NIS2 obligations in Bulgaria

Competent authority & CSIRT Legal ref: Art. 16, 27

• Ministry of Electronic Governance. ecs-org.eu · 28 Oct 2026 · secondary source
• In addition to the competent authority, the following have supervisory powers: ecs-org.eu · 28 Oct 2026 · secondary source
• Ministry of Interior. ecs-org.eu · 28 Oct 2026 · secondary source
• Ministry of Defence. ecs-org.eu · 28 Oct 2026 · secondary source
• State Agency for National Security. ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Annex 1

• The scope excludes public administration. ecs-org.eu · 28 Oct 2026 · secondary source

Registration Legal ref: Art. 6

• The draft requires entities to submit the following information: ecs-org.eu · 28 Oct 2026 · secondary source
• Name of the organisation. ecs-org.eu · 28 Oct 2026 · secondary source
• Address and contact details. ecs-org.eu · 28 Oct 2026 · secondary source
• IP address. ecs-org.eu · 28 Oct 2026 · secondary source
• Sector and subsector classification. ecs-org.eu · 28 Oct 2026 · secondary source
• List of member states where the entity provides services (if applicable). ecs-org.eu · 28 Oct 2026 · secondary source
• Details of the point of contact administering the domain name. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Art. 23

• Significant incidents are reported to the national CSIRT. Reporting requirements: ecs-org.eu · 28 Oct 2026 · secondary source
• Early warning within 24 hours, indicating whether the incident could have a cross-border impact. ecs-org.eu · 28 Oct 2026 · secondary source
• Incident report within 72 hours, providing details on severity and impact. ecs-org.eu · 28 Oct 2026 · secondary source
• Interim report with up-to-date information at the request of the national CSIRT (if necessary). ecs-org.eu · 28 Oct 2026 · secondary source
• Final report no later than 1 month after sending the incident report. ecs-org.eu · 28 Oct 2026 · secondary source
• Progress report (if the incident is still ongoing) no later than 1 month after sending the incident report and a final report within another month after the end of the incident, indicating the likely cause or threat and describing the measures taken to mitigate it. ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art. 28, 29 and 30

• Up to 10,000,000 EUR or 2% of the total worldwide annual turnover (essential entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Up to 7,000,000 EUR or 1.4% of the total worldwide annual turnover (important entities). ecs-org.eu · 28 Oct 2026 · secondary source
• From 500 EUR to 5000 EUR for violations by heads of administrative bodies, managers, or members of management bodies of significant and important entities. ecs-org.eu · 28 Oct 2026 · secondary source
• Art. 30 mandates additional fines for more types of violations. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: Art. 25

• Reference to EU standards under the NIS2 Directive. ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: Final Text

What changed recently

No dated changes recorded.