gazette, No. 17 of 13 February 2026, sets no date of its own: it took effect on 17 February 2026, three days after promulgation (Constitution, Art. 5(5)). By the account of the Ministry of Innovation and Digital Transformation, Bulgaria notified full transposition on 6 March 2026; the European Commission closed its infringement case INFR(2024)0257 on 1 October 2026.

• There is no official consolidated text. The law in force is the 2018 act as amended six times, the last time by an act published on 16 June 2026 that renamed the Ministry of e-Government the Ministry of Innovation and Digital Transformation throughout. Article numbers changed meaning in 2026: Art. 21 held the notification limits of the 2018 text and now holds the duties of the management bodies, so an article number is only safe with the version it belongs to.

• The act names no single competent authority. The national competent authorities for cybersecurity (национални компетентни органи по киберсигурност, НКО in the act) are the administrative bodies the Council of Ministers designates by decision for the sectors and services of Annexes I and II, where a special law has not set one up (Art. 16(1)). The Ministry of Innovation and Digital Transformation is the authority for every administrative body and for the persons and organisations of Art. 4, points 7 and 8 (Art. 16(2)), and the national single point of contact sits there (Art. 17(1)). The Communications Regulation Commission is the authority for providers of public electronic communications, trust service providers and postal and courier services (Electronic Communications Act, Art. 21(6)), and the Supreme Judicial Council for the bodies of the judiciary (Judiciary Act, Art. 30(2), point 24).

• An entity does not register itself, and the act gives it no deadline to do so. The national competent authorities determine the essential and important entities under a methodology adopted by the Council of Ministers and notify the minister (Art. 16(3), point 8), who keeps the register of entities; the register is not public (Art. 6(1) and (5)). The act gave the Council of Ministers six months from the entry into force to designate the sector authorities and adopt the methodology, and gives the authorities five months from that decision to determine the entities (§ 47, point 1; § 48). Neither the decision nor the methodology is on Reglyze's record, so this page names no sector authority beyond those the acts themselves name.

• What the entity owes to the register: it notifies its national competent authority of any change in the data provided, within two weeks of the change (Art. 6(3)). The providers Art. 6(2) lists, among them DNS service providers, top-level-domain name registries, domain name registration services, cloud, data centre and managed service providers, give the authorities the address of their main establishment and of their other establishments in the Union or, where they have none there, of their representative, within two months of their coming into being.

• Every administrative body is an essential entity. The act applies to the administrative bodies, the bodies that belong to the system of the executive power (Art. 4, point 1; supplementary provisions, § 3, point 1), and counts every one of them as essential, with no size condition (Art. 4а(1), point 4), where the directive makes the public administration entities of central government essential. It also applies to the bodies of the judiciary (Art. 4, point 9), and to the persons performing public functions and the organisations providing public services that are not essential or important entities on another ground, when they deliver administrative services electronically (Art. 4, points 7 and 8). Public administration is not a sector of the act's Annex I.

• For the Annex I and II types the size test is the directive's, read through the national act on small and medium-sized enterprises: medium-sized or larger, with partner and linked enterprises counted and the rule on 25 % public control set aside (Art. 4, point 2). In scope at any size: providers of public electronic communications networks or of publicly available electronic communications services, trust service providers, top-level-domain name registries and DNS service providers (Art. 4, point 3), the entities identified as critical under Directive (EU) 2022/2557 (point 4) and domain name registration services (point 5).

• Two classes, as in the directive. Essential: the Annex I types above the ceilings of a medium-sized enterprise, qualified trust service providers, top-level-domain name registries and DNS service providers at any size, providers of public electronic communications from medium size, every administrative body, the entities identified as essential under Art. 4, point 3, letters г to ж, the critical entities, and whoever was designated an operator of essential services on the date the act entered into force (Art. 4а(1)). The other entities of an Annex I or II type that the act covers are important, among them those identified as important under the same letters (Art. 4а(2)). Domain name registration services are in scope for the duties that name them, and Art. 4а gives them no class.

• Incidents go to the sectoral CSIRT, and only to it. Essential and important entities notify the sectoral computer security incident response team (секторен екип за реагиране при инциденти с компютърната сигурност, СЕРИКС) set up at their national competent authority of every significant incident (Art. 23(1), Art. 18(1)), where the directive says the CSIRT or, where applicable, the competent authority. The limits run from the establishment of the incident ('след установяването'), a word the act does not define, where the directive counts from becoming aware: an early warning (ранно предупреждение) within 24 hours, an incident notification (уведомление за инцидент) within 72 hours, 24 for trust service providers, an interim report (междинен доклад) at the CSIRT's request, and a final report (окончателен доклад) no later than one month after the notification (Art. 23(5), points 1 to 4). An entity that has not handled the incident by then files an interim report, then the final report within one month of handling it (point 5).

• Reglyze counts both limits from detection, which can never give a later deadline than the act's. The act refers the form of the notification to the ordinances of its Art. 3 (Art. 23(1)), and this page names no reporting channel. For an incident with critical systems of strategic sites and of activities that matter for national security, the entity's head also notifies the centre at the State Agency for National Security at once (Art. 15(6)).

• Management bodies train every two years. The management bodies of essential and important entities and the administrative bodies approve the cybersecurity risk-management measures and oversee their implementation (Art. 21(1)). The members of the management bodies of essential and important entities must undergo training every two years ('на всеки две години'), where the directive sets no interval, and must offer and organise that training for their employees as well, where the directive only encourages it (Art. 21(2) and (3)). Any natural person responsible for the entity or acting as its legal representative has the powers needed to ensure compliance with the act and can be held liable for failing in those duties (Art. 27к(5)).

• Twelve measures, and two ordinances for their minimum scope. The measures rest on an all-hazards approach and include the directive's ten and two more: change management of information assets (Art. 22(2), point 11), and the risk-management measures and reporting obligations for entities of an Annex I or II type and for entities identified as critical under Directive (EU) 2022/2557 (point 12). Supply-chain security covers the security-related aspects of the relationships between each entity and its direct suppliers or service providers (point 4). An ordinance of the Council of Ministers sets the minimum scope of the measures for every entity except providers of public electronic communications (Art. 3(2)); a second one, proposed by the Communications Regulation Commission and the minister, sets it for providers of public electronic communications, trust service providers and postal and courier services (Art. 3(3)). The act gave eight months from its entry into force for both (§ 47, points 2 and 3). Neither ordinance, in a version aligned with the act, is on Reglyze's record, and Reglyze assesses Bulgarian entities on the NIS2 substrate.

• The Council of Ministers may impose certified products and restrict technologies, by decree. To prove compliance with particular requirements of Art. 22, a decree adopted on a proposal of the Cybersecurity Council may require essential and important entities to use particular ICT products, ICT services and ICT processes, proven suitable in operational and economic terms and certified under the European cybersecurity certification schemes (Art. 24). The same council prepares the reasoned proposal for a decree restricting the use, by the entities in scope, of specific technologies or of critical supply chains of ICT services and ICT products (Art. 27(1)); an entity that already uses a technology so restricted stops using it within three years of the decree's adoption, or within the shorter period the decree sets where the risk to national security is high (Art. 27(2)).

• A special law that requires risk-management measures or the notification of significant incidents with at least equivalent effect displaces the corresponding provisions of the act, supervision included (Art. 6а(1)). The clause speaks of a special law and names no Union act: banking and financial market infrastructures stay in Annex I, and DORA appears in the act as cooperation between authorities (Art. 16(13)).

NIS2 in Bulgaria: frequently asked questions

Is NIS2 in force in Bulgaria?

Yes, since 17 February 2026. The act amending the Cybersecurity Act (Закон за киберсигурност) was promulgated in the State Gazette, No. 17 of 13 February 2026, and sets no date of its own, so it took effect three days after promulgation under Article 5(5) of the Constitution. The date is not 13 February: that is the day of promulgation. The European Commission closed its infringement case against Bulgaria on 1 October 2026.

Does a Bulgarian company have to register under NIS2?

No, the act sets no self-registration and no deadline for one. The national competent authority of each sector determines the essential and important entities under a methodology adopted by the Council of Ministers and notifies the minister, who keeps a register that is not public (Art. 16(3), point 8; Art. 6(1) and (5)). What an entity owes is the notification of any change in its data within two weeks (Art. 6(3)) and, for the digital types of Art. 6(2), the addresses of its establishments in the Union within two months.

Where does a Bulgarian entity report a significant incident?

To the sectoral CSIRT (секторен екип за реагиране при инциденти с компютърната сигурност, СЕРИКС) set up at its national competent authority, and only to it (Art. 23(1), Art. 18(1)): the act does not keep the directive's alternative, the competent authority. The early warning is due within 24 hours and the incident notification within 72 hours of the establishment of the incident, 24 for trust service providers; the final report follows no later than one month after the notification (Art. 23(5)). The act does not define the establishment of the incident, and Reglyze counts both limits from detection, which can never give a later deadline than the act's. The act refers the form to the ordinances of its Art. 3, and this page names no reporting channel.

Who is the NIS2 competent authority in Bulgaria?

There are several. The Council of Ministers designates by decision the administrative bodies that act as national competent authority for the sectors of Annexes I and II, where a special law has not set one up (Art. 16(1)). The acts themselves name three: the Ministry of Innovation and Digital Transformation for every administrative body and for the entities of Art. 4, points 7 and 8 (Art. 16(2)), the Communications Regulation Commission for public electronic communications, trust services and postal and courier services (Electronic Communications Act, Art. 21(6)), and the Supreme Judicial Council for the judiciary (Judiciary Act, Art. 30(2), point 24). The ministry also hosts the national single point of contact (Art. 17(1)). The decision designating the other sector authorities is not on Reglyze's record.

How often must the management of a Bulgarian entity train on cybersecurity?

Every two years. The members of the management bodies of essential and important entities must undergo training every two years, to gain enough knowledge and skills to identify risks and to assess cybersecurity risk-management practices and their impact on the services the entity provides (Art. 21(2)), where the directive says regularly and sets no interval. They must also offer and organise that training for their employees (Art. 21(3)), where the directive only encourages it.

Is a small Bulgarian IT company in scope?

It depends on what it provides. Trust services, DNS services, a top-level-domain name registry and public electronic communications are in scope at any size (Art. 4, point 3), and so are domain name registration services (point 5). Cloud, data centre, managed service and managed security service providers are in scope from medium size, by the size test of the national act on small and medium-sized enterprises with partner and linked enterprises counted (Art. 4, point 2), unless they are identified on one of the grounds of Art. 4, point 3. A supplier outside the act still meets it through its customers, whose measures cover their direct suppliers and service providers (Art. 22(2), point 4).