Regulations in plain language

What are these regulations?

• EU laws that tell organisations how to protect their computers, data and services from attacks and outages.
• The aim is that people do not lose power, water, healthcare or money if someone attacks a hospital, bank, public body or supplier.
• The main five are:

• NIS2For important sectors and public administration. Each EU country puts it into its own law — in Bulgaria, the Cybersecurity Act.
• DORAFor banks, insurers, payment and investment firms and their IT providers.
• GDPRFor anyone who handles personal data.
• AI ActFor companies that build or use artificial intelligence.
• Cyber Resilience ActFor makers of software and connected devices.

Who do they apply to?

• Medium and large organisations in 18 sectors — for example energy, transport, health, water, digital services, food, manufacturing and waste. Medium means 50 or more staff or over €10 million turnover.
• Public administration. Many countries go further: in Bulgaria, for example, every municipality and administrative body is covered regardless of size.
• Some companies regardless of size, for example internet service providers.
• Banks and financial firms — under DORA (EU Digital Operational Resilience Act).
• Small companies indirectly: if you supply a bank, hospital or public body, they will ask for evidence that you are a secure supplier.

What does “compliance” mean?

Doing what the law requires — and being able to show it. In practice:

• management is responsible for security and has been trained;
• you know what the risks are;
• there are rules on who can access what;
• backups can actually be restored;
• you know what to do in an attack and whom to notify;
• you check your suppliers.

A document in a drawer is not enough. You need evidence that the measures work.

Why prepare now?

• The laws already apply: DORA since 17 January 2025, and the national NIS2 (EU cybersecurity directive) laws in most EU countries — in Bulgaria since 17 February 2026.
• You do not need to wait for a letter. The obligations apply by law.
• Preparation takes weeks to months.
• After an attack you must send the first warning within 24 hours. Without preparation that is almost impossible.
• Customers and banks are already asking.

What happens if you are not ready?

• A fine for the organisation: up to €10 million or 2% of worldwide turnover, and up to €7 million or 1.4% for less critical organisations.
• Management can be held personally responsible — in Bulgaria, for example, personal fines of €500 to €5 000.
• The authority can order the breach to be made public.
• Under the GDPR — fines up to €20 million or 4% of turnover.
• Lost customers and contracts.
• Most importantly: one attack can stop your work for days.

Where to start?