NIS2 Bulgaria: Draft Law, What’s Changing & How to Get Ready
See where Bulgaria stands in implementing the NIS2 Directive (EU) 2022/2555 — which entities will be in scope, how the current Cybersecurity Act is expected to change, and what organisations should do now to prepare.
Introduction: NIS2 Directive & the Bulgarian context
The NIS2 Directive strengthens cybersecurity rules for essential and important entities across the EU. Bulgaria already has a Cybersecurity Act based on the first NIS Directive, but this regime only covers a relatively narrow set of operators.
To align with NIS2, Bulgaria is updating its Cybersecurity Act and extending the rules to many more sectors, including digital infrastructure and key services that support the economy and public administration.
NIS2 implementation in Bulgaria
Bulgaria has transposed the NIS2 Directive through amendments to the Cybersecurity Act of 2018, adopted by Parliament on 5 February 2026. The revised framework expands the scope of entities and aligns national cybersecurity obligations with the NIS2 model of essential and important entities. The amendments update risk-management requirements, supervision and incident reporting obligations, with further detail to be provided through secondary legislation where applicable.
Because the EU transposition deadline passed in October 2024 without full implementation, Bulgaria is under pressure to complete the process. Once the revised law enters into force, it is expected to apply immediately, with details clarified in secondary legislation.
Status
NIS2 has been transposed through amendments to the Cybersecurity Act, adopted by Parliament on 5 February 2026. The revised framework is in force, with secondary legislation and supervisory guidance supporting implementation.
Current regime
The Cybersecurity Act (2018), as amended to transpose NIS2 in February 2026, now governs cybersecurity obligations for essential and important entities under the expanded national framework.
What has changed
The amended Cybersecurity Act introduces the NIS2 categories of essential and important entities, expands the list of in-scope sectors and entities, and updates the rules on risk management, supervision and incident reporting in line with the Directive.
NIS2 Bulgaria: what to expect for compliance & obligations
Bulgaria has transposed NIS2 through amendments to the Cybersecurity Act. Organisations operating in NIS2 sectors and meeting the applicable size thresholds must comply with the expanded cybersecurity obligations for essential and important entities.
Scope (expected)
- Entities operating in NIS2 Annex I sectors (e.g. energy, transport, health, drinking water, digital infrastructure, public administration).
- Entities operating in NIS2 Annex II sectors (e.g. postal and courier services, waste management, food, manufacturing of key products).
- Medium-size and larger organisations (meeting NIS2 staff / turnover thresholds).
- Certain providers in scope regardless of size (e.g. DNS, TLD registries, cloud services, managed service providers).
Core obligations (expected)
- Implement risk-management and security measures for relevant network and information systems.
- Adopt policies for incident prevention, detection, response and recovery.
- Report significant incidents and threats to the national CSIRT or competent authority within NIS2 timeframes.
- Manage supply-chain and third-party risks, including contractual security requirements for key suppliers.
- Ensure management-level oversight, training and accountability for cybersecurity.
Standards & frameworks
The amended Cybersecurity Act and its implementing ordinances set out minimum technical and organisational measures in line with NIS2. While no single certification standard is mandated, aligning with recognised international frameworks such as ISO/IEC 27001 or NIST CSF is a practical way to structure and demonstrate compliance.
NIS2 timeline & key dates (Bulgaria)
Sector-specific notes for Bulgaria
- Energy: electricity, gas and related infrastructure operators are expected to be classified as essential entities with strict obligations.
- Transport: air, rail, road and maritime operators, as well as key logistics infrastructure, will likely fall in scope under NIS2.
- Health: hospitals, clinics, laboratories and critical e-health service providers are expected to be covered as essential or important entities.
- Water services: drinking water and wastewater operators are expected to be explicitly covered.
- Finance & public administration: selected public bodies and financial-sector actors will have duties aligned with NIS2 and other EU sector rules.
- Digital infrastructure & ICT: data centres, cloud providers, electronic communications networks, hosting and managed service providers will play a central role and are explicitly targeted by NIS2.
Penalties for non-compliance (planned)
The amended Cybersecurity Act implements the NIS2 administrative penalty framework. That means:
- For essential entities, maximum fines may reach the higher of a fixed euro amount (up to €10 million) or 2% of total worldwide annual turnover.
- For important entities, maximum fines may reach the higher of a fixed euro amount (up to €7 million) or 1.4% of total worldwide annual turnover.
- Competent authorities may impose corrective orders, inspections and mandatory remediation measures where deficiencies are identified.
- In cases of serious or repeated non-compliance, management may face individual liability in accordance with applicable national law.
How to prepare for NIS2 in Bulgaria
- Check if you are likely in scope: map your services and customers against NIS2 sectors and size thresholds.
- Perform a gap assessment: compare your current controls to NIS2 requirements for risk management, incident handling and governance.
- Strengthen governance: define clear roles for cybersecurity, assign board-level accountability and ensure regular reporting.
- Prepare for registration: collect organisational and contact information that will be required when Bulgaria launches its NIS2 registries.
- Improve incident readiness: set up monitoring, logging, incident response playbooks and escalation paths to the national CSIRT.
- Review third-party risk: update supplier contracts to include security obligations, audit rights and incident-notification clauses.
- Align with a recognised framework: begin or strengthen implementation of an ISMS based on ISO 27001 or an equivalent framework.
- Train staff: run awareness campaigns and exercises so employees recognise and respond correctly to cyber incidents.