Bulgaria has implemented NIS2 through its Cybersecurity Act. This guide explains which organisations are in scope, management duties, cybersecurity measures, incident reporting deadlines, the interaction with DORA and the applicable fines.
Vassilev & Chisuse Law Firm · 2026-10-07 · Legal review: 12 October 2026
Bulgaria has implemented the NIS2 framework through amendments to the Cybersecurity Act adopted in 2026. The regime applies to a substantially wider range of public and private organisations than the previous cybersecurity framework and places legal obligations on management as well as on technical and security functions.
For businesses, the first question is whether the organisation falls within the statutory scope and, if so, whether it is classified as an essential or important entity. The answer affects supervision and the maximum level of fines, while the core duties include cybersecurity risk-management measures, management oversight and reporting of significant incidents.
As a general rule, the Bulgarian Cybersecurity Act covers public and private entities of the types listed in Annex I or Annex II that meet the criteria for medium-sized enterprises or exceed the upper threshold for medium-sized enterprises. The Act also brings specified categories of entities into scope regardless of size.
The covered sectors include energy, transport, banking and financial-market infrastructure, health, drinking water and wastewater, digital infrastructure, ICT service management, public administration, space, postal and courier services, waste management, the manufacture and distribution of certain chemicals and food, specified manufacturing activities, certain digital service providers and research organisations. Scope must nevertheless be assessed against the exact activity and the specific statutory rules rather than inferred from a broad sector label.
Some entities are covered regardless of size, including certain electronic communications providers, trust service providers, top-level domain name registries and DNS service providers. The Act also contains special grounds for entities whose services are particularly critical at national or regional level.
The Cybersecurity Act divides in-scope organisations into essential and important entities. The classification depends on the sector, the size of the undertaking and specific statutory grounds.
Among other categories, entities listed in Annex I that exceed the upper threshold for medium-sized enterprises are essential entities. Certain providers, including qualified trust service providers, top-level domain name registries and DNS service providers, are treated as essential regardless of size. Public electronic communications providers meeting the statutory medium-sized enterprise criteria are also included among essential entities.
Entities of the types listed in Annex I or Annex II that fall within the Act but do not meet the criteria for essential entities are generally treated as important entities. This distinction is relevant to the supervisory regime and to the maximum administrative fines.
NIS2 compliance is a management responsibility and cannot be treated solely as a technical security project. Under the Bulgarian Cybersecurity Act, the management bodies of essential and important entities must approve the cybersecurity risk-management measures required by law and oversee their implementation.
Members of the management bodies of essential and important entities must undergo training every two years. The training must provide sufficient knowledge and skills to identify risks and assess cybersecurity risk-management practices and their impact on the services provided by the entity. Management bodies must also propose and organise corresponding training for employees.
These obligations make cybersecurity governance part of the organisation's legal and corporate governance framework. Decisions on policies, responsibilities, resources and corrective measures should therefore be capable of being demonstrated in practice, not merely described in a policy document.
Essential and important entities must implement appropriate and proportionate technical, operational and organisational measures to manage risks to the security of the network and information systems used in their core activities or in providing their services. The required level of security must correspond to the risk.
When proportionality is assessed, the organisation's exposure to risk, its size, the likelihood of incidents and the potential social and economic impact of those incidents must be taken into account. The statutory framework therefore does not prescribe an identical control environment for every entity.
The measures include policies for risk analysis and information-system security, incident handling, business continuity, backup management and disaster recovery, crisis management, supply-chain security, secure acquisition and development of network and information systems, vulnerability handling, assessment of the effectiveness of cybersecurity measures, cyber hygiene, training, cryptography, access control and asset management. Where appropriate, the framework also includes multi-factor or continuous authentication and secure communications systems.
Supply-chain security is expressly included in the statutory cybersecurity risk-management measures. When deciding which measures are appropriate, an entity must consider vulnerabilities specific to each direct supplier or service provider and the overall quality of their products and cybersecurity practices.
This makes contracts and operational arrangements with technology providers legally relevant to NIS2. Cloud service providers, data-centre providers, managed service providers, managed security service providers and other critical suppliers may affect the entity's ability to meet its own statutory obligations.
A contractual review should therefore be connected to the actual allocation of responsibilities, access to information, incident cooperation, continuity arrangements and the organisation's ability to evidence and enforce the controls on which it relies.
An essential or important entity affected by a significant incident must submit an early warning to the relevant sectoral computer security incident response team within 24 hours after becoming aware of the incident. Where applicable, the early warning indicates whether the incident is suspected to result from unlawful or malicious acts and whether it could have a cross-border impact.
Within 72 hours after becoming aware of the significant incident, the entity must submit an incident notification updating the initial information and providing an initial assessment of the incident's severity and impact, together with available technical information. For trust service providers, the statutory 72-hour period is replaced by a 24-hour period for this notification.
As a general rule, the final report must be submitted no later than one month after the incident notification. If the incident has not been resolved by that time, an intermediate report is submitted and the final report is due within one month after the incident has been resolved.
For an essential entity that fails to comply with the obligations under Articles 22 and 23 of the Cybersecurity Act, the pecuniary sanction may reach EUR 10,000,000 or 2 percent of the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs, whichever amount is higher. The sanction may not be lower than EUR 25,000. The turnover-based rule does not apply in the same way to essential entities that are administrative authorities.
For an important entity that fails to comply with the obligations under Articles 22 and 23, the pecuniary sanction may reach EUR 7,000,000 or 1.4 percent of the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs, whichever amount is higher. The sanction may not be lower than EUR 12,500.
A breach of the management obligations under Article 21 may also result in a fine of between EUR 500 and EUR 5,000 for the relevant heads of administrative authorities, managers or members of management bodies of essential and important entities.
The transitional rule reducing fines and pecuniary sanctions by 50 percent applied only to infringements committed up to 1 June 2026. It does not apply to infringements committed after that date.
The interaction between NIS2 and the Digital Operational Resilience Act, Regulation (EU) 2022/2554, must be assessed carefully for financial entities. The Bulgarian Cybersecurity Act provides that where a special legal regime imposes cybersecurity risk-management or significant-incident notification requirements that are at least equivalent in effect, the corresponding provisions of the Cybersecurity Act do not apply to the entities covered by that special regime.
At EU level, DORA is treated as a sector-specific Union legal act for financial entities for the purposes of Article 4 of NIS2. The European Commission has clarified that the relevant DORA provisions on ICT risk management, ICT-related incident management and reporting, digital operational resilience testing, information-sharing arrangements and ICT third-party risk apply instead of the corresponding NIS2 provisions for the financial entities covered by DORA.
This does not justify a general assumption that the entire Cybersecurity Act is irrelevant to every financial entity. The exact overlap must be checked against the entity's regulatory status, the obligations in question and the scope of the sector-specific regime. VC Law's separate DORA service and DORA practical guide address the financial-sector framework in more detail.
The first step is a legal scope assessment under the Bulgarian Cybersecurity Act, including the organisation's activity, size and any special grounds for inclusion. If the Act applies, the entity should then determine whether it is essential or important and identify the competent authority and reporting channel relevant to its sector.
The organisation should compare its existing governance, policies, technical and organisational measures, supplier arrangements, business-continuity processes and incident procedures with the applicable statutory requirements. The assessment should connect legal obligations to the systems and operational processes that actually support the regulated activity.
NIS2 implementation requires coordination between management, legal, security, technology, procurement and operational functions. A technical control does not by itself demonstrate that the management, reporting, supplier-management and documentation obligations have been satisfied.
Vassilev & Chisuse Law Firm advises businesses on the application of NIS2 and the Bulgarian Cybersecurity Act, including scope and classification assessments, management obligations, internal documentation, incident-reporting procedures, supplier arrangements and the legal aspects of cybersecurity risk management.
Our NIS2 legal service can include an assessment of the entity's regulatory status, review of existing documentation and processes, preparation and revision of policies and procedures and legal support for an ongoing compliance framework. Where a cybersecurity incident also raises personal-data issues, the analysis may need to be coordinated with the applicable data-protection requirements.
This material reflects the legal framework reviewed as of 08 October 2026 and is provided for general information only. It does not constitute individual legal advice. The application of the Cybersecurity Act depends on the particular entity, activity, size, sector and facts, and sector-specific legislation may alter the analysis.