NIS2 Implementation in the EU |
|
Bulgaria |
|
|
(Europe)
Firm
Penkov, Markov & Partners
Contributors
Nikolay Cvetanov |
|
| Status | Ongoing |
| Status of the NIS2 Implementation Act | Following the formation of the new Bulgarian Parliament in December 2024, the Bulgarian government submitted the official draft of the NIS2 Implementation Act on 12 December 2024. The draft bill is intended to amend and supplement the existing Cybersecurity Act. As part of the legislative process, the draft has been forwarded to the relevant committees of the Bulgarian Parliament for review. However, it has yet to be examined, debated and voted on in plenary. |
| If available, foreseeable significant deviations of the National Implementation Act from the NIS2 Directive |
|
| Expected date of entry into force of the Implementation Act | It is difficult to predict whether the newly elected Parliament, once constituted in November, will prioritize this draft. In any case, we anticipate that it is likely to be passed by the end of the calendar year. |
NIS2 Implementation in the EU
Ongoing
Following the formation of the new Bulgarian Parliament in December 2024, the Bulgarian government submitted the official draft of the NIS2 Implementation Act on 12 December 2024. The draft bill is intended to amend and supplement the existing Cybersecurity Act. As part of the legislative process, the draft has been forwarded to the relevant committees of the Bulgarian Parliament for review. However, it has yet to be examined, debated and voted on in plenary.
- The draft Implementation Act closely mirrors the provisions of the NIS2 Directive, and we anticipate that it will be enacted in its current form, with no significant revisions.
- Within 8 months after the entry into force of the NIS2 Implementation Act, the Bulgarian government must adopt secondary legislation (an ordinance to be approved by the Council of Ministers), which shall regulate the various technical, operational and organizational measures for network and information security. Currently, no draft of such an ordinance is available, but is expected to replace the existing one, maintaining identical scope.
- Periodicity of cybersecurity trainings for members of the management bodies and employees of in-scope organizations is set at every 2 years.
- In-scope organizations are not required to notify the designated competent authorities under the Cybersecurity Act in order to be entered with the respective registers of essential and important entities, maintained by these regulators. Categorization and registration will be carried out ex officio. An exception applies for TDNS service providers, TLD name registries, entities providing domain name registration services, cloud computing service providers, data center service providers, content delivery network providers, managed service providers, managed security service providers, as well as providers of online marketplaces, of online search engines and of social networking services platforms whose main establishment is located in Bulgaria. These entities will have to notify and provide company details to the relevant authorities for initial registration purposes.
It is difficult to predict whether the newly elected Parliament, once constituted in November, will prioritize this draft. In any case, we anticipate that it is likely to be passed by the end of the calendar year.