Bulgaria: NIS2 written into the Cybersecurity Act

13 Feb 2026 8 months ago Already applies

Promulgated in the State Gazette · Закон за изменение и допълнение на Закона за киберсигурност, ДВ бр. 17 от 13.02.2026 · National Assembly of Bulgaria

MaritimeIndustryInfrastructure Bulgaria Law

Bulgaria transposed NIS2 through amendments to the Cybersecurity Act, published in State Gazette issue 17 of 13 February 2026. Essential and important entities must register their details with the competent authority, report changes within two weeks, send an early warning of a significant incident within 24 hours, and have their managing bodies trained every two years.

State Gazette (dv.parliament.bg) · lex.bg (consolidated text)

What to do 0 of 5 done

Read the amended Закон за киберсигурност and the transitional provisions for existing entities
Register the company and its contact details with the national competent authority
Set up the 24-hour early warning and the follow-up incident reports
Book cybersecurity training for the management board and keep the certificate
Review contracts with suppliers for the security clauses the law expects

Ticks are kept in this browser only. Sign in to the client portal to share them with your team.

Bulgaria: NIS2 written into the Cybersecurity Act

Bulgaria: NIS2 written into the Cybersecurity Act

Need this tracked for your fleet or plant?