Is your organisation obliged under the Cybersecurity Act? Check in 30 seconds.
Cybersecurity Act (ZKS, State Gazette No. 55 of 16 June 2026) – the transposition of NIS2. See who is in scope, what the sanctions are and who carries out inspections.
Essential entities under Art. 4a ZKS
Sanctions of up to EUR 10,000,000 or 2% of annual turnover. Automatically subject to scheduled inspections by the MIDT.
| Category | Examples | Legal basis |
|---|---|---|
| Municipalities | All 265 municipalities in Bulgaria | Art. 4a(4) ZKS |
| Energy | CEZ, EVN, ENVIA | Art. 4a(2) ZKS |
| Transport – rail | BDZ, NRIC | Art. 4a(3) ZKS |
| Transport – aviation | Airports, airlines | Art. 4a(3) ZKS |
| Transport – maritime | Public transport ports, passenger ferries | Art. 4a(3) ZKS |
| Water utilities | Water supply and sewerage operators | Art. 4a(5) ZKS |
| Healthcare | Hospitals, National Health Insurance Fund | Art. 4a(6) ZKS |
| Digital infrastructure | DNS, cloud providers, data centres | Art. 4a(8) ZKS |
Important entities under Art. 4a(2)
Sanctions of up to EUR 7,000,000 or 1.4% of annual turnover.
| Category | Examples | Legal basis |
|---|---|---|
| Postal services | Courier companies | Art. 4a(2) ZKS |
| Waste management | Municipal and private operators | Art. 4a(2) ZKS |
| Marinas | >50 employees or >EUR 10 million turnover | Art. 4a(2) ZKS |
| Food industry | Producers and distributors | Art. 4a(2) ZKS |
| Digital providers | Online platforms, search engines | Art. 4a(2) ZKS |
⚓ Ports and marinas – are you in scope?
Public transport ports (passenger and cargo) are essential entities under Art. 4a(3) ZKS – automatically, with no thresholds.
Marinas and yacht harbours are important entities if they have more than 50 staff, an annual turnover above EUR 10 million, or are expressly designated by the MIDT (Art. 4a(1)).
If in doubt, run a free AI scan of your infrastructure or contact us.
Who carries out inspections?
Four authorities, four different sets of powers.
MIDT
Supervisory authority under the ZKS. Scheduled and unscheduled inspections of all entities. Can impose sanctions and publish violations.
CPDP
Oversees GDPR violations – personal data, cookie policies, DPO obligations.
SANS
Critical infrastructure and national security. Coordination of high-priority incidents.
SERIKS (CERT-BG)
Receives incident reports: 24 h early warning → 72 h notification → final report within 1 month.