NIS2 in Bulgaria: is your company in scope and what to do now
On 5 February 2026 the Bulgarian Parliament adopted amendments to the Cybersecurity Act, and on 13 February they were published in the State Gazette, issue 17. With them Bulgaria transposed the EU NIS2 directive. For many companies it is the first cybersecurity law that affects them directly. Here is, in short, who is in scope, what is required and where to start.
Is your company in scope
The check has two steps: sector and size. The law covers highly critical sectors such as energy, transport, banking, healthcare, water, digital infrastructure and ICT service management for other businesses, and other critical sectors such as postal and courier services, waste management, chemicals, food production and distribution, and certain manufacturing.
As a rule, medium and large enterprises are in scope: 50 employees or more, or annual turnover and balance sheet above €10 million. Linked companies in a group count too. Some activities are in scope regardless of size, for example providers of public electronic communications, trust services and DNS.
Companies in scope are of two kinds: essential and important entities. Their obligations are similar. The difference is in how intensively they are supervised and in the size of the fines.
What is required
Risk-management measures. Risk assessment, access control, backups, a business continuity plan, supply-chain security and incident handling. The measures must be proportionate to the risk.
Management accountability. The management body approves the measures and oversees how they are applied. Its members take cybersecurity training every two years. For breaches the law provides personal fines of €500 to €5,000.
Incident reporting. For a significant incident: an early warning within 24 hours, a notification with an initial assessment within 72 hours, and a final report within one month.
Registration. Entities are entered in a register that is not public, and they report any change to their data within two weeks.
The fines
For essential entities: up to €10 million or up to 2% of worldwide annual turnover, whichever is higher, with a minimum of €25,000. For important entities: up to €7 million or up to 1.4% of turnover, with a minimum of €12,500. The law halved fines only for breaches committed before 1 June 2026. That transition period is over.
If you are not in scope
If you are a small company outside the listed sectors, the law probably does not apply to you directly. But if you supply a company that is in scope, it has to manage the risk in its supply chain. So you may receive contractual requirements: security standards, incident notification deadlines, audit rights. It is worth being ready for them.
Where to start
First check the scope: sector, size, linked companies. Then run a gap analysis against the required measures. Review your contracts with IT suppliers. Prepare a procedure that can actually deliver an early warning within 24 hours, weekends included. And book the management training.
This article is a general overview, not legal advice. For your specific case, consult a lawyer. If you would like help with the technical side, from risk assessment to the incident plan, write to us.