Contents
According to the analysis of the transitional provisions presented by law firm DGKV to AmCham and the British Bulgarian Business Association, the competent authorities must designate the entities within the scope of the Cybersecurity Act (ZKS) by 17 January 2027. The new ordinance on minimum measures, scheduled for October 2026, has not yet been adopted. However, the obligations under the Act already apply.
Key ZKS deadlines (a timeline of delays)
| Date | Event or deadline |
|---|---|
| 13 February 2026 | The amendment to ZKS was promulgated in the State Gazette, issue 17. |
| 8 May 2026 | MIDT was established, taking over the functions of the former Ministry of Electronic Governance. |
| 1 June 2026 | End of the period during which penalties were imposed at half their amount. |
| 17 August 2026 | Deadline for the Council of Ministers’ decision on the competent authorities and the methodology for designating entities. |
| 1 October 2026 | The European Commission closed the proceedings against Bulgaria for delayed transposition of NIS2. |
| 14 October 2026 | The Council of Ministers considered a decision on which public administrations should be included in the National Cybersecurity System. |
| 17 October 2026 | Deadline for the secondary legislation on minimum measures. |
| 17 November 2026 | Deadline for the new national cybersecurity strategy. |
| 17 January 2027 | The competent authorities designate the essential and important entities. |
Where we stand as of 21 October 2026
The new ordinance on minimum measures has not been promulgated, no draft has been published for public consultation, and the MIDT website still lists the 2019 ordinance. The decision on the competent authorities and the methodology have not been promulgated either.
Until the new ordinance is adopted, the 2019 ordinance applies, while Commission Implementing Regulation (EU) 2024/2690 can serve as a European benchmark. The deadlines may shift, but the Act is already in force.
Why you should not wait for notification
The obligations arise when a company meets the statutory criteria, not when it receives a letter. Not being listed in the register does not exempt it from these obligations.
The obligation to notify the sectoral CSIRT of a significant incident within 24 hours already applies.
If your clients are essential or important entities, they are already required to assess their suppliers and will request evidence under their contracts.
Once designated, essential entities are subject to scheduled inspections. Inspectors will look for measures that work, not plans initiated a week earlier.
When the ordinance is published, hundreds of companies will seek consultants at the same time. Those who start now will not have to wait in line.
Exception: providers that must submit their own details
DNS service providers, domain name registries, cloud computing services, data centres, content delivery networks, providers of managed ICT services and security services, online platforms, search engines and social networks must submit their details themselves within two months, and report changes within two weeks (Art. 6, paras. 2 and 3).
Roadmap to 17 January 2027
- Self-assessment: sector under Annexes I and II and size, including linked enterprises.
- Gap analysis against the measures under Art. 22: risk, incidents, business continuity, suppliers, access, cryptography and training.
- Management decision approving the measures (Art. 21).
- Incident response procedure covering the deadlines of 24 hours, 72 hours and one month, and contact with the sectoral CSIRT.
- Assessment of direct suppliers and security clauses in contracts.
- Training for management (mandatory every two years) and employees.
Avigentis completes steps 1–2 remotely in one day and delivers a 30- or 90-day roadmap. Our subscription keeps you up to date when the new ordinance and methodology are published.
Start with a free AI scan of your website or using your company’s Unique Identification Code (EIK): avigentis.eu/app
Our subscription
