---
title: "NIS2 in Bulgaria: the Cybersecurity Act explained (2026)"
url: https://nodepoint.bg/en/nis2/
updated: 2026-11-05
author: "Todor Karachorbadzhiev, NodePoint"
publisher: "NodePoint (NodePoint EOOD), Burgas, Bulgaria"
language: en
translation_of: https://nodepoint.bg/nis2/
---

# NIS2 in Bulgaria: what businesses need to know about the Cybersecurity Act

Author: [Todor Karachorbadzhiev](https://nodepoint.bg/en/about/#ekspert), NodePoint · Checked against the law on 5 November 2026

In short: **NIS2** is the EU cybersecurity directive that Bulgaria transposed through amendments to its Cybersecurity Act, published in State Gazette No. 17 of 13 February 2026 and in force since 17 February 2026. The Act covers medium-sized and large companies in 17 sectors, plus public administration. Management approves the measures and is trained every two years, incidents are reported within 24 hours, and fines reach EUR 10 million or 2% of turnover.

This short guide explains the Bulgarian law in plain English and is not legal advice. The official text of the Act exists only in Bulgarian. For a specific company, check with a lawyer or [ask NodePoint for a first conversation](https://nodepoint.bg/en/services/cybersecurity-nis2/#zapitvane).

**Does the Act apply to your organisation?** Check in 3 minutes — with the articles, no sign-up. [Start the check →](https://nodepoint.bg/en/nis2/check/#proverka)

## What is NIS2 and how has Bulgaria implemented it?

NIS2 is Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union. It replaced the first NIS Directive of 2016, extended the range of sectors covered and introduced personal accountability for management and higher fines.

Bulgaria transposed NIS2 through the Act amending and supplementing the Cybersecurity Act, published in State Gazette No. 17 of 13 February 2026 and in force since 17 February 2026. The Act was amended again by State Gazette No. 55 of 16 June 2026; since then, the register of entities has been kept by the Minister of Innovation and Digital Transformation (Art. 6(1)), and the Ministry of Innovation and Digital Transformation is the competent authority for administrative bodies (Art. 16(2)).

The obligations under the Act have applied since it entered into force, with no transition period. As of 5 November 2026, the Council of Ministers has not yet designated the sectoral competent authorities or adopted the methodology for identifying essential and important entities (§ 47, item 1 of the Transitional and Final Provisions, deadline 17 August 2026). The new ordinance on minimum security measures has not been adopted either; until then, the 2019 Ordinance on minimum requirements for network and information security remains in force.

## Who does the Bulgarian Cybersecurity Act apply to?

The Act applies to public and private entities in the sectors listed in its Annexes I and II that are **at least medium-sized enterprises** under the Bulgarian Small and Medium-Sized Enterprises Act, plus administrative bodies and certain entities regardless of size (Art. 4). A medium-sized enterprise has 50 or more employees, or annual turnover and total assets above EUR 10 million (Art. 3 of the SME Act, as in force from 1 January 2026). Large enterprises — 250 or more employees, or turnover above EUR 50 million and total assets above EUR 43 million — in an Annex I sector are essential entities. Partner and linked enterprises are taken into account in the calculation. State-owned and municipal companies are assessed against the same thresholds as private companies: the exception in Art. 4(9) of the SME Act (for enterprises in which the state or a municipality controls 25% or more of the capital) does not apply (Art. 4, item 2 of the Cybersecurity Act).

| Annex I (sectors of high criticality) | Annex II (other critical sectors) |
| --- | --- |
| 1. Energy (electricity, district heating, oil, gas, hydrogen) | 1. Postal and courier services |
| 2. Transport (air, rail, water, road) | 2. Waste management |
| 3. Banking | 3. Manufacture, production and distribution of chemicals |
| 4. Financial market infrastructures | 4. Production, processing and distribution of food |
| 5. Health | 5. Manufacturing (medical devices, computers and electronics, electrical equipment, machinery, motor vehicles, other transport equipment) |
| 6. Drinking water | 6. Digital providers (online marketplaces, online search engines, social networks) |
| 7. Waste water | 7. Research |
| 8. Digital infrastructure (IXPs, DNS, TLD registries, cloud, data centres, CDNs, trust services, electronic communications) |  |
| 9. ICT service management, business-to-business (managed service and managed security service providers) |  |
| 10. Space |  |

**Regardless of size**, the scope includes, for example, providers of public electronic communications networks and services, trust service providers, top-level domain registries and DNS service providers, sole providers of an essential service, and entities whose disruption could affect public safety, security or health (Art. 4, item 3).

**Important for suppliers:** even if your company is not in scope, your clients that are must manage supply chain security (Art. 22(2), item 4) and will ask you for measures and evidence.

Not sure whether your company is in scope? [Check in 3 minutes →](https://nodepoint.bg/en/nis2/check/#proverka) or [ask us](https://nodepoint.bg/en/services/cybersecurity-nis2/#zapitvane)

## What is the difference between essential and important entities?

Essential entities are large enterprises in the Annex I sectors and certain special categories; all other entities in scope are important entities (Art. 4a). The security and reporting obligations are the same; the difference lies in supervision and in the level of fines.

|  | Essential entity | Important entity |
| --- | --- | --- |
| Supervision | Scheduled and ad hoc inspections, regular and targeted security audits (Art. 27zh(1)) | On-site inspections and ex post remote supervision, targeted audits (Art. 27zh(2)) |
| Maximum fine | up to EUR 10,000,000 or 2% of worldwide turnover (Art. 29(2)) | up to EUR 7,000,000 or 1.4% of worldwide turnover (Art. 29(3)) |

**Who decides the status?** The national competent authorities identify essential and important entities using a methodology adopted by the Council of Ministers and notify the minister who keeps the register (Art. 16(3), item 8; Art. 6; § 48). The register is not public (Art. 6(5)). Most companies do not register themselves; the exception is certain digital providers — DNS, cloud, data centres, CDNs, managed service providers, marketplaces, search engines and social networks — which submit their details themselves within two months (Art. 6(2)).

## What are the obligations under the Cybersecurity Act?

There are three groups: management approves and oversees the measures (Art. 21), the company implements risk management measures (Art. 22) and reports significant incidents (Art. 23).

**The measures under Art. 22(2)** must be "appropriate and proportionate" to the risk and size of the entity and include:

1. policies on risk analysis and information system security;
2. incident handling;
3. business continuity — backups, disaster recovery, crisis management;
4. supply chain security;
5. security in acquiring, developing and maintaining systems, including vulnerability handling;
6. policies to assess the effectiveness of the measures;
7. basic cyber hygiene practices and cybersecurity training;
8. policies on cryptography and encryption;
9. human resources security, access control and asset management;
10. multi-factor authentication, secured voice, video and text communications, secured emergency communication systems;
11. change management for information assets;
12. reporting measures and obligations for Annex I and II entities and critical entities.

The Act is technology-neutral — it does not require specific products. If a gap is found, the company must take corrective measures (Art. 22(4)). What these measures look like in practice for a small or medium-sized company: [cybersecurity and NIS2 for companies](https://nodepoint.bg/en/services/cybersecurity-nis2/#tehnicheski-merki).

## What are the deadlines for reporting a cyber incident?

A significant incident is reported to the sectoral computer security incident response team (CSIRT) in three stages: early warning within 24 hours, incident notification within 72 hours and a final report within one month (Art. 23(5)).

| Stage | Deadline | Content |
| --- | --- | --- |
| Early warning | within 24 hours of becoming aware | Whether malicious action is suspected; whether there may be a cross-border impact |
| Incident notification | within 72 hours of becoming aware (24 hours for trust service providers) | Initial assessment — severity, impact, technical indicators |
| Intermediate report | at the CSIRT's request | Status update |
| Final report | within 1 month of the notification | Detailed description, root cause, measures, cross-border impact |

Notification in itself does not increase the entity's liability (Art. 23(1)). **Practical tip:** 24 hours pass quickly. The procedure — who decides that an incident is significant, who writes the report, to whom — must be ready in advance.

## Is cybersecurity training mandatory under NIS2 in Bulgaria?

Yes. Members of the management bodies of essential and important entities must complete training every two years, so that they can identify risks and assess risk management practices (Art. 21(2)). They must also offer and organise such training for their employees (Art. 21(3)). Separately, "basic cyber hygiene practices and cybersecurity training" is one of the mandatory measures (Art. 22(2), item 7).

The Act does not set the format, duration or provider of the training. In practice, an inspector will look for evidence: who was trained, when and on which topics.

**Sentinel by NodePoint** — short email quizzes for management and staff (phishing, phone scams, GDPR, deepfakes), no accounts, with an annual PDF record: topics, participation and each employee's results. The quizzes are in Bulgarian.

[See Sentinel](https://nodepoint.bg/en/sentinel/) · [Request a demo](https://sentinel.nodepoint.bg/request-demo?utm_source=nodepoint.bg&utm_medium=referral&utm_campaign=nis2-guide-en)

## What are the fines under the Bulgarian Cybersecurity Act?

| Breach | Fine | Article |
| --- | --- | --- |
| An essential entity fails to implement the measures (Art. 22) or to report (Art. 23) | up to EUR 10,000,000 or up to 2% of total worldwide annual turnover (whichever is higher), but not less than EUR 25,000 | Art. 29(2) |
| An important entity — the same | up to EUR 7,000,000 or up to 1.4% of turnover (whichever is higher), but not less than EUR 12,500 | Art. 29(3) |
| A manager or member of the management body breaches Art. 21 (approving and overseeing measures, training) | a fine of EUR 500 to 5,000 — personally | Art. 29(4) |

**Transitional rule:** for breaches committed before 1 June 2026, fines are reduced by 50% (§ 51). There is no reduction for later breaches. For essential entities, the competent authority may also request a temporary ban on a person exercising management functions (Art. 27k).

## What to do now — a checklist

1. **Check whether you are in scope** — sector under Annex I/II and size.
2. **Determine whether you are an essential or important entity and watch for a notification from the competent authority.**
3. **Brief management on its obligations under Art. 21 and plan its training — it is personally liable.**
4. **Make an inventory of systems, data, suppliers and access rights.**
5. **Carry out a gap analysis against the 12 measures in Art. 22(2).**
6. **Prioritise the quick wins: multi-factor authentication, tested backups, updates, removal of unnecessary access.**
7. **Prepare an incident procedure with the 24 h / 72 h / 1 month deadlines and the CSIRT contacts.**
8. **Organise staff training and keep the evidence.**
9. **Review supplier contracts** — supply chain security.
10. **Document everything and decide when you will review the measures again.**

## Need help with NIS2 in Bulgaria?

NodePoint helps with practical implementation: assessing whether your company is in scope, reviewing where you stand, technical guidance and measures, incident response and training for management and staff. Legal documents are prepared with external partner lawyers. The first conversation is free.

[Take the NIS2 check](https://nodepoint.bg/en/nis2/check/#proverka) · [Request a free call](https://nodepoint.bg/en/services/cybersecurity-nis2/#zapitvane) · [See Sentinel (training)](https://nodepoint.bg/en/sentinel/) · [Call: +359 887 975 180](tel:+359887975180)

## Sources

- [Cybersecurity Act — consolidated text incl. State Gazette No. 17 and No. 55 of 2026 (PDF, in Bulgarian, Communications Regulation Commission)](https://crc.bg/files/2026%20%D0%9F%D0%A0%D0%90%D0%92%D0%9D%D0%90/%D0%97%D0%90%D0%9A%D0%9E%D0%9D%20%D0%97%D0%90%20%D0%9A%D0%98%D0%91%D0%95%D0%A0%D0%A1%D0%98%D0%93%D0%A3%D0%A0%D0%9D%D0%9E%D0%A1%D0%A2.pdf)
- [Act amending the Cybersecurity Act, State Gazette No. 17 of 13.02.2026 (in Bulgarian)](https://dv.parliament.bg/DVWeb/showMaterialDV.jsp?idMat=241234)
- [Ministry of Innovation and Digital Transformation — cybersecurity legal framework (in Bulgarian)](https://midt.gov.bg/bg/digital-transformation/cybersecurity/laws)
- [Directive (EU) 2022/2555 (NIS2) — EUR-Lex, English](https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng)
- [Small and Medium-Sized Enterprises Act, Art. 3 — size criteria (in Bulgarian)](https://www.lex.bg/laws/ldoc/2134682112)

Last checked against the law: 5 November 2026. The guide is reviewed at least once a month until the secondary legislation under § 47 is adopted, and whenever the Act or its ordinances change. The fuller [Bulgarian version of this guide](https://nodepoint.bg/nis2/) is the master text.

## Frequently asked questions about NIS2 in Bulgaria

### When did NIS2 come into force in Bulgaria?

On 17 February 2026. NIS2 was transposed into Bulgarian law by the Act amending and supplementing the Cybersecurity Act, published in State Gazette No. 17 of 13 February 2026. The Act was amended again by State Gazette No. 55 of 16 June 2026. For breaches before 1 June 2026, fines are halved (§ 51).

### Does NIS2 apply to a company with 60 employees in Bulgaria?

Yes, if it operates in a sector listed in Annex I or II to the Cybersecurity Act — a company with 60 employees is normally a medium-sized enterprise. If its sector is not in the annexes, it is not in scope unless one of the special grounds in Art. 4 applies. A medium-sized enterprise in scope is usually an "important entity".

### Does a company have to register itself as a NIS2 entity in Bulgaria?

Most companies do not apply for registration themselves. The competent authorities identify essential and important entities using a Council of Ministers methodology and notify the Minister of Innovation and Digital Transformation, who keeps the register (Art. 6 and Art. 16(3), item 8). The exception is certain digital providers, which submit their details themselves within two months (Art. 6(2)). You do not need to wait for a notification to start on the measures.

### Is management personally liable under NIS2 in Bulgaria?

Yes. Managers and members of the management bodies of essential and important entities are personally liable. A breach of Art. 21 carries a fine of EUR 500 to 5,000 (Art. 29(4)). For essential entities, the competent authority may also request a temporary ban on exercising management functions (Art. 27k(2) and (4)).

### Do we need ISO 27001 certification to comply with NIS2?

No. The Bulgarian Cybersecurity Act requires appropriate and proportionate measures, not a certificate. European and international standards are taken into account "where applicable" (Art. 22(1)), so ISO/IEC 27001 is a convenient framework but not mandatory.

Author: [Todor Karachorbadzhiev](https://nodepoint.bg/en/about/#ekspert), Managing Director of NodePoint — Checked against the law on 5 November 2026 — Updated on 5 November 2026