Amendments to the Bulgarian Cybersecurity Act introduce the requirements of the NIS 2 Directive

Despite the delay in transposition, in February 2026, amendments to the Bulgarian Cybersecurity Act introduced the requirements of Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 concerning measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972 and repealing Directive (EU) 2016/1148 (NIS 2).
The amendments are in several directions, first of all expanding the circle of persons who are obliged to comply with cybersecurity requirements – namely:
– administrative authorities (no change here);
– types of medium or large enterprises listed in Annex I and II that provide services or carry out activities on the territory of the EU in the energy sectors; transport; banking; financial markets; healthcare; drinking water supply; waste water treatment; digital infrastructure; ICT service management; space activities; postal and courier services; waste management; production and distribution of chemicals; production, processing and distribution of food; listed manufacturing sectors; digital service providers; research organisations;
– entities listed in Annexes I and II have obligations under the amended Cybersecurity Act, regardless of their size, if they provide public electronic communications networks or publicly available electronic communications services; trust services; services such as registrar of top-level domains or domain name system services; are the sole providers of services essential for the maintenance of critical societal and economic activities; if a disruption of the service would pose a systemic risk, in particular if such risk would have a cross-border nature; or if the entity is critical due to specific factors at national or regional level;
– entities designated as critical with a respective public act;
– entities providing domain registration services;
– educational institutions carrying out research activities in the sectors under Annex I and II;
– persons performing public functions and providing administrative services electronically;
– organizations providing public services electronically;
– judicial authorities.
That is, there is a significant expansion of the scope of obligations to comply with cybersecurity requirements.
These obligations now have a different nature – a more clearly expressed focus on risk assessment and taking preventive measures. With the entry into force of the amendments, the management bodies of the main categories of obligated persons should approve risk management measures and monitor their compliance. The obligations to provide cybersecurity measures have been specified – and clear criteria have already been specified which these measures must meet. What is new is the establishment of substantive requirements – for example, the introduction of measures for business continuity or security of supply chains. Similarly, detailed requirements have been introduced for notification of an incident affecting cybersecurity – while the notification obligation is now limited to serious incidents only.
Regarding the measures, the role of the supervisory authorities has been strengthened, with opportunities provided for the Cybersecurity Council to introduce requirements for the use of specific suitable products, services and procedures in the field of information and communication technologies that are certified at EU level. The Council of Ministers, upon a proposal from the Cybersecurity Council, may introduce restrictions on the use of risky technologies by persons obliged under the Cybersecurity Act, provided that these restrictions do not violate EU law.
Measures for supervision have been expanded and additional powers have been provided for administrative authorities. Accordingly, the rules provide for significant sanctions in case of violation – reaching up to EUR 10,000,000 or 2% of global turnover for the most serious violations, according to the model introduced in the General Data Protection Regulation. Along with these sanctions against obligated persons, fines are also provided for the members of their management bodies – which reflects the significant change in cybersecurity measures, practically introducing personal responsibility for their compliance.
All of the above clearly indicates that any person operating in any of the sectors under Annex I and II of the Cybersecurity Act should assess whether they have an obligation to comply with the measures listed therein and take appropriate measures.