Who does the Bulgarian Cybersecurity Act apply to?
The Bulgarian Cybersecurity Act applies to public and private organisations of the types listed in its Annexes I and II that are at least medium-sized, plus certain organisations regardless of size (Art. 4). Three things decide: the type of organisation, the sector and type of activity, and size.
- Size. An enterprise is at least medium-sized with 50 or more staff, or with annual turnover and balance sheet total above EUR 10 million (Art. 3 of the SME Act, in force since 1 January 2026). It is large with 250 or more staff, or with turnover above EUR 50 million and balance sheet total above EUR 43 million. Figures of linked and partner enterprises are added (SME Act, Art. 4g). State- and municipality-owned companies are measured against the same thresholds, because the exception in Art. 4(9) of the SME Act does not apply (Art. 4, item 2 of the Cybersecurity Act).
- Regardless of size, the Act covers administrative bodies — ministries, agencies, regional administrations, mayors and municipal administrations (Art. 4, item 1), providers of public electronic communications networks and services, trust service providers, TLD name registries and DNS service providers (Art. 4, item 3(a)–(v)), domain name registrars and their agents and resellers (Art. 4, item 5; § 3, item 29a of the Supplementary Provisions), critical entities (Art. 4, item 4) and judicial authorities (Art. 4, item 9). A small company may also be brought into scope if it is the sole provider of an essential service or if a disruption could affect safety or health (Art. 4, item 3(g)–(zh)). That is assessed by the competent authority.
- Essential or important. Essential entities are large enterprises in Annex I, administrative bodies, DNS service providers, TLD name registries, qualified trust service providers, medium-sized and large electronic communications providers, critical entities and former operators of essential services (Art. 4a(1)). All other entities in scope are important (Art. 4a(2)). The obligations are the same. The difference is in supervision and in the level of fines.
Important for suppliers: a company outside the scope may still receive requirements. Its clients in scope must assess the security of their direct suppliers (Art. 22(2), item 4 and Art. 22(3)).
An unclear case — food: the Directive covers only food wholesale, industrial production and processing. The Bulgarian Act refers to the general definition of a food business. For medium-sized and larger shops and catering businesses, the check therefore shows "individual review" rather than a category. Small ones are out of scope under both readings (Art. 4, item 2).
DNS at hosting and internet providers: a DNS service provider is also a company that runs authoritative DNS for client domains or public recursive DNS (§ 3, item 5 of the Supplementary Provisions). Such a company is an essential entity regardless of size (Art. 4a(1), item 2), so the check asks about it separately.
Which sectors does the Bulgarian Cybersecurity Act cover?
The Act covers 17 sectors: 10 in Annex I (sectors of high criticality) and 7 in Annex II (other critical sectors). In each sector, only the listed types of entities are covered, not every company in it.
| Annex I — sectors of high criticality | Annex II — other critical sectors |
|---|---|
| 1. Energy (electricity, district heating and cooling, oil, natural gas, hydrogen) | 1. Postal and courier services |
| 2. Transport (air, rail, water, road) | 2. Waste management |
| 3. Banking (credit institutions) | 3. Manufacture, production and distribution of chemicals |
| 4. Financial market infrastructures | 4. Production, processing and distribution of food |
| 5. Health (healthcare providers, laboratories, pharmaceuticals, critical medical devices) | 5. Manufacturing (medical devices, computers and electronics, electrical equipment, machinery, motor vehicles, other transport equipment) |
| 6. Drinking water | 6. Digital providers (online marketplaces, search engines, social networks) |
| 7. Waste water | 7. Research |
| 8. Digital infrastructure (IXPs, DNS, TLD registries, cloud, data centres, CDNs, trust services, electronic communications) | |
| 9. ICT service management, business-to-business (managed service and managed security service providers) | |
| 10. Space (ground-based infrastructure) |
Public administration is not a sector in the annexes to the Bulgarian Act. Administrative bodies are covered directly (Art. 4, item 1) and are essential entities (Art. 4a(1), item 4). The full list of entity types is in the annexes to the Act.
How does the NIS2 check work?
The check asks up to 11 questions with ready-made answers; the usual path is 8. The logic follows Art. 4 and 4a of the Bulgarian Cybersecurity Act and Art. 3–4g of the Bulgarian SME Act.
Type of organisation
company, state or municipal body, judiciary, educational or public organisation.
Status
have you already been designated as an operator of essential services or a critical entity.
Sector
the 17 sectors in Annexes I and II, or "none".
Type of activity
the types of entities the Act lists in that sector.
Group
linked and partner enterprises.
Headcount
average number of staff.
Turnover
for the last closed year.
Balance sheet total
the balance sheet figure.
Hosting, cloud, internet and IT providers get an additional question about DNS and domain registration. If the company is small, there is an additional question about the special criteria in Art. 4, item 3. If it is out of scope, the last question is whether you supply organisations that are in scope.
Possible results: likely an essential entity · likely an important entity · likely out of scope, but in the supply chain · likely out of scope · individual review needed. The last one appears when the answers are not enough or the Act leaves the decision to the competent authority. We prefer an honest "let's check" to guessing.
Every question has an "I don't know" answer with a hint on where to find the information. The articles the result is based on are shown under it.
What happens after the check?
The second part, "How ready are you?", assesses your organisation against the measures in Art. 21–23: management, training, risk analysis, incidents, backups, access, suppliers and systems. You get an assessment by group ("good", "partial", "missing") and a personal plan: what to do now, within 3 months and within 12 months. You can print it or send it to us as an enquiry. The first consultation with NodePoint is free.
Prefer to go through the check together? Request a free call
Questions about the NIS2 check
How do I know whether NIS2 applies to my company in Bulgaria?
The Bulgarian Cybersecurity Act applies to your company if it is a type of entity listed in Annex I or II and is at least medium-sized, or if it is covered regardless of size (Art. 4). Check your sector and type of activity first, then your size under Art. 3 of the SME Act. The NIS2 check does this in 8 questions.
Which companies are medium-sized for NIS2 purposes?
An enterprise is at least medium-sized with 50 or more staff, or with annual turnover and balance sheet total both above EUR 10 million (Art. 3 of the Bulgarian SME Act, in force since 1 January 2026). The figures are for the last closed year and include linked and partner enterprises (Art. 4g). Status changes after two consecutive years above or below the thresholds (Art. 4b).
What is the difference between an essential and an important entity?
The obligations are the same; the difference is in supervision and fines. Essential entities are subject to regular and ad hoc inspections and audits (Art. 27zh(1)) and fines of up to EUR 10 million or 2% of turnover. For important entities, supervision is mainly ex post (Art. 27zh(2)) and fines go up to EUR 7 million or 1.4% (Art. 29).
Is the result of the check binding?
No. The result is indicative and is not legal advice. Essential and important entities are identified by the competent authorities using a methodology of the Council of Ministers (Art. 16(3), item 8). As of , the methodology has not been adopted. The obligations under Art. 21–23, however, have applied since 17 February 2026.
Do I have to register myself if the Act applies to me?
Most organisations do not apply themselves, because the competent authority identifies them (§ 48 of the Transitional and Final Provisions). Digital providers are the exception: DNS, domain registries and registrars, cloud, data centres, CDNs, managed services, online marketplaces, search engines and social networks. They submit their details themselves within two months (Art. 6(2)).
The Act doesn't apply to my company. Do I need to do anything?
Not by law, but if you supply organisations in scope, they will require measures from you. The Act obliges them to assess the security of their direct suppliers (Art. 22(2), item 4 and Art. 22(3)). The second part of the check shows which measures are asked for most often.
What happens to my answers?
NodePoint does not collect them or send them anywhere. With JavaScript on, the check runs entirely in your browser and the answers exist only in the page address. Without JavaScript, each step is loaded from the server and, like any visit, appears in the server's technical logs, with no name and no link to you. You only send an enquiry if you fill in the form yourself.
Legal framework and sources
Legal framework checked as of . The Act has applied since 17 February 2026 with no transition period. The Council of Ministers has not yet designated the sectoral competent authorities or adopted the methodology for identifying essential and important entities (§ 47, item 1 of the Transitional and Final Provisions, deadline 17 August 2026). When it does, the check will be updated. Article and point letters follow the Bulgarian alphabet (a, b, v, g, d, e, zh…), as in the official text: for example, Art. 27zh is the article after 27e.
- Cybersecurity Act — consolidated text as amended by State Gazette No. 17 and No. 55 of 2026 (PDF, Communications Regulation Commission; in Bulgarian) (opens in a new window)
- Act amending and supplementing the Cybersecurity Act, State Gazette No. 17 of 13 February 2026 (in Bulgarian): https://dv.parliament.bg/DVWeb/showMaterialDV.jsp?idMat=241234 (opens in a new window)
- Small and Medium-Sized Enterprises Act, Art. 3–4g (as amended by State Gazette No. 70 of 2024, in force since 1 January 2026; in Bulgarian): https://www.lex.bg/laws/ldoc/2134682112 (opens in a new window)
- Directive (EU) 2022/2555 (NIS2): https://eur-lex.europa.eu/eli/dir/2022/2555/oj (opens in a new window)
- Commission Recommendation 2003/361/EC concerning the definition of micro, small and medium-sized enterprises: https://eur-lex.europa.eu/eli/reco/2003/361/oj (opens in a new window)
- Implementing Regulation (EU) 2024/2690 (digital providers): https://eur-lex.europa.eu/eli/reg_impl/2024/2690/oj (opens in a new window)
- Ministry of Innovation and Digital Transformation — cybersecurity legal framework (in Bulgarian): https://midt.gov.bg/bg/digital-transformation/cybersecurity/laws (opens in a new window)
More on the topic: NIS2 in Bulgaria — a short guide · Cybersecurity and NIS2 for businesses · Sentinel — staff training