NIS2 in Bulgaria: what medium-sized companies must do now
Bulgaria's amended Cybersecurity Act brings NIS2 into force. Who is covered, what management is responsible for, and the 24-hour reporting clock.
Bulgaria transposed the EU NIS2 Directive in February 2026, when Parliament adopted amendments to the Cybersecurity Act. The law arrived about sixteen months after the EU deadline, and it applied without a long transition period.
Who is covered
Coverage is no longer based on designation by an authority. A company is in scope automatically if it is at least a medium-sized enterprise and operates in one of the 18 sectors listed in the law’s annexes. The list now reaches well beyond classic critical infrastructure, including manufacturing, food production, waste management and digital service providers.
If you are a medium-sized company and you are not sure whether you are covered, assume you need to check — not that you are exempt.
Management is personally responsible
Members of the management body must approve the cybersecurity risk-management measures and oversee how they are implemented. They must also complete cybersecurity training every two years and organise regular training for staff. Cybersecurity is now a board-level duty, not only an IT task.
The reporting clock
Significant incidents follow a three-stage timeline:
- An early warning within 24 hours.
- A formal incident notification within 72 hours.
- A final report within one month.
Meeting the 24-hour deadline is an operational problem first. You need detection, a named decision-maker and a tested playbook before an incident happens.
What to do this quarter
- Confirm whether you are an essential or an important entity, and document the reasoning.
- Run a gap assessment against the risk-management measures in Article 21 of NIS2.
- Write and rehearse an incident-reporting playbook built around the 24-hour early warning.
- Brief your management body and schedule their training.
- Watch for the secondary legislation that will set the detailed minimum security requirements.
If you also make software or connected products, note that the Cyber Resilience Act’s reporting obligations have applied since 11 September 2026 — a separate duty with its own 24-hour clock.
This article is general information, not legal advice.