Bulgaria continues to align its national cybersecurity legislation with the requirements of the European Union. A key element of this process has been the implementation of the NIS2 Directive, aimed at increasing the resilience of critical digital infrastructure and strengthening the protection of organizations against cyberattacks.

 

In May 2025, the European Commission sent Bulgaria a reasoned opinion over the failure to notify the Commission of the full transposition of the NIS2 provisions into national law. Bulgaria was among 19 EU member states that received such reasoned opinions. Member states were required to complete the transposition of the directive by October 17, 2024.

In response, Sofia introduced amendments to the existing Cybersecurity Act. The amendments were adopted by the National Assembly in February 2026 and formed the basis for transposing NIS2 requirements into national legislation. The new rules provide for the classification of regulated organizations as “essential” and “important” entities, while also introducing additional requirements for cybersecurity risk management and incident response.

NIS2 significantly expands the range of organizations subject to European cybersecurity requirements. The directive covers 18 critical sectors, including energy, transport, healthcare, digital infrastructure, public administration, banking, the production of critical goods, and water supply.

This is particularly significant for Bulgaria given the strategic role of the country’s energy and transport infrastructure. Important energy and transport routes run through Bulgarian territory, while the national infrastructure is simultaneously integrated into European networks. As a result, protecting the digital systems of the energy and transport sectors, financial institutions, and public authorities has become part of the broader task of ensuring the resilience of critical infrastructure.

The new requirements also increase the responsibility of organizational management. Companies and institutions covered by NIS2 are required to implement cybersecurity risk-management measures, ensure the protection of information systems, and establish mechanisms for responding to serious incidents. At the same time, requirements for reporting cyberattacks and cooperating with national cybersecurity authorities are being strengthened.

At the EU level, the full implementation of NIS2 is regarded as one of the key elements in strengthening the Union’s overall cyber resilience. The European Commission states that the directive is intended to improve the ability of governments and the private sector to prevent cyber incidents, respond to attacks, and ensure the continuity of critical services.

The current process is taking place against the backdrop of broader efforts by the EU to strengthen digital security requirements for Bulgaria. In October 2026, for example, the European Commission again sent Sofia an additional formal notification concerning other digital legislation, the Digital Services Act, citing problems with the full functioning of the national Digital Services Coordinator.

 

Thus, the implementation of NIS2 is part of a broader restructuring of Bulgaria’s digital security system. At the same time, the final assessment of Bulgaria’s compliance remains with the European Commission: the Commission itself notes that information on the state of transposition reflects data provided by the member states and does not replace a formal assessment of whether national measures comply with NIS2 requirements.

CCBS Research Desk

#ANALYSIS

#BULGARIA

02.10.2026 08:31