After a lengthy legislative process, amendments to the Bulgarian Cybersecurity Act transposing Directive (EU) 2022/2555 — known as NIS2 — entered into force in early 2026. The changes significantly widen the range of organisations required to implement cybersecurity risk-management measures.
Who is affected
The Directive covers so-called essential and important entities across a wide range of sectors — energy, transport, banking and financial market infrastructure, health, digital infrastructure, ICT service management, postal and courier services, manufacturing, food, digital providers and others. As a general rule, medium-sized and large enterprises in these sectors are covered, but certain entities fall within scope regardless of size.
Key obligations
- Appropriate technical, operational and organisational risk-management measures;
- Management accountability — management bodies approve the measures, oversee their implementation and undergo training;
- Reporting of significant incidents within short, staged deadlines;
- Supply-chain security assessment, including contracts with IT service providers;
- Registration with and cooperation with the competent authorities.
Sanctions
The Act provides for substantial fines, differentiated by type of entity, as well as possible personal liability of management. Reduced sanctions applied to breaches committed during an initial transitional period, which has now expired.
First steps
We recommend that every company operating in the listed sectors assess whether it falls within scope, appoint a responsible person and start with a gap analysis against the requirements. Contracts with key IT suppliers should be reviewed and supplemented with security and incident-notification clauses.
SM Legal assists with scope assessments, internal policies and contractual clauses, and with communication with the competent authorities — in cooperation with technical information security specialists.
This publication is for information purposes only and does not constitute legal advice. For advice on a specific matter, please contact us.
Sylvia Marushkina — Attorney-at-law, Founder of SM Legal