Bulgaria

(a) What is the NIS2 implementation status?

A draft bill for amendment of the Cybersecurity Act (2018, as amended) was submitted to the Bulgarian National Assembly in December 2024 and was voted at first reading in February 2025.

(b) What is the envisaged NIS2 implementation timeline?

The adoption of the final act is expected in Q2 of 2025.

(c) What does the NIS2 mean for other national cybersecurity legislation?

The Cybersecurity Act (2018, as amended) is the main legal act regulating cybersecurity in Bulgaria, transposing Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (NIS1). The implementation of NIS2 in Bulgaria will require amendments to the Cybersecurity Act and the underlying legislation on its application, including the Regulation for the Minimum Network and Cyber Security Standards and the Methodology for Identification of the Essential Services Providers. Amendments to industry-specific legislation, including the electronic communication regulations, may also be expected.

(d) Who will be the supervisory authority and how are they preparing the market?

The main supervisory authority responsible for the application of the Bulgarian Cybersecurity Act following the transposition of NIS2 is expected to remain the Bulgarian Ministry of Electronic Governance. There are no guidelines or official statements published in this regard.

(e) What should you be doing/on the lookout for?

Although cybersecurity laws are often seen as instruments which are applicable in the public sector only, the business organisations will be also affected by the implementation of NIS2. The application of legal and administrative procedures and significant sanctions for non-compliance provided for in NIS2 must be noted. Clients must conduct internal analysis on their business activities to identify if they fall within the scope of NIS2 and subsequently assess the potential implications. Clients should also plan suitable measures to adopt the business processes in their organisations to the new standards under NIS2 (including audits, trainings, internal policies review, etc).