Bulgaria NIS2 Transposition

Amendments to the Bulgarian Cybersecurity Act transposing NIS2.

Analysis

Bulgaria has transposed the NIS2 Directive by amending its existing Cybersecurity Act (Закон за киберсигурност), with the main NIS2‑aligned amendments adopted on 5 February 2026 and promulgated in State Gazette issue 17 on 13 February 2026.Directive (EU) 2022/2555 NIS2 Act amending the Cybersecurity Act – Bulgaria (overview) NIS2 status Bulgaria

Below is a structured analysis aligned with your requested sections. Because the consolidated Bulgarian Act text is only available in Bulgarian in the State Gazette, I will cite high‑quality legal and regulatory summaries and, where possible, EU primary sources.

Key Requirements (Bulgarian NIS2 Transposition)

• Transposition instrument and entry into force
• Bulgaria transposes NIS2 by amending the 2018 Cybersecurity Act, rather than adopting a standalone NIS2 law.NIS2 status Bulgaria NIS2 in Bulgaria – transposition and authority
• The Act amending and supplementing the Cybersecurity Act was adopted by the National Assembly on 5 February 2026 and promulgated in State Gazette (Държавен вестник) No. 17 on 13 February 2026.NIS2 in Bulgaria – transposition and authority NIS2 timeline – Bulgaria
• Under Bulgarian constitutional rules, the amendment enters into force three days after promulgation (17 February 2026).NIS2 in Bulgaria – transposition and authority

• Scope of application and sector coverage
• The Bulgarian Act aligns with the NIS2 sectoral model, extending coverage to 18 critical sectors, including 11 “sectors of high criticality” (e.g., energy, transport, banking, health, drinking water, digital infrastructure, public administration) and 7 “other critical sectors” (e.g., postal and courier services, waste management, food production, manufacturing, digital providers, research).Bulgarian National Assembly debate summary NIS2 Directive text – Annexes I and II
• Bulgaria’s amended Cybersecurity Act introduces Annexes I and II that classify sectors and entities, substantially widening coverage compared to the original NIS1‑based regime.NIS2 Bulgaria – sectors and entities Transposition in Bulgaria – NIS2 Directive

• Classification of entities: essential vs. important
• The law distinguishes “essential entities” and “important entities”, mirroring NIS2’s classification and applying it to medium and large entities in Annex I/II sectors and certain entities irrespective of size.Transposition in Bulgaria – NIS2 Directive NIS2 status Bulgaria
• Coverage becomes automatic by sector and company size, rather than by individual designation by an authority, creating a more objective, criteria‑based system.NIS2 Bulgaria – sectors and entities NIS2 Directive Article 2–3

• Risk management and technical/organizational measures
• The amended Act imports NIS2’s risk‑management obligations, requiring covered entities to implement “appropriate and proportionate” technical and organizational measures addressing:
• risk analysis and information system security
• incident handling
• business continuity and crisis management
• supply chain security
• security in network and information systems acquisition, development and maintenance
• policies and procedures for vulnerabilities disclosure
• cybersecurity training.Deloitte – Bulgarian Cybersecurity Act changes NIS2 Article 21 – Cybersecurity risk-management measures
• Bulgaria’s Cybersecurity Act now explicitly assigns risk‑management duties to management, with consequences for non‑compliance.NIS2 timeline Bulgaria – management accountability AmCham Bulgaria – key changes businesses need to know

• Incident reporting obligations
• The amended Act aligns incident reporting with NIS2, introducing a 24‑hour initial notification requirement to the competent Bulgarian authorities for significant incidents.AmCham Bulgaria – incident reporting requirement NIS2 Article 23 – reporting obligations
• NIS2 requires multi‑stage reporting (early warning, incident notification, final report); Bulgarian transposition follows this structure via the Cybersecurity Act.NIS2 Directive – Article 23 NIS2 status Bulgaria

• Supervision, enforcement, and penalties
• Bulgaria’s amendments expand supervisory powers of competent authorities (Ministry of e‑Government / State e‑Government Agency, and sectoral regulators), including on‑site inspections, audits, and binding instructions.NIS2 Directive implementation in Bulgaria – authority NIS2 status Bulgaria
• The law introduces a rewritten penalty scale with statutory minimum fines and significant maximum penalties, aligned with NIS2’s ranges (for essential entities, up to EUR 10 million or 2% of worldwide annual turnover; for important entities, up to EUR 7 million or 1.4%).AmCham Bulgaria – fines and sanctions NIS2 Article 34 – penalties
• There is a temporary reduction of fines during the initial months after entry into force (until 1 July 2026) to facilitate transition.NIS2 timeline Bulgaria – reduced penalties AmCham Bulgaria – transitional fine regime

• Management accountability and governance
• The Bulgarian Cybersecurity Act now introduces personal responsibility for senior management for implementing and overseeing cybersecurity measures, including possible sanctions for failing to fulfill governance duties.AmCham Bulgaria – personal responsibility for management NIS2 Article 20 – management accountability
• The Act requires management approval of cybersecurity risk‑management measures and participation in training, consistent with NIS2 governance requirements.Deloitte – Bulgarian Cybersecurity Act changes NIS2 Article 20

Compliance Challenges

• Identifying whether an entity is in scope
• Organizations struggle to determine whether they qualify as essential/important entities under the Bulgarian criteria (sector + size + specific listed categories), especially in complex group structures.Transposition in Bulgaria – NIS2 Directive NIS2 Bulgaria – scope and coverage
• Industry analyses highlight confusion in sectors like manufacturing, research, and digital providers, where borderline cases and cross‑border operations complicate scope assessment.Wolf Theiss – Bulgaria’s implementation of NIS2 IBA – Transposition of NIS2 in Bulgaria

• Overlap and fragmentation of regulatory obligations
• Telcos, financial institutions, and cloud providers in Bulgaria must navigate overlapping regimes (NIS2‑aligned Cybersecurity Act, sector‑specific telecom, finance, data‑protection rules), leading to complex compliance mapping.IBA – overlapping rules for telcos NIS2 Directive Recitals on interaction with other EU law
• Legal commentary warns that avoiding duplication across frameworks (e.g., NIS2, GDPR security obligations, sector supervisory rules) is a major project and documentation challenge.Wolf Theiss – Bulgaria NIS2 implementation analysis Deloitte – Bulgarian Cybersecurity Act changes

• Incident reporting within 24 hours
• The 24‑hour initial incident reporting obligation requires organizations to rapidly detect, classify, and escalate incidents, which many lack the technical and organizational maturity to achieve.AmCham Bulgaria – 24‑hour incident reporting NIS2 Article 23 – reporting timelines
• Case‑study style analyses of NIS2 implementation in other Member States show frequent under‑reporting or late reporting during initial periods, suggesting similar challenges are likely in Bulgaria.RISI NIS2 Transposition Tracker – enforcement notes NIS2Have – enforcement status commentary

• Building adequate risk‑management and governance structures
• Many medium‑sized Bulgarian entities lack formal risk‑management frameworks and must build governance structures, policies, and controls from scratch to satisfy NIS2‑aligned obligations.Deloitte – Bulgarian Cybersecurity Act changes NIS2 Article 21 requirements
• Legal and consulting analyses emphasize training boards and senior executives on new accountability obligations to avoid personal liability and fines.Wolf Theiss – Bulgaria NIS2 implementation AmCham Bulgaria – personal liability aspect

• Supply‑chain security and third‑country technologies
• NIS2 and the Bulgarian Act require assessment of supply‑chain security, including potential restrictions on “high‑risk” technologies from third countries, coordinated at EU level.NIS2 Article 21(2)(d) – supply chain security AmCham Bulgaria – high‑risk technologies provision
• Businesses face practical difficulty conducting supplier risk assessments and contractual alignment, especially SMEs relying on global cloud or ICT services.Wolf Theiss – supply‑chain implications NIS‑solutions Bulgaria – compliance overview

Implementation Best Practices

• Perform a structured NIS2/Bulgarian Cybersecurity Act gap analysis
• Organizations should map existing controls to NIS2 Article 21 and Bulgarian implementing provisions, identifying gaps in risk analysis, incident handling, business continuity, supply‑chain security, and training.NIS2 Article 21 – risk-management measures Deloitte – practical implications of Bulgarian Act
• EU‑level guidance and sector‑specific documents (e.g., ENISA NIS2 implementation materials) can serve as reference frameworks for designing controls.ENISA – NIS2 Directive overview and guidance Digital Strategy – NIS2 implementation in Member States

• Establish clear governance and management accountability
• Implement formal cybersecurity governance, including:
• assigning a CISO or equivalent
• establishing a cybersecurity steering committee
• defining roles and responsibilities for incident response and reporting.NIS2 Article 20 – management obligations NIS2 timeline Bulgaria – management accountability
• Provide regular training to senior management on liability, decision‑making, and oversight obligations introduced by the Bulgarian Act.AmCham Bulgaria – management training recommendation Wolf Theiss – governance best practices

• Implement a robust incident management and reporting process
• Build an incident classification and escalation workflow that ensures:
• rapid detection and triage
• early notification (within 24 hours) to Bulgarian authorities for significant incidents
• accurate final reporting.NIS2 Article 23 – reporting obligations AmCham Bulgaria – incident reporting obligations
• Align processes with ENISA’s incident handling good practices and, where applicable, sector‑specific CSIRT guidance.ENISA – CSIRT services and incident handling ENISA – NIS2 implementation guidance

• Use established cybersecurity frameworks
• To structure controls, organizations can align with ISO/IEC 27001 or NIST Cybersecurity Framework, mapping these to NIS2/Bulgarian obligations:
• ISO/IEC 27001 provides a management system approach for information security.[ISO/IEC 27001 – standard overview](https

Recent developments

• 2026-08-06 — On 5 February 2026 the Bulgarian National Assembly adopted amendments to the Cybersecurity Act to transpose NIS2, promulgated in State Gazette No. 17 on 13 February 2026, with the law explicitly implementing Directive (EU) 2022/2555.[1] (source)
• 2026-08-03 — Bulgaria transposed NIS2 via amendments to its existing Cybersecurity Act, adopted on 5 February 2026, promulgated on 13 February 2026, and in force since 17 February 2026, with no general transition period and temporary reduced fines only until 1 June 2026.[3] (source)
• 2026-06-03 — A May 2026 NIS2 enforcement update notes that Bulgaria’s NIS2 enforcement entered its “final phase” on 1 June 2026, with fines and sanctions now fully applicable after an initial 50% reduction period for early infringements expired.[13] (source)
• 2026-06-03 — An enforcement tracker highlights conflicting views, still listing Bulgaria among “not transposed” laggards as of mid‑2026 and referencing Commission infringement proceedings opened in November 2024, illustrating ongoing uncertainty in industry assessments of Bulgaria’s NIS2 status despite the February 2026 law.[15] (source)
• 2026-05-29 — A June 2026 status update notes Bulgaria has amended its Cybersecurity Act to carry NIS2 requirements but the European Commission has not yet received a full transposition notification, so the legal text must still be read directly against the directive.[5] (source)
• 2026-05-27 — RISI’s Bulgaria NIS2 page confirms transposition through an amending act to the Cybersecurity Act, in force from 17 February 2026, highlighting extremely late implementation and noting reduced sanctions only for breaches before 1 June 2026.[4] (source)
• 2026-05-27 — An EU-wide NIS2 transposition tracker lists Bulgaria as “Transposed,” with the Act amending the Cybersecurity Act in force from 17 February 2026 and notes that Bulgaria has been referred to the Court of Justice of the EU for late transposition.[7] (source)
• 2026-02-17 — Legal analysis from Kinstellar explains that the NIS2-aligned amendments to Bulgaria’s Cybersecurity Act were finally adopted in February 2026, entered into force on 17 February 2026, significantly expand the sectors and entities covered, and impose immediate obligations without a transitional compliance period.[2] (source)
• 2026-02-17 — CMS reports that Parliament adopted comprehensive NIS2-transposing amendments to the Cybersecurity Act on 5 February 2026, published on 13 February 2026, which broaden the scope of covered entities and require the Council of Ministers to adopt a new National Cybersecurity Strategy and implementing ordinance.[6] (source)
• 2026-02-06 — The Bulgarian News Agency (BTA) describes Parliament’s second-reading adoption of amendments to the Cybersecurity Act to align with NIS2, expanding the scope to more public and private entities and strengthening requirements on risk assessment and incident reporting.[8] (source)

Related regulations

• NYDFS Cybersecurity Regulation — New York, Active, effective 2025-11-01
• Law on Cybersecurity of Vietnam — Vietnam, Active
• Austria NIS2 Act — Austria, Upcoming
• Luxembourg NIS2 Transposition — Luxembourg, Active
• EU Cyber Resilience Act (CRA) — European Union, Phased, effective 2027-12-11
• EU Cyber Resilience Act - Vulnerability and Incident Reporting (11 Sep 2026) — European Union, Active, effective 2026-09-11
• Netherlands NIS2 Transposition (Cyberbeveiligingswet) — Netherlands, Active, effective 2026-08-15
• Belgium NIS2 Transposition — Belgium, Active, effective 2024-10-18

Put it into practice

• Generate the policy: NIS2 policy generator (generatepolicy.com)
• Buy the policy pack: NIS2 Compliance Policy (cyberpolicy.shop)
• Build it yourself: DORA + NIS2 EU Compliance Workbook (ciso.diy)

Browse all regulations · Compliance deadlines · Latest updates