With the amendments to the Cybersecurity Act, promulgated in State Gazette No. 17 of 13 February 2026, the Bulgarian legal framework has been brought into alignment with Directive (EU) 2022/2555 (NIS 2). The amendments constitute a comprehensive overhaul of the existing regime and introduce a new regulatory model, also aligned with Directive (EU) 2022/2557 on the resilience of critical entities and Regulation (EU) 2022/2554 (DORA) for the financial sector.
The new framework pursues a strategic objective – to achieve and maintain a “high common level of cybersecurity” in the Republic of Bulgaria through an expanded scope of entities within the scope of the Act, a clear distinction between essential and important entities, enhanced management accountability, and detailed regulation of risk management measures.
 
From “operators of essential services” to “essential and important entities”
One of the most significant changes is the abolition of the previous concept of “operators of essential services” and the introduction of a two-tier classification – essential and important entities.
The scope of the Act now includes:

• public and private entities operating in the sectors listed in Annex I and Annex II that meet or exceed the thresholds for medium-sized enterprises;
• certain providers irrespective of their size (e.g. providers of public electronic communications networks and services, qualified trust service providers, DNS service providers, and top-level domain name registries);
• entities designated as critical under Directive (EU) 2022/2557;
• educational institutions carrying out critical research activities;
• judicial authorities.

This classification has direct implications for the supervisory regime. Essential entities are subject to more intensive and proactive supervision, whereas important entities are primarily subject to ex post, risk-based supervision, except where there are indications of non-compliance.
 
Jurisdiction and cross-border activities
The new framework introduces detailed rules governing jurisdiction and cross-border activities. For providers of cloud computing services, data centre services, managed services, DNS services, online platforms and other digital service providers, the main establishment principle applies.
Entities providing services within the European Union but not established in a Member State are required to designate a representative in the EU. This ensures effective supervision and clarity as to the applicable jurisdiction.
These rules are particularly relevant for groups of undertakings with cross-border structures and for providers operating in multiple markets simultaneously.
 
National Strategy and a systemic approach to cybersecurity
The Act provides for the adoption and periodic review of a National Cybersecurity Strategy, consolidating sectoral policies and defining priorities, resources and coordination mechanisms.
The Strategy covers, inter alia, supply chain security, coordinated vulnerability management, ICT-related public procurement requirements, cyber hygiene and awareness-raising initiatives. This broadens the focus from purely operational protection to resilience at national level.
 
Expanded register and enhanced transparency requirements
A register of entities covered by the Act will be established and maintained by the Minister of e-Government. It will contain identification and contact details, IP ranges, sector classification and information on cross-border activities.
Providers of cloud computing services, data centre services, managed services, content delivery networks (CDNs) and online platforms are expressly required to submit and update information within short statutory deadlines.
This enhances transparency and facilitates cross-border coordination.
 
Management accountability and personal responsibility
New Article 21 elevates cybersecurity to the level of the management body. Management is required to:

• approve risk management measures;
• oversee their implementation;
• undergo training at least once every two years;
• ensure appropriate training for employees.

Cybersecurity is now embedded within the duties of sound corporate governance and can no longer be treated as a purely technical function.
In cases of serious and systemic infringements, the Act provides for the possibility of imposing individual restrictive measures on members of management bodies, including temporary removal from office. This further reinforces the personal accountability of senior management.
 
A new risk management model
Article 22 introduces an obligation to implement appropriate and proportionate technical, organisational and operational measures based on an all-hazards approach.
Key elements include:

• risk assessment policies;
• incident and crisis management;
• business continuity and disaster recovery;
• supply chain security;
• vulnerability handling and coordinated vulnerability disclosure;
• cryptographic policies;
• access control and multi-factor authentication.

Particular emphasis is placed on risks arising from suppliers and interdependent sectors.
 
Restriction of high-risk technologies and suppliers
The Act establishes a mechanism for coordinated EU-level risk assessments concerning specific technologies and suppliers.
Where a high risk is identified, restrictive measures may be imposed, including the phased discontinuation of certain technologies or services within a specified timeframe. This is of strategic importance for critical infrastructure sectors and telecommunications operators.
 
Reporting obligations and coordinated incident management
The Act introduces harmonised rules for the notification of significant incidents and establishes a national framework for managing large-scale cyber crises.
The National Computer Security Incident Response Team (NCSIRT) also acts as the national coordinator for coordinated vulnerability disclosure, serving as a trusted intermediary between the discoverer and the affected entity.
The Act further regulates voluntary notification and information sharing regarding cyber threats between entities, while providing safeguards for the protection of sensitive information.
Organisations should establish clear internal escalation procedures and mechanisms for engagement with the competent authorities.
 
Deadlines and stages for reporting significant incidents
The new regime introduces an accelerated notification procedure:

• Early warning: within 24 hours of becoming aware of a significant incident;
• Incident notification: within 72 hours of becoming aware;
• Final report: no later than one month after the notification, or, in the case of an ongoing incident, within one month of its resolution.

These shortened deadlines require clearly documented internal processes and predefined impact assessment criteria, including duration, number of affected users and economic impact.
 
Enhanced supervision and regulatory coordination
National competent authorities are granted expanded powers to conduct inspections, request information and issue binding instructions. In certain cases, independent audits or external supervisors may be appointed.
The Act also provides for coordination with sector-specific legislation. Where a specific law contains equivalent risk management and reporting requirements (e.g. in the financial sector), the relevant provisions of the Cybersecurity Act will not apply concurrently, in order to avoid regulatory overlap.
 
Sanctions and enforcement
Enhanced supervision is accompanied by a strengthened sanctions regime.
Administrative fines may reach:
For essential entities:

• up to EUR 10,000,000; or
• up to 2% of the total worldwide annual turnover, whichever is higher.

For important entities:

• up to EUR 7,000,000; or
• up to 1.4% of the total worldwide annual turnover, whichever is higher.

Pursuant to § 51 of the Transitional and Final Provisions, for infringements committed before 1 June 2026, fines and pecuniary sanctions will be imposed at 50% of the amounts provided for in Chapter Three.
The new regime elevates cyber risk from a technological concern to a strategic and financial risk at management level.
 
What this means for business
Organisations should:

• determine whether they qualify as essential or important entities;
• assess their cross-border structure and applicable jurisdiction;
• update their risk management framework;
• formalise the involvement of their management bodies;
• strengthen oversight of suppliers;
• adapt incident reporting procedures;
• ensure alignment with sector-specific regulation and data protection requirements.

The amendments require a shift from formal compliance to genuine cyber resilience.
The changes to the Cybersecurity Act mark a new phase in the development of Bulgaria’s cybersecurity framework. They place cyber resilience at the core of strategic governance and require active engagement from senior management.
For businesses, this represents both a regulatory challenge and an opportunity – by building resilient processes and a mature cyber risk management framework, they can enhance the trust of clients, partners and regulators.
The team at Consejo closely monitors regulatory developments and supports organisations in assessing their scope, developing and updating cybersecurity management systems, preparing for audits and achieving sustainable compliance with the new requirements.