Bulgaria’s Cybersecurity Act deadlines (NIS2)

Deadlines under Bulgaria’s Cybersecurity Act: what already applies and what is coming

Bulgaria transposed NIS2 through amendments to its Cybersecurity Act, published in State Gazette issue 17 of 13 February 2026. The obligations apply by law, not from a letter from the authority. The status of the implementing acts was checked in the State Gazette up to issue 94 of 13 October 2026.

What already applies

Since 17 February 2026 the obligations apply to every organisation in scope.
Up to and including 1 June 2026 sanctions were halved (Section 51). After that date they apply in full.
A significant incident is reported to the sector CSIRT (computer security incident response team): an early warning within 24 hours, a notification within 72 hours and a final report within one month (Art. 23(5)).
Changes to the organisation's data are reported to the authority within two weeks.
Certain digital providers submit their own data to the authority within two months.

What is still coming

A Council of Ministers decision on the competent authorities and the designation methodology (Section 47(1)). The statutory deadline was six months from entry into force, around mid-August 2026. Up to issue 94 of 13 October 2026 no methodology for designating essential and important entities had been published.
Designation of essential and important entities by the authorities within five months of that decision (Section 48). This deadline is for the authorities, not a date businesses can wait for.
A new ordinance on minimum measures under Art. 3. The statutory deadline is eight months, around mid-October 2026. Up to issue 94 of 13 October 2026 no new ordinance had been published, so the 2019 ordinance applies.
A national strategy: the statutory deadline is nine months.

Recurring deadlines

Management training every two years.
An annual internal audit under the ordinance.
A review of the risk assessment and measures after material changes.

What to do now

Do not wait for a designation letter. Check whether you are in scope, approve the measures with a management decision and prepare the incident-reporting process. The quick assessment shows where to start in 10 working days.