Mayors and Bulgaria’s Cybersecurity Act

Mayors and Bulgaria’s Cybersecurity Act: what the law asks of them personally

NIS2 covers public administration, and many EU countries go further than the directive. In Bulgaria every municipality is covered through its mayor as an executive body, and administrative bodies are essential entities regardless of size (Art. 4a(1)(4)). Some duties fall on the head personally.

What the mayor must do

Approve the cybersecurity measures and oversee them (Art. 21(1)), ideally with a written decision and an annual report.
Complete cybersecurity training every two years (Art. 21(2)).
Organise training for staff (Art. 21(3)).
Name who is responsible for security and who reports incidents.

What the municipality needs

A risk assessment for the main systems: records management, local taxes, the services portal, accounting and email.
A process for significant incidents: an early warning to the sector CSIRT (computer security incident response team) within 24 hours and a notification within 72 hours (Art. 23(5)).
Security requirements in contracts with IT suppliers.
Backups and a tested restore.

Who supervises

The competent authority for administrative bodies is the Ministry of Innovation and Digital Transformation (Art. 16(2)). It can issue binding instructions and order a breach to be announced publicly.

What the mayor risks personally

For a breach of Art. 21 the head can be fined personally €500 to €5 000 (Art. 29(4)). This is separate from any measures against the municipality.

Where to start

Management training: half a day, with a written record and certificates.
A quick assessment in 10 working days: where the municipality stands and what to do in the next 90 days.
An annual programme: the assessment and 12 months of expert support in one contract, easy to plan in the budget.

Minimum measures are set by an ordinance under Art. 3 of the Act. Up to State Gazette issue 94 of 13 October 2026 no new ordinance had been published, so the 2019 ordinance applies.