How Bulgarian Companies Must Comply with EU Cybersecurity Rules in 2026: Practical Steps for Boards, Counsel and Compliance Teams

Cybersecurity compliance Bulgaria has become a board-level priority as the EU’s second Network and Information Security Directive, NIS2 (Directive (EU) 2022/2555), moves from legislative text into enforced operational reality. For Bulgarian companies in scope, 2026 is a year in which abstract obligations crystallise into concrete duties: documented governance, risk-based technical controls, tested incident-response procedures and reporting duties to the national CSIRT. ENISA’s annual Threat Landscape reports reinforce the urgency, mapping the threat themes, supply-chain compromise, ransomware, and attacks on digital infrastructure, that regulators now expect entities to defend against. This guide translates those EU-level requirements into a practical, step-by-step playbook for Bulgarian boards, general counsel, compliance officers and CISOs.

Why 2026 is a turning point

The practical significance of the current period lies in enforcement maturity. NIS2 replaces the earlier NIS framework with harmonised, stricter obligations and, critically, explicit management and board-level accountability. Where the old regime left cybersecurity governance to vary between national frameworks, NIS2 sets clearer expectations: management bodies must oversee cyber risk, approve measures, and can be held accountable for failures. Combined with current ENISA threat signals, this makes cybersecurity compliance Bulgaria a corporate-governance obligation, not merely a technical project.

Who should read this

If your company operates in energy, transport, banking, health, digital infrastructure, public administration, online marketplaces or other listed sectors, this article is written for you. It is equally relevant to general counsel drafting board resolutions, compliance officers building evidence files, and CISOs implementing controls. External counsel advising Bulgarian and international businesses will find the checklists and timelines directly actionable.

Eligibility, which Bulgarian companies are in scope

NIS2 widens the net considerably compared with its predecessor. The directive distinguishes between two tiers of obligated organisations, and Bulgarian implementing measures designate the competent authority and national contact points. Determining your category is the first legal step in cybersecurity compliance Bulgaria.

NIS2 categories: essential and important entities

• Essential entities. Organisations in high-criticality sectors, including energy, transport, banking, financial market infrastructure, health, drinking and waste water, digital infrastructure, ICT service management, public administration and space. These face the most stringent supervision, including proactive inspections.
• Important entities. Organisations in other critical sectors, such as postal and courier services, waste management, chemicals, food, manufacturing of certain products, digital providers and research. Supervision here is primarily reactive, triggered by evidence of non-compliance.

Size and sector thresholds

NIS2 generally applies a size-cap rule: medium-sized and large enterprises within listed sectors fall in scope, while certain providers (such as DNS service providers, top-level domain name registries, and some digital infrastructure operators) are covered regardless of size. Smaller entities can still be captured where they play a critical societal or economic role. Because thresholds and sector annexes are defined in the directive itself, counsel should verify applicability against the consolidated NIS2 text on EUR-Lex, and against the Bulgarian implementing legislation, before concluding a company is out of scope.

Bulgarian national implementing authority

Bulgaria has transposed NIS2 through national cybersecurity legislation. Bulgaria operates national Computer Security Incident Response Team functions (CERT Bulgaria), and the responsible ministry and designated competent authorities coordinate national cybersecurity functions. Where an incident involves personal data, the Commission for Personal Data Protection (CPDP) is the relevant supervisory authority under the GDPR. Companies should confirm their designated competent authority and contact point through current national guidance before building reporting workflows, as the institutional framework has been evolving under the national transposition of NIS2.

Step-by-step compliance actions for cybersecurity compliance Bulgaria

This section is the operational heart of the guide. It sets out numbered steps, who owns each one, the deliverables, and realistic timelines. Treat these as a programme, not a checklist to complete in a single afternoon, several steps run in parallel and some (technical controls, recordkeeping) are continuous.

Board actions

The role of the management body under NIS2 is explicit. Management bodies must approve the cybersecurity risk-management measures, oversee their implementation, and can be held accountable for breaches of those duties. Practical board actions include adopting a formal resolution assigning responsibility, allocating budget, scheduling regular cyber reporting as a standing agenda item, and completing cybersecurity awareness training. Each decision should be minuted to create evidence of oversight.

Legal and compliance actions

Legal and compliance teams own the translation of NIS2 obligations into enforceable internal policy. This means mapping statutory duties to documented controls, drafting the governance charter changes, ensuring supplier contracts contain security clauses, coordinating the interplay between NIS2 and GDPR reporting, and building the evidence file that will satisfy a supervisory inspection.

IT and CISO actions

The CISO and security operations function implement the technical and organisational measures: multi-factor authentication, patch management, logging and monitoring, encryption, access control, backup and recovery, and vendor security verification. They also operate the detection and triage processes that feed the incident-reporting workflow.

1. Gap analysis against NIS2 and current ENISA risk themes. Map the services your organisation provides, inventory the assets and systems supporting them, and extend the map to your supply chain. Measure current controls against NIS2 requirements and current ENISA threat priorities. Produce a documented gap register with owners and remediation deadlines. Owners: compliance lead, external cyber consultant, legal.
2. Appoint responsible persons and update governance. Appoint a security officer or CISO, integrate cyber risk into the enterprise risk register, and pass a board resolution formalising reporting lines and accountability. Update the board charter so cybersecurity oversight is an explicit standing responsibility. Owners: board, general counsel.
3. Prepare or update the Incident Response Plan (IRP). Define detection and triage criteria, assign roles, set internal and external communications protocols, and specify the notification triggers that activate reporting to the national CSIRT and, where personal data are affected, the CPDP. Include escalation thresholds and decision-maker contacts. Owners: CISO/IT, legal, communications.
4. Implement technical and organisational measures on a risk basis. Deploy multi-factor authentication, enforce patching cycles, centralise logging and monitoring, apply encryption to data in transit and at rest, and tighten vendor and access controls. Prioritise by the risk register produced in step 1. Owners: IT/security operations.
5. Establish the reporting process and templates. Build an internal escalation workflow that moves cleanly from detection to national notification. Prepare templates capturing what must be reported, the applicable timeframes, and the escalation chain. Pre-draft notification wording to save time under pressure. Owners: legal, compliance, IT.
6. Run testing, exercises and audits. Conduct tabletop exercises, penetration testing and, where resourced, red/blue-team exercises. Schedule these at a defined cadence and after any major system change. Document outcomes and brief the board. Owners: CISO, external tester.
7. Maintain recordkeeping and evidence for supervisory inspection. Retain logs, board minutes, training records, risk assessments and incident documentation in an accessible, defensible form. This evidence demonstrates compliance to the competent authority. Owners: compliance, IT.

Step / Who / Duration timeline

External counsel checklist

External counsel should verify scope determination against the NIS2 annexes and the Bulgarian implementing act, review and strengthen supplier contract clauses, confirm the correct national competent authority and CSIRT reporting channel, pressure-test the interplay between NIS2 and GDPR notification obligations, and review board resolution language for enforceability under Bulgarian corporate law.

NIS versus NIS2: what changed

Required documents for compliance

Documentation is the currency of supervisory inspection. When a competent authority asks a company to demonstrate cybersecurity compliance Bulgaria, it is the written policies, risk assessments, minutes and logs that prove, or fail to prove, that duties were met. The table below sets out a minimum document set, its purpose, who signs off and how long to retain it. Retention periods should be set in line with Bulgarian statutory requirements and the organisation’s own retention policy.

Minimum policies and evidence

Templates to prepare

To accelerate implementation, prepare reusable assets ahead of any incident: a board resolution template assigning cybersecurity accountability, a modular IRP with pre-drafted notification wording, a supplier security-clause library, and a standard DPIA format. These reduce response time during a live incident and improve the consistency of the evidence file.

Timeline and deadlines

Under NIS2, reporting is time-critical and staged. The directive requires an early warning quickly after an entity becomes aware of a significant incident, followed by a fuller incident notification and then a final report. Because the precise mechanics and any additional national requirements are set by the Bulgarian implementing act, companies must confirm the exact national deadlines and reporting channel through the designated Bulgarian competent authority and CSIRT before finalising their workflow.

Incident notification timelines

NIS2 establishes a multi-stage reporting regime for significant incidents, broadly as follows (always verify against the national implementing rules):

These timeframes reflect the directive’s framework; the Bulgarian implementing legislation sets the operational detail, including any intermediate reports the authority may request. Confirm current requirements before relying on them.

Board reporting cadence

Beyond incident deadlines, boards should receive scheduled cybersecurity reporting, quarterly as a baseline, with immediate escalation for material incidents. This cadence can be fixed in the board charter or internal governance documents so that oversight is demonstrable and continuous rather than reactive.

Audit and inspection windows

Essential entities should expect the possibility of proactive supervisory inspection, while important entities face reactive supervision triggered by indications of non-compliance. Maintaining audit-ready documentation at all times, not assembling it when a request arrives, is the only reliable posture. The exact national supervision arrangements depend on the Bulgarian implementing act for NIS2; verify them against current guidance from the designated competent authority before acting.

Costs and fees

Budgeting for cybersecurity compliance Bulgaria varies enormously by company size, sector, legacy-system complexity and the extent to which controls already exist. The ranges below are indicative planning figures, not quotations. Treat them as a basis for scoping rather than a fixed price.

Disclaimer: these figures are illustrative ranges only and will differ according to your organisation’s size, sector and existing maturity. Bulgaria has adopted the euro, but obtain tailored quotations in the applicable currency before budgeting.

What changes in 2026, ENISA and EU signals

ENISA’s annual Threat Landscape reporting frames the risk environment that supervisory authorities now expect entities to address. For Bulgarian companies, interpreting these signals is central to a defensible risk-based programme, regulators increasingly ask not only whether controls exist, but whether they are calibrated to current threats.

Key ENISA threat themes

• Supply-chain risk. Attacks propagating through third-party software and service providers remain a dominant theme, reinforcing the need for supplier due diligence and contractual security clauses.
• Ransomware and extortion. The continued prominence of ransomware raises the bar on backup, recovery and tested incident response.
• Threats to digital infrastructure. Attacks targeting the systems that underpin essential services sharpen expectations on entities designated as essential under NIS2.

Expected Bulgarian implementation actions

The practical effect of ongoing NIS2 implementation is expected to be a tightening of national supervision, clearer reporting channels through the national CSIRT, and growing regulator interest in evidence of board-level oversight. The likely result is that companies treating cybersecurity as a documented governance discipline, rather than an IT task, will be best placed to withstand inspection. Companies should monitor European Commission guidance on NIS2 implementation, implementing regulations, and national guidance for updated obligations.

Common pitfalls and how to avoid them

Most compliance failures are organisational rather than technical. The recurring mistakes below undermine otherwise sound programmes.

• Treating cybersecurity as IT-only. NIS2 makes the management body accountable. Formalise oversight in governance documents and minute decisions to evidence governance.
• Incomplete or late incident reporting. Pre-build the notification workflow and templates so staged deadlines to the national CSIRT are met under pressure.
• Weak supplier clauses. Supply-chain compromise is a leading threat; embed security obligations, audit rights and breach-notification duties in contracts.
• Poor recordkeeping. Without logs, minutes and training records, compliance cannot be demonstrated. Maintain audit-ready evidence continuously.
• Ignoring the GDPR interplay. Where personal data are involved, coordinate CPDP notification with NIS2 reporting rather than treating them separately.
• Untested incident response. A plan that has never been exercised fails in practice. Run tabletop and technical tests and brief the board on results.
• One-off compliance. Risk assessments and controls must be reviewed and updated, not completed once and shelved.
• Unclear ownership. Ambiguity over who reports and who decides slows response. Designate a primary incident manager and a legal/compliance liaison in advance.

Conclusion

Cybersecurity compliance Bulgaria is no longer a discretionary IT improvement project, it is a legal obligation anchored in NIS2, policed by national authorities, and shaped by the threat priorities tracked in ENISA’s Threat Landscape reporting. The companies that fare best will be those that treat compliance as a documented governance discipline: a management body that oversees and minutes its decisions, a compliance function that maintains an audit-ready evidence file, and a security team that implements and tests risk-based controls. Begin with a gap analysis, formalise accountability through a board resolution, build and rehearse your incident-reporting workflow, and keep your documentation current.

Working through the steps, timelines and documents set out above gives Bulgarian boards, counsel and compliance teams a practical path to meeting their obligations with confidence. Because the national framework continues to develop under NIS2 transposition, always confirm current requirements with the designated Bulgarian authorities before acting.

Sources

1. ENISA, European Union Agency for Cybersecurity
2. EUR-Lex, Directive (EU) 2022/2555 (NIS2)
3. European Commission, Cybersecurity policy
4. Commission for Personal Data Protection (Bulgaria), CPDP
5. European Data Protection Board (EDPB)