Adopted changes to the Bulgarian Cybersecurity Act transposing the NIS 2 Directive

On 5 February 2026 Bulgarian Parliament adopted changes to the Bulgarian Cybersecurity Act (“the Act”). This is an important step towards shaping the regulatory framework of cybersecurity in Bulgaria.

The Act introduces into the Bulgarian legislation the requirements of Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (“NIS 2 Directive”).