{"text_format":"2","workbook":"xlsx","n_sheets":2,"sheets":["Coversheet","NIS2 Implementation in the EU"],"not_rendered":{"charts":0,"images":1,"macros":0,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"run_cost":"one","rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Coversheet","index":0,"n_rows":12,"n_cols":3,"rows_kept":12,"cut":false,"hidden":false,"merged":[]}
[]
[]
[null,"Prepared By:","Contributors:"]
[null,"Penkov, Markov & Partners","Nikolay Cvetanov"]
[]
[]
[]
["NIS2 Implementation in the EU"]
[]
["Report Generated: 6/16/2026"]
[]
["View your report results on next tab"]

{"sheet":"NIS2 Implementation in the EU","index":1,"n_rows":6,"n_cols":2,"rows_kept":6,"cut":false,"hidden":false,"merged":[]}
["Question","Bulgaria"]
["NIS2 Implementation Status"]
["Status of the legislative process","Ongoing"]
["Status of the NIS2 Implementation Act","Instead of adopting an entirely new piece of legislation, the Bulgarian authorities chose to amend and supplement the existing local \nCybersecurity Act which already introduces certain general concepts under NIS2 (such as the \nNational Cybersecurity Strategy, the so-called National Single Point of Contact, measures for mitigating risks of cyber incidents, etc.).\nAccordingly, the local \nNIS2 Implementation Act, intended to amend and supplement the existing \nCybersecurity Act, has been adopted at first reading by the Bulgarian National Assembly on 20th February 2025. It was subsequently reviewed by the competent parliamentary committees in June and July 2025. As part of this process, opinions were collected from relevant institutions such as the Bulgarian Cybersecurity Association, the Ministry of Internal Affairs, the Ministry of e-Governance, etc.\nAs of January 2026, the second reading and voting on the \nBulgarian NIS2 Implementation Act has not yet been conducted. Respectively, its final adoption, approval by the President, and publication in the \nState Gazette remains pending. Minding that the government has resigned at the end of 2025 and new parliamentary elections shall be carried out this year, the process of adopting the legislative changes could be further delayed.\nWithin eight months of the entry into force of the \nNIS2 Implementation Act, the Bulgarian government shall adopt secondary legislative act - an ordinance, to be issued pursuant to and in fulfillment of the main law. This ordinance will lay down in detail the technical, operational, and organizational measures that the obliged entities must implement for achieving network and information security in their activity. \n"]
["Significant deviations of the National Implementation Act from the NIS2 Directive, if any"," \n The draft National Implementation Act , approved at first reading, to great extent mirrors the structure of the NIS2 Directive , i.e. most of its provisions are aligned with the legal effect and wording of the NIS2 Directive . We can reasonably expect this status quo to be maintained after the second reading, and the new piece of legislation to be adopted close to its current form, fully consistent with the NIS2 Directive's concept and language. \n "]
["Date of entry into force of the Implementation Act","As commented above, in the context of the current unstable political situation in the state and the recent resignation of the government, it is difficult to determine when the second-reading vote on the \nImplementation Act will take place. It is not entirely excluded that, following the formation of a new government and a new parliament, an entirely new draft law to be proposed, although such an approach would not be expedient nor practical. In view of the already missed deadlines for the transposition of the \nNIS2 Directive, the reasonable expectation is that the process will nevertheless be finalized within the course of 2026.\n"]