Which companies the Bulgarian Cybersecurity Act (NIS2) covers

Directive (EU) 2022/2555, known as NIS2, was transposed into Bulgarian law by the amendment to the Cybersecurity Act published in the State Gazette, issue 17 of 13 February 2026. The amendment significantly widens the range of organisations with cybersecurity obligations. This article summarises the main requirements; the specific obligations of each organisation must be checked against the current text of the Act.

Scope

The Act covers medium and large enterprises operating in the sectors listed in Annexes 1 and 2. Under the Bulgarian Small and Medium-sized Enterprises Act, a medium enterprise has 50 or more employees or an annual turnover above €10 million.

The sectors of high criticality (Annex 1) are energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, business-to-business ICT service management and space.

The other critical sectors (Annex 2) include postal and courier services, waste management, chemicals, food, the manufacture of medical devices, electronics, machinery and vehicles, digital providers and research.

Regardless of size, the Act also covers providers of public electronic communications networks and services, trust service providers, top-level domain name registries and DNS service providers, and sole providers of an essential service. It also applies to administrative bodies. Where a sector-specific law contains equivalent requirements, such as DORA for the financial sector, that law applies.

Essential and important entities

Essential entities are most often large enterprises in Annex 1, trust service providers, and domain registries and DNS providers regardless of size. All other medium and large enterprises in the two annexes are important entities. Essential entities are subject to proactive supervision; important entities are supervised after the fact, when there is evidence of a breach. The competent authorities identify the specific entities using a methodology adopted by the Council of Ministers.

Risk-management measures

Article 22(2) of the Act requires measures based on an all-hazards approach, including:

• risk analysis and information system security policies;
• incident handling;
• business continuity: backup management, disaster recovery and crisis management;
• supply chain security;
• security in the acquisition, development and maintenance of systems, including vulnerability handling and disclosure;
• policies for assessing the effectiveness of the measures;
• basic cyber hygiene and training;
• cryptography and encryption;
• human resources security, access control and asset management;
• multi-factor or continuous authentication and secured communications;
• change management.

Management responsibility

The management body approves the measures and oversees their implementation (Article 21(1)). Its members complete cybersecurity training every two years and organise similar training for staff (Article 21(2) and (3)). The persons responsible for breaches can be fined personally, and for essential entities a court can temporarily ban the exercise of management functions.

Incident reporting

Significant incidents are reported to the sectoral computer security incident response team (СЕРИКС) in three steps (Article 23(5)):

1. an early warning within 24 hours of becoming aware of the incident;
2. an incident notification within 72 hours (within 24 hours for trust service providers);
3. a final report within one month of the notification.

Where a crime is suspected, the Chief Directorate for Combating Organised Crime (ГДБОП) is also notified (Article 23(7)).

Penalties

Penalties for breaches committed before 1 June 2026 are reduced by half.

First steps

The first step is to establish whether the organisation falls within the scope of the Act. This is followed by a technical assessment of the current measures against the requirements of Article 22 and a plan with specific remediation steps and deadlines.

Sources: Bulgarian Cybersecurity Act, as amended in State Gazette No. 17 of 13 February 2026; Directive (EU) 2022/2555.