Contents
What is NIS2
NIS2 (Directive (EU) 2022/2555) is the European directive on network and information security – the updated European directive on network and information security. It replaces the first NIS Directive of 2016 (Directive 2016/1148), which no longer matched the growing cyber threats in the EU.
The main differences compared with NIS1:
- Extended scope – from 7 to 18 sectors, covering a significantly larger part of the economy
- Harmonised sanctions – minimum fine thresholds, similar to the GDPR model
- Personal liability – managers are personally liable for non-compliance
- Essential/important distinction – two types of entities with different supervisory regimes
- Stricter reporting requirements – a three-stage procedure for incidents
- Supply chain security – an explicit obligation to assess suppliers
Why NIS2 matters for GDPR-regulated companies
NIS2 and GDPR complement each other. GDPR protects personal data, while NIS2 protects network and information systems. Many organisations will fall under both regimes. A cyber incident that also affects personal data requires dual reporting – under both NIS2 and GDPR. GDPR compliance is a good starting point, but it does not cover the requirements of NIS2.
Transposition in Bulgaria
The transposition of NIS2 in Bulgaria was significantly delayed. Here is the timeline:
- 16 January 2023 – NIS2 enters into force at EU level
- 17 October 2024 – transposition deadline. Bulgaria misses the deadline
- November 2024 – the European Commission opens infringement proceedings against Bulgaria and 22 other Member States
- May 2025 – the EC sends a reasoned opinion, which is the last step before referral to the Court of Justice of the EU
- 17 February 2026 – the National Assembly adopts amendments to the Cybersecurity Act (ZKS), transposing NIS2
No transitional period
Contrary to some expectations, the Bulgarian law does not provide for a transitional period for achieving compliance. The obligations apply from the date of promulgation. The only concession: reduced sanctions until 1 June 2026, which in practice provides 3.5 months for preparation. After 1 June 2026 the full sanctions regime applies.
According to estimates by the Ministry of e-Government (MEU), between 10,000 and 12,000 organisations in Bulgaria fall within the scope of NIS2 – significantly more than the hundred or so operators of essential services under the old NIS1.
Which businesses fall within the scope
NIS2 divides entities into two categories: essential (Annex I) and important (Annex II). The difference lies in the level of supervision and the amount of the fines.
Enterprise size threshold
As a general rule, NIS2 covers medium-sized and large enterprises:
- 50+ employees, or
- €10M+ annual turnover
Exception: for certain critical sectors (DNS, TLD, cloud services, data centres, trust service providers) size is irrelevant – they are covered regardless of the number of employees.
The 18 sectors
| Category | Sector | Examples of entities |
|---|---|---|
| Essential (Annex I) | Energy | Electricity distribution, gas, oil, district heating, hydrogen |
| Transport | Air, rail, water, road | |
| Banking | Credit institutions | |
| Financial market infrastructure | Exchanges, central counterparties, depositories | |
| Healthcare | Hospitals, laboratories, pharmaceuticals, medical devices | |
| Drinking water | Water and sewerage companies, water supply operators | |
| Waste water | Treatment plants, sewerage operators | |
| Digital infrastructure | DNS, TLD, cloud services, data centres, CDN, IXP | |
| ICT service management (B2B) | Managed service providers (MSP) and managed security service providers (MSSP) | |
| Public administration | Central and regional government bodies | |
| Space | Operators of ground-based infrastructure for space services | |
| Important (Annex II) | Postal and courier services | Postal operators, courier companies |
| Waste management | Waste collection, recycling, landfilling | |
| Chemical industry | Manufacture and distribution of chemicals | |
| Food | Production, processing and distribution of food | |
| Manufacturing | Medical devices, computers, electronics, machinery, motor vehicles | |
| Digital providers | Online marketplaces, search engines, social networks | |
| Research | Research organisations (where they are not public bodies) |
Attention: the food sector in Bulgaria has been extended
In the original directive, the food sector covers only undertakings engaged in wholesale production and distribution. The Bulgarian law, however, extends the scope to ALL food businesses (including retail) that meet the size criterion. This means that large food retail chains and distributors that remain outside the directive are covered by the Bulgarian law.
10 mandatory measures under Art. 21
Article 21 of NIS2 (transposed in the Cybersecurity Act) sets out 10 mandatory measures for managing cybersecurity risks that every organisation within scope must implement:
Policies on risk analysis and information system security
Organisations must develop and maintain up-to-date risk assessment policies based on a systematic analysis of threats to information systems. This includes a risk assessment methodology, a risk register and a risk treatment plan.
Art. 21(2)(a) NIS2Incident handling
Procedures for preventing, detecting, analysing and responding to cybersecurity incidents. This includes an incident response plan, a response team, escalation procedures and documentation.
Art. 21(2)(b) NIS2Business continuity and crisis management
Business continuity plans (BCP), backup management, disaster recovery (DRP) and crisis management. The organisation must be able to continue operating during and after a cyber incident.
Art. 21(2)(c) NIS2Supply chain security
Assessment of risks from suppliers and subcontractors, including risks related to specific ICT products and services. Organisations must include cybersecurity requirements in contracts with suppliers.
Art. 21(2)(d) NIS2Security in the acquisition, development and maintenance of network and information systems
Including vulnerability handling and disclosure. Organisations must apply security by default (security by design) when developing and deploying systems.
Art. 21(2)(e) NIS2Policies and procedures to assess the effectiveness of risk management measures
Regular audits, penetration testing, vulnerability assessments and internal reviews of the effectiveness of the cybersecurity measures implemented.
Art. 21(2)(f) NIS2Basic cyber hygiene practices and cybersecurity training
Staff awareness programmes and regular training on recognising phishing, social engineering and other threats. In Bulgaria: mandatory management training every 2 years.
Art. 21(2)(g) NIS2Policies and procedures on the use of cryptography and encryption
Determining when and how to use encryption to protect data at rest and in transit, cryptographic key management, and policies on algorithms and key lengths.
Art. 21(2)(h) NIS2Human resources security, access control policies and asset management
Access control based on the principle of least privilege, identity management, asset inventory, staff policies (onboarding/offboarding) and access procedures.
Art. 21(2)(i) NIS2Multi-factor authentication and secured communications
Use of multi-factor authentication (MFA) or continuous authentication, secured voice, video and text communications, and secured emergency communication systems.
Art. 21(2)(j) NIS2
Proportionality of the measures
The measures must be proportionate to the risks – for example, a small courier company will not apply the same technical measures as a bank. The assessment takes into account: the degree of exposure to risks, the size of the entity, the likelihood of incidents and their severity, including their societal and economic impact.
Incident reporting
NIS2 introduces a three-stage procedure for reporting significant incidents:
| Stage | Deadline | What is reported | To whom |
|---|---|---|---|
| Early warning | 24 hours | Whether the incident is caused by unlawful acts and whether it has a cross-border impact | CERT Bulgaria / MEU |
| Incident notification | 72 hours | An initial assessment of the incident, including its severity and impact, and indicators of compromise (IoC) | CERT Bulgaria / MEU |
| Final report | 1 month | A detailed description of the incident, type of threat, root cause, measures applied, cross-border impact | CERT Bulgaria / MEU |
When is an incident “significant”?
An incident is considered significant when it:
- Has caused or is capable of causing severe operational disruption of the services or financial loss for the entity
- Has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage
Dual reporting: NIS2 + GDPR
When a cyber incident also affects personal data, the organisation must report under both regimes in parallel:
| Aspect | NIS2 | GDPR |
|---|---|---|
| First report | 24 hours (early warning) | 72 hours (notification to the CPDP) |
| To whom | CERT Bulgaria / MEU | CPDP |
| Focus | Network and information security | Protection of data subjects’ personal data |
| Notification of affected persons | Where necessary – public notification | Where there is a high risk to rights and freedoms – Art. 34 GDPR |
Practical recommendation
Prepare a single incident response procedure that covers both NIS2 and GDPR requirements at the same time. Designate a team capable of launching both notifications in parallel. See our article on reporting personal data breaches within the 72-hour deadline for details on the GDPR part.
Personal liability of management
One of the most significant changes brought by NIS2 is the introduction of personal liability for the management of organisations. Article 20 of the directive (transposed in the Cybersecurity Act) requires that:
- Management approves the cybersecurity risk management measures under Art. 21
- Management is personally liable for failure to comply with the obligations
- Management undergoes training in cybersecurity – in Bulgaria: mandatory every 2 years (stricter than the directive)
- Management must also ensure training for employees to identify risks
Possible removal from office
In the event of systematic failure to fulfil NIS2 obligations, the supervisory authority may request the temporary removal from office (suspension) of the natural person from a managerial position, as well as a prohibition on holding managerial positions (disqualification). The measure is unprecedented and shows that the EU and Bulgaria are placing the topic at the level of corporate governance.
Fines and sanctions
NIS2 introduces a harmonised sanctions regime throughout the EU, with minimum thresholds set in the directive. The Bulgarian Cybersecurity Act provides for:
| Entity category | Maximum fine | Minimum fine |
|---|---|---|
| Essential entities | up to €10,000,000 or 2% of global annual turnover (whichever is higher) | €25,000 |
| Important entities | up to €7,000,000 or 1.4% of global annual turnover (whichever is higher) | €12,500 |
| Managers personally | €500 – €5,000 | €500 |
Additional sanctioning mechanisms:
- Daily penalties – in the event of continued non-compliance, the fine may accrue for each day until the infringement is remedied
- Temporary suspension of activity – for essential entities, the supervisory authority may order the temporary suspension or restriction of services
- Public disclosure – the supervisory authority may publish information about infringers
- Removal of management – see the section on personal liability above
Reduced sanctions until 1 June 2026
The Bulgarian law provides for reduced sanctions for the period until 1 June 2026 – in effect a “transitional relief regime” for preparation. After 1 June 2026 the full sanctions regime applies without exception. Use this time to achieve compliance.
Stricter Bulgaria-specific requirements
When transposing NIS2, Bulgaria introduced several stricter requirements than those provided for in the directive:
Extended food sector
The directive covers only wholesale food production and distribution undertakings. The Bulgarian law extends the scope to all food businesses (including retail) that meet the size criterion. This affects dozens of large food retail chains and distributors.
Mandatory management training every 2 years
The directive requires management training without specifying its frequency. The Bulgarian law introduces mandatory training every 2 years with documentation and certification. Managers who have not completed the training may be sanctioned personally.
14-day deadline for registration changes
In the event of a change in circumstances (new manager, change of contact details, change of status), entities must notify the supervisory authority within 2 weeks. The directive does not set a specific deadline.
Technology restrictions
The Bulgarian law empowers the MEU to impose technology restrictions on specific ICT products and services that pose a threat to national security. This may affect suppliers from certain countries and necessitate the replacement of equipment.
NIS2 vs GDPR – a comparison
Many organisations are already GDPR-compliant and are wondering how NIS2 differs. Here is a detailed comparison:
| Aspect | GDPR | NIS2 |
|---|---|---|
| Main focus | Protection of personal data | Protection of network and information systems |
| Legal instrument | Regulation (directly applicable) | Directive (requires transposition) |
| Who is affected | Anyone who processes personal data | 18 specific sectors + enterprise size criterion |
| Incident reporting | 72 hours to the CPDP | 24h + 72h + 1 month to CERT/MEU |
| Supervisory authority in Bulgaria | CPDP (Commission for Personal Data Protection) | MEU (Ministry of e-Government) / CERT Bulgaria |
| Maximum fine | €20M or 4% of turnover | €10M or 2% of turnover (essential) |
| Personal liability | Indirect (through the controller) | Direct – fines and removal from office |
| DPO / responsible person | DPO (under certain conditions) | No explicit requirement for a separate person, but management bears responsibility |
| DPIA / risk assessment | DPIA (in case of high risk) | Mandatory risk assessment for all entities |
| Supply chain | Contracts with processors (Art. 28) | Mandatory assessment of supplier risks |
| Audit | Recommended (GDPR audit) | Mandatory regular audit and penetration testing |
Complementary, not duplicative
GDPR and NIS2 do not duplicate each other – they complement each other. A good GDPR programme (policies, training, incident procedures, DPIA) is a solid foundation for NIS2 compliance. However, NIS2 adds technical requirements (penetration testing, MFA, encryption, business continuity and recovery plans (BCP/DRP)) that GDPR does not explicitly cover. Organisations should integrate the two regimes into a single information security management framework.
7 steps to prepare
If your organisation falls within the scope of NIS2, we recommend the following action plan:
Determine whether you are in scope
Check whether your sector is among the 18 covered by NIS2 and whether you meet the size criterion (50+ employees or €10M+ turnover). Determine whether you are an essential or an important entity. Do not forget the Bulgarian extension for the food sector.
Carry out a gap analysis
Assess your current level of compliance against the 10 measures under Art. 21. Identify the gaps and prioritise them by risk level. If you are already GDPR-compliant, many of the organisational measures are probably already in place. Carry out a comprehensive audit covering both regimes.
Secure management commitment
Inform the board/managing directors of their personal liability under NIS2. Secure a cybersecurity budget. Schedule the mandatory management training (in Bulgaria – every 2 years). Without commitment “from the top”, the NIS2 project is doomed.
Develop an action plan
Based on the gap analysis, create a concrete plan with owners, deadlines and budget. Prioritise: incident management and reporting (the 24-hour rule), risk assessment, supply chain security. Set realistic deadlines – before 1 June 2026 for full compliance.
Implement technical measures
Multi-factor authentication (MFA) for all critical systems. Encryption of data at rest and in transit. A vulnerability management system. Business continuity and recovery plans (BCP/DRP). Network segmentation and monitoring. Penetration testing.
Create an incident reporting procedure
Establish a single procedure that covers both NIS2 (24 hours / 72 hours / 1 month to CERT) and GDPR (72h to the CPDP). Designate a response team. Test the procedure with simulated incidents (tabletop exercises). Provide a 24/7 reporting channel.
Document and maintain
NIS2 compliance is not a one-off project. Document all policies, procedures and training. Conduct regular audits and tests. Update the risk assessment when threats or the business environment change. Maintain a register of incidents and measures taken.
Frequently asked questions
When does NIS2 enter into force in Bulgaria?
NIS2 has been transposed in Bulgaria through amendments to the Cybersecurity Act adopted on 17 February 2026. The obligations apply from the date of promulgation – there is no transitional period. Reduced sanctions apply until 1 June 2026, after which the full sanctions regime applies.
My company has 45 employees – does it fall under NIS2?
Under the general rule (size-cap), NIS2 covers medium-sized and large enterprises with 50+ employees or €10M+ annual turnover. If you have 45 employees and a turnover below €10M, you are in principle not covered. Exception: if you are a provider of DNS, TLD, cloud services, a data centre or trust services – size is irrelevant.
What is the difference between an essential and an important entity?
Essential entities come from the 11 sectors in Annex I and are subject to proactive supervision (the supervisory authority carries out checks on its own initiative) and higher fines (up to €10M/2%). Important entities come from the 7 sectors in Annex II and are subject to reactive supervision (inspection following an incident or a report) with lower fines (up to €7M/1.4%).
Do I have to report an incident under both NIS2 and GDPR?
Yes, if the incident affects both network security and personal data, dual reporting is required: under NIS2 to CERT Bulgaria/MEU (24h early warning + 72h notification + 1-month final report) and under GDPR to the CPDP (72h notification under Art. 33). We recommend a single response procedure covering both regimes.
What are the NIS2 fines in Bulgaria?
For essential entities: up to €10,000,000 or 2% of global annual turnover, with a minimum of €25,000. For important entities: up to €7,000,000 or 1.4% of turnover, with a minimum of €12,500. Managers personally: from €500 to €5,000. Daily penalties are possible in the event of continued non-compliance. Until 1 June 2026 the sanctions are reduced.
