The transposition of Directive (EU) 2022/2555 (NIS2) into Bulgarian law expands the range of organisations subject to cybersecurity requirements. In addition to risk management and incident reporting obligations, the legal framework provides for the identification and registration of organisations falling within its scope.
The amendments to the Bulgarian Cybersecurity Act, published in State Gazette No. 17 of 2026, establish the national legal framework for implementing NIS2. These changes require updates to secondary legislation, including the Ordinance on Minimum Requirements for Network and Information Security, to align it with the new statutory requirements.
This raises several practical questions for organisations: which entities are required to register, what information must they provide, which authority is responsible, and what steps can they take before the administrative procedure is fully clarified?

What Is NIS2 Registration?
Registration forms part of the mechanism for identifying organisations subject to cybersecurity requirements. It helps competent authorities determine the scope of supervision, maintain up-to-date information on the relevant entities and communicate with them.
Article 3 of Directive (EU) 2022/2555 requires Member States to establish a list of essential and important entities, as well as entities providing domain name registration services. National legislation determines the procedures for collecting and maintaining the necessary information.
Registration does not constitute certification or confirmation of compliance with NIS2. Inclusion in the relevant register does not mean that an organisation has fulfilled all applicable requirements for risk management and the security of network and information systems.

Which Organisations Are Required to Register?
The Bulgarian Cybersecurity Act distinguishes between two main categories of organisations: essential entities and important entities.
Whether an organisation falls within the scope of the Act depends on several factors, including its sector of activity, the types of services it provides, its size and certain specific criteria.
The sectors covered by the legal framework include:

• Energy, transport, banking and financial market infrastructures.
• Healthcare, drinking water and wastewater.
• Digital infrastructure, ICT service management (business-to-business) and public administration.
• Postal and courier services, waste management and the manufacture of certain products.
• Production, processing and distribution of food.
• Manufacture and distribution of chemicals, digital providers and research organisations.

The medium-sized or large enterprise criterion applies to a significant proportion of organisations. However, certain entities fall within the scope of the Act regardless of their size.
Consequently, operating in a particular sector is not, in itself, sufficient to determine whether an organisation is covered. An assessment must consider its specific activities, size criteria, special grounds for inclusion and the applicable provisions of the Act, including Articles 4 and 4a and Annexes I and II.

Who Is Responsible for Registration in Bulgaria?
The Bulgarian Cybersecurity Act provides for the establishment and maintenance of a register of essential and important entities. The register is not publicly accessible, as stipulated in Article 6(5) of the Act.
Under the 2026 amendments, responsibility for establishing, keeping and maintaining the register is assigned to the Minister of Innovation and Digital Transformation.
At the same time, the Act provides for the involvement of national competent authorities designated according to the sector and type of entity. This means that the authority responsible for maintaining the register should not automatically be regarded as the authority to which an organisation must fulfil all its obligations.
To organise the registration process correctly, each organisation needs to identify the national competent authority responsible for its activities.

What Information Must Organisations Provide?
Article 6 of the Bulgarian Cybersecurity Act specifies the main categories of information collected about essential and important entities.
These include:

• Name of the organisation.
• Address and up-to-date contact details, including email address and telephone number.
• IP address ranges.
• Sector, subsector and type of entity, where applicable.
• The EU Member States in which the organisation provides the relevant services, where applicable.
• Contact details of the designated representative, where applicable.

Additional information requirements apply to certain categories of providers.
Organisations should consider not only the initial submission of information but also their obligation to update it when changes occur.
This information can be prepared in advance, regardless of the specific technical arrangements that will be introduced for its submission.

When and How Will NIS2 Registration Take Place in Bulgaria?
At present, there is no confirmed information about an operational, publicly accessible electronic portal for the registration of all essential and important entities in Bulgaria. The practical arrangements for submitting registration information, including the applicable administrative procedures and deadlines, have yet to be clarified.
However, the absence of a single electronic platform does not mean that statutory information-submission obligations have been postponed. Competent authorities may use sector-specific procedures or other administrative channels.
Organisations should verify the applicable deadlines for the initial submission and subsequent updating of information under the legislation in force and the official guidance issued by the relevant competent authority.

How Is NIS2 Registration Related to the Ordinance on Minimum Requirements for Network and Information Security?
The amendments to the Bulgarian Cybersecurity Act require updates to the Ordinance on Minimum Requirements for Network and Information Security, which sets out organisational and technical requirements for protecting network and information systems. Under the Act, the Ordinance also establishes the procedures for keeping, storing and accessing the register of essential and important entities.
Registration and the implementation of cybersecurity measures are separate obligations. Registration serves to identify organisations within the scope of the legislation and provide the necessary information to competent authorities, while cybersecurity measures focus on managing risks and ensuring an appropriate level of protection.
The forthcoming amendments to the Ordinance should not automatically be interpreted as grounds for postponing obligations that already arise under the Act.

How Is NIS2 Registration Carried Out in Other EU Member States?
The NIS2 Directive does not establish a single electronic registration platform for all organisations across the European Union. Member States organise their national procedures in accordance with their respective legal and administrative frameworks.
National practices illustrate different approaches.
Belgium uses the centralised electronic platform Safeonweb@Work, through which organisations falling within the scope of national legislation submit their registration information.
Poland applies a combined approach involving the ex officio registration of certain entities based on existing government data and self-registration by other organisations.
Slovakia uses a procedure whereby organisations submit the required information, after which the competent authority enters them in the register and notifies the entity concerned.
Greece has introduced mandatory registration for essential and important entities under Law No. 5160/2024, which transposed NIS2 into national legislation. Registration is carried out through a dedicated electronic platform accessible via the government portal gov.gr, under the responsibility of the National Cybersecurity Authority (Εθνική Αρχή Κυβερνοασφάλειας).
The Greek administration also provides an online self-assessment tool to help organisations determine whether they fall within the scope of NIS2.
These examples demonstrate that national procedures may differ in how information is submitted, the involvement of competent authorities and the administrative steps required for registration.
For organisations in Bulgaria, the requirements of the Bulgarian Cybersecurity Act and the applicable national procedures remain decisive.

What Should Organisations Do Now?
Regardless of how the registration procedure develops, organisations can take several preparatory steps.
1. Assess whether NIS2 applies. The first step is to determine whether the organisation falls within the scope of the Bulgarian Cybersecurity Act, taking into account its sector, specific activities, size and any special criteria.
2. Determine its classification. The organisation should establish whether it qualifies as an essential or important entity, as this affects the applicable supervisory regime.
3. Identify the competent authority. Organisations should determine which national competent authority is responsible for their sector and monitor its published guidance.
4. Prepare the registration information. Information about the organisation, contact persons, IP address ranges, services provided and relevant EU Member States can be collected and verified in advance.
5. Assign internal responsibilities. Organisations should clearly designate the individuals responsible for preparing, submitting and updating the required information.
6. Begin a compliance assessment. Registration is only one element of the regulatory obligations. In parallel, organisations should assess their existing cybersecurity measures, risk management processes and readiness to meet the applicable requirements.

NIS2 registration is an important element of Bulgaria's national cybersecurity governance and supervisory framework. It enables the identification of organisations falling within the scope of the legislation and provides a basis for their interaction with the competent authorities.
For organisations in Bulgaria, the key priorities are to determine whether the legislation applies to them, prepare the necessary information and monitor official guidance on the registration procedure.
NIS2 readiness should not be limited to administrative registration. It should form part of a comprehensive approach to risk management, information security and organisational resilience.
CONSEJO supports organisations in assessing the applicability of NIS2 requirements, conducting compliance assessments, identifying the necessary measures and preparing to meet their obligations under the Bulgarian Cybersecurity Act.
We are closely following the forthcoming amendments to the Ordinance on Minimum Requirements for Network and Information Security. Once the amendments are adopted, we will publish updated information on the NIS2 registration procedure and applicable deadlines in Bulgaria.