NIS2 in Bulgaria: Cybersecurity Act 2026 legal analysis
How the NIS2 Directive is transposed in Bulgaria: scope, obligations, reporting deadlines, penalties and practical steps for compliance.
The NIS2 Directive is now law in force in Bulgaria. With the publication in State Gazette (Държавен вестник, ДВ) No. 17 of 13 February 2026 of the Act amending and supplementing the Cybersecurity Act (ЗКС), the obligations for medium-sized and large businesses in 18 sectors are a fact: not a draft, not a plan, but rules with direct effect. The delay against the transposition deadline (17 October 2024) is more than 15 months, but this does not lessen the weight of the requirements.
This analysis covers the legal framework after the amendments, the classification of essential and important entities, the 11 mandatory risk management measures, the new incident reporting system, the penalty regime (including the personal liability of managers) and the practical steps for reaching compliance before 1 June 2026, when the period of reduced penalties expires.
❓What is NIS2 and who does it affect in Bulgaria?
Source: ЗКС (amended ДВ No. 17/2026)
What NIS2 is and why it matters for Bulgaria
Directive (EU) 2022/2555 (NIS2) was adopted on 14 December 2022 and replaces the earlier Directive (EU) 2016/1148 (NIS1). The main reason for adopting NIS2 was the dramatic increase in cyberattacks in the EU and the finding that NIS1 was ineffective: its scope was too narrow (only 6 sectors), it was applied inconsistently between the Member States, and it had no effective penalty mechanism.
NIS2 widens the scope from 6 to 18 sectors, introduces a clear distinction between essential and important entities, harmonises the minimum cybersecurity measures and sets up a strict regime for reporting incidents. In Bulgaria the transposition was carried out through an amending act to the ЗКС, adopted at second reading by the National Assembly on 5 February 2026 and published in ДВ No. 17 of 13 February 2026.
18
Sectors covered by NIS2, three times as many as NIS1, which covered only 6 sectors
Source: Directive (EU) 2022/2555, Annexes I and II
Legal framework: the ЗКС after the 2026 amendments
The Cybersecurity Act (ЗКС) is the main legal act transposing the requirements of NIS2 into Bulgarian law. The amendments of February 2026 introduce new chapters and expand the existing provisions. The central place is taken by the new Art. 4а (classification of entities), Art. 22 (mandatory measures) and Art. 23 (incident reporting), as well as the entirely new Chapter IIc on control and supervision (Art. 27е-27o).
Cybersecurity Act (ЗКС)
Art. 4(1) (amended ДВ No. 17/2026)
Official Bulgarian text
„Този закон се прилага за административните органи по смисъла на Закона за администрацията и за субектите, извършващи дейности в секторите по Приложения 1 и 2.“
Cybersecurity Act (ЗКС)
Art. 4а(1) (new, ДВ No. 17/2026)
Official Bulgarian text
„Съществени субекти са субектите, извършващи дейности в секторите по Приложение 1, които отговарят на критериите за средно или голямо предприятие по смисъла на Закона за малките и средните предприятия.“
A secondary act is still to be adopted: an ordinance under Art. 3(2) ЗКС, within 8 months of the entry into force of the law (that is, by October 2026). This ordinance will specify the technical and organisational measures that apply to the different categories of entities. Until the ordinance is adopted, entities should be guided by the provisions of the law and by the NIS2 Directive itself, which is sufficiently detailed in describing the measures.
Essential and important entities: who NIS2 affects
One of the most significant innovations of NIS2 is the clear distinction between two types of obliged entities: essential and important. This distinction determines not only the intensity of supervision but also the size of the penalties. The classification depends on two factors: the sector of activity and the size of the business.
| Criterion | Essential entities (Annex 1) | Important entities (Annex 2) |
|---|---|---|
| Sectors | Energy, transport, banking, financial markets, health, drinking water, waste water, digital infrastructure, ICT services (B2B), public administration, space | Postal services, waste management, chemicals, food, manufacturing (medical devices, computers, electronics, machinery, motor vehicles), digital providers, research |
| Size | Medium-sized and large businesses (250+ employees or turnover of 50+ million euro) | Medium-sized businesses (50-249 employees or turnover of 10-50 million euro) |
| Supervision | Prior (ex-ante): proactive inspections | Subsequent (ex-post): only on evidence of a breach |
| Maximum penalty | 20,000,000 BGN or 2% of global turnover | 14,000,000 BGN or 1.4% of global turnover |
| Minimum penalty | 50,000 BGN | 25,000 BGN |
Cybersecurity Act (ЗКС)
Art. 6 (amended ДВ No. 17/2026)
Official Bulgarian text
„Министърът на електронното управление създава и поддържа непубличен регистър на съществените и важните субекти, извършващи дейности в секторите по Приложения 1 и 2.“
It should be noted that for certain categories of providers (DNS service providers, cloud service providers, data centre service providers, content delivery network providers, trust service providers and providers of public electronic communications networks) the size rule does not apply: they fall within the scope regardless of the number of employees and turnover.
Caution
Ask Pravko and get an answer with citations from the law.
11 mandatory risk management measures (Art. 22 ЗКС)
The core of the obligations under NIS2 is the 11 risk management measures in Art. 22 ЗКС, which transposes Art. 21 of the Directive. The approach is risk-based and proportionate: the measures must take into account the size of the entity, the likelihood of incidents and their potential impact. The management bodies approve the measures and oversee their implementation (Art. 21 ЗКС), and bear personal liability if they fail to do so.
11 mandatory measures under Art. 22 ЗКС
Policies on risk analysis and information system security*
Incident handling (prevention, detection, response, recovery)*
Business continuity and crisis management (including backups and disaster recovery)*
Supply chain security (including relationships with direct suppliers and service providers)*
Security in the acquisition, development and maintenance of network and information systems (including vulnerability handling)*
Policies and procedures to assess the effectiveness of risk management measures*
Basic cyber hygiene practices and cybersecurity training*
Policies and procedures on the use of cryptography (and encryption, where appropriate)*
Human resources security, access control policies and asset management*
Use of multi-factor authentication (MFA) or continuous authentication solutions*
Use of secured voice, video and text communications and secured emergency communication systems*
* Mandatory documents
Cybersecurity Act (ЗКС)
Art. 21(2) (amended ДВ No. 17/2026)
Official Bulgarian text
„Управителните органи на съществените и важните субекти одобряват мерките за управление на риска за киберсигурността, следят за прилагането им и могат да бъдат подведени под отговорност за нарушения. Членовете на управителните органи преминават обучение по киберсигурност не по-рядко от веднъж на две години.“
The mandatory training of managers is an innovation that deserves particular attention. The law requires every member of the management body to complete cybersecurity training at least once every 2 years. Failure to meet this obligation can lead to a personal fine of 1,000 to 10,000 BGN.
Incident reporting: the new system under Art. 23 ЗКС
NIS2 introduces a strict 4-stage system for reporting significant cybersecurity incidents. Entities must notify the national СЕРИКС (Sector Cybersecurity Incident Response Team) within strictly defined deadlines. The system is considerably more detailed than the previous framework and includes a feedback mechanism from the competent authority.
Incident reporting procedure (Art. 23 ЗКС)
Early warning (within 24 hours)
Incident notification (within 72 hours)
Intermediate report (on request)
Final report (within 1 month)
Early warning (within 24 hours)
Incident notification (within 72 hours)
Intermediate report (on request)
Final report (within 1 month)
24 hours
Maximum time for sending an early warning to СЕРИКС from the moment of becoming aware of a significant cybersecurity incident
Failure to comply: penalties under Art. 28-29 ЗКС
An incident is significant if it has or may have a significant impact on the service provided by the entity. The criteria include: (1) serious operational disruption of the service or financial losses for the entity; (2) an effect on other natural or legal persons by causing considerable material or non-material damage.
СЕРИКС must respond within 24 hours of receiving the early warning, providing guidance or technical support. The law also allows voluntary reporting by entities that do not fall within the scope of the ЗКС, without this creating additional obligations for them.
Penalties and personal liability
The penalty regime under the amended ЗКС is unprecedented in Bulgarian cybersecurity legislation. The amounts of the fines are comparable to those under Regulation (EU) 2016/679 (GDPR), which is no coincidence: NIS2 follows the GDPR model of turnover-based fines.
Penalties by category of entity
Essential entities: maximum
The higher of the two figures applies
20,000,000 BGN or 2% of global annual turnover
Important entities: maximum
The higher of the two figures applies
14,000,000 BGN or 1.4% of global annual turnover
Essential entities: minimum
50,000 BGN
Important entities: minimum
25,000 BGN
Fine for managers personally
For failing to approve measures or failing to complete training
1,000 to 10,000 BGN
Failure to comply with orders (first time)
2,500 to 12,000 euro
Failure to comply with orders (repeated)
5,000 to 25,000 euro
Total
117,50 лв
Important
50%
Reduction of penalties in the transitional period until 1 June 2026; after that date the full amounts apply
Source: ЗКС, Transitional and Final Provisions
Control and supervision (Chapter IIc, Art. 27е-27o ЗКС)
The entirely new Chapter IIc of the ЗКС sets up a differentiated control regime depending on the category of the entity. The competent authority is the Ministry of e-Government (МЕУ), which has wide powers for inspections, audits and enforcement measures.
| Aspect | Essential entities | Important entities |
|---|---|---|
| Type of control | Prior (ex-ante): proactive scheduled and unscheduled inspections | Subsequent (ex-post): only on evidence of a breach or a significant incident |
| Scheduled inspections | Yes: under a plan approved in advance by МЕУ | No: only for a specific reason |
| Targeted audits | Yes: the costs are paid by the entity inspected | Yes: on evidence of a breach |
| Access to data | Full: on request of the competent authority | For a specific reason |
| Suspension of activity | Possible: as a last resort for systematic breaches | No |
The competent authority has 7 main powers: (1) scheduled inspections, (2) unscheduled inspections, (3) targeted security audits, (4) security scans, (5) requests for information and documents, (6) orders to remedy breaches and (7) public disclosure of breaches. The enforcement measures follow an escalation model: warnings, orders with a deadline, orders for immediate compliance and, as a last resort, public disclosure of the breach.
Cybersecurity Act (ЗКС)
Art. 27е (new, ДВ No. 17/2026)
Official Bulgarian text
„Министърът на електронното управление или оправомощени от него длъжностни лица осъществяват контрол по спазването на изискванията на този закон чрез планови и извънпланови проверки, целеви одити на сигурността и сканиране на сигурността.“
Practical steps for compliance
Achieving compliance with NIS2 requires a systematic approach. The following checklist sums up the key steps that organisations should take. It is critical to note that the period of reduced penalties (50%) expires on 1 June 2026; after that date the full amounts of the fines apply.
NIS2 compliance checklist
Determine whether the organisation is an essential or an important entity (check the sector under Annexes 1/2 + the size of the business)*
Appoint a responsible person (CISO/DPO) and arrange training for all members of the management body*
Carry out a gap analysis: compare the current security measures with the 11 requirements under Art. 22 ЗКС*
Develop or update policies on information security, risk analysis and a continuity plan*
Put in place an incident response plan with clear procedures for 24h/72h/1m reporting*
Implement MFA, encryption, monitoring and access control: the technical measures under Art. 22*
Ensure supply chain security: include cybersecurity clauses in contracts with suppliers*
Set up a programme of regular cyber hygiene training for all employees*
Carry out penetration testing and a vulnerability assessment
Prepare for registration in the non-public register of МЕУ (Art. 6 ЗКС)*
* Mandatory documents
1 June 2026
End of the transitional period with 50% reduced penalties. After this date the full amounts of the fines under Art. 28-29 ЗКС apply.
Less than 2 months remain to reach baseline compliance
Information
Pravko provides legal information but does not replace consultation with a lawyer. For a specific assessment of compliance with NIS2, turn to a cybersecurity and IT law specialist.
⚠️ Important
Pravko provides legal information, but it does not replace advice from a lawyer. For important legal matters, consult a licensed lawyer.
