Regulatory reference — checked against the sources
Regulatory answers state the date on which they were checked against the source given. Sections are reviewed quarterly and whenever a relevant change is published.
Plain-language client questions → · DORA or NIS2 — a practical comparison →
We are a payment institution. Is our DORA route the same as a bank’s? #
Start with the licensed legal entity, home state and authorised services. DORA Article 2 covers payment institutions, electronic money institutions and account information service providers; the licence and any specific exemption determine the applicable framework. Under Bulgarian Payment Services Act Article 182b, BNB is the DORA competent authority for those entities headquartered in Bulgaria. A register returned to such an entity is not automatically an FSC case. Confirm the receiving authority, reporting instructions and reference date before commissioning correction; the register-only service can address an agreed package without a full DORA assessment.
What is DORA and who does it apply to? #
DORA is the EU regulation on digital operational resilience for the financial sector. It has applied since 17 January 2025 to the listed financial entities, with lighter rules for some categories, and affects their ICT (information and communication technology) providers through mandatory contract terms. The competent authority depends on the entity and licence: in Bulgaria it is commonly BNB or FSC, while ECB or another authority may apply. DORA requires an ICT risk-management framework approved by the management body, incident classification and reporting, resilience testing, a register of ICT third-party arrangements and specific contract terms.
How does NIS2 apply in Bulgaria? #
Bulgaria transposed NIS2 by amending the Cybersecurity Act (State Gazette No. 17 of 13 February 2026), applicable from 17 February 2026; a transitional period with sanctions reduced by half ended on 1 June 2026. You are in scope if you operate in one of the eighteen listed sectors and are at least a medium-sized enterprise — 50 or more staff, or turnover and balance-sheet total above €10 million, counted with linked and partner enterprises. Some entities are covered regardless of size: public electronic-communications providers, trust-service providers, top-level-domain registries and DNS (Domain Name System) providers, and entities that are the sole provider of an essential service, whose disruption would affect public safety or health, that pose systemic risk, or that are critical nationally or regionally. Administrative bodies, judicial authorities and certain public-service organisations are covered as well. Cloud, data-centre, content-delivery, managed-service and online-platform providers are covered under the general sector-and-size test and have a separate duty to supply their establishment details to the competent authority within two months. Management bodies approve the measures, oversee them and train at least every two years. Fines reach €10 million or 2% of worldwide turnover for essential entities (statutory minimum €25,000) and €7 million or 1.4% for important ones (minimum €12,500); members of management bodies face personal fines of €500 to €5,000. The statutory deadlines for the secondary acts differ: six months for the identification methodology, eight months for the ordinances on minimum measures, nine months for the national strategy; whether each has been adopted is checked at the time of your engagement.
Who must comply with NIS2 — the sectors and tiers? #
The NIS2 Directive covers eighteen sectors. Eleven are of high criticality (Annex I): energy; transport; banking; financial market infrastructure; health; drinking water; waste water; digital infrastructure; ICT service management (business-to-business); public administration; and space. Seven are other critical sectors (Annex II): postal and courier services; waste management; chemicals; food; manufacturing of medical devices, electronics, electrical equipment, machinery and vehicles; digital providers (online marketplaces, search engines, social networks); and research organisations. Within these sectors, medium-sized and larger entities are generally in scope, and some entities are covered regardless of size. Each Member State transposes the Directive into national law, and the details differ: for example, the Bulgarian Cybersecurity Act lists ten Annex I sectors and covers administrative bodies separately, as essential entities regardless of size. Whether an organisation is an essential or important entity depends on its type, its size and the national law that applies where it is established or operates; being in scope regardless of size does not, by itself, determine the category. A customer’s contract can extend requirements to you even when the law does not.
Do municipalities and other public bodies have to comply? #
Yes. Administrative bodies are essential entities by category, not by size, so all 265 Bulgarian municipalities are in scope together with central-government administration; judicial authorities are covered too. The mayor, as head of the administration, approves the security measures and oversees them; a head of an administrative body or a member of a management body who fails to do so can be fined €500 to €5,000. The turnover-based fine does not apply to essential entities that are administrative bodies; enforcement takes the form of binding instructions, warnings, public disclosure and the personal fine. The national competent authority for administrative bodies is the Ministry of Innovation and Digital Transformation. The municipal associations have published their own guidance. Article 6 assigns the register to the minister, and Article 16(2) assigns competence for administrative bodies. The February text names electronic government; Section 73 of the law in State Gazette 55/2026 replaces those minister/ministry references throughout the Cybersecurity Act with innovation and digital transformation.
Who decides that we are in scope, and do we register? #
Two things run in parallel. The duties apply by operation of law from 17 February 2026 to any entity that meets the sector-and-size test or falls into a listed category — whether or not a letter has arrived. Formal identification is administrative: the national competent authorities designate essential and important entities under a methodology adopted by the Council of Ministers and notify the Ministry of Innovation and Digital Transformation, which keeps the register; the register is not public. Certain digital providers — DNS, TLD registries, domain-registration services, cloud, data-centre, content-delivery, managed and managed-security services, online marketplaces, search engines and social-network platforms — must themselves supply their establishment details to the competent authority within two months; all entities notify changes within two weeks. We prepare the register data in advance and tell you what will be asked. Article 6 assigns the register to the minister, and Article 16(2) assigns competence for administrative bodies. The February text names electronic government; Section 73 of the law in State Gazette 55/2026 replaces those minister/ministry references throughout the Cybersecurity Act with innovation and digital transformation.
What is NIS2 for? #
NIS2 is an EU directive whose purpose is to raise the common level of cybersecurity across the services society and the economy depend on — power, water, health, transport, finance, digital infrastructure and public administration — because a failure in one spreads quickly to the rest. It does this by making cybersecurity a management responsibility, by setting minimum measures and common incident-reporting rules, and by extending duties down the supply chain. The consequences of ignoring it are concrete: fines, personal fines and a possible temporary management ban for directors at essential entities, targeted audits at the entity’s own expense and public disclosure of a breach. Beyond the law, regulated customers increasingly require evidence of compliance in their contracts.
What does “management accountability” mean under NIS2 and DORA? #
Under the Cybersecurity Act the management bodies of essential and important entities, and the heads of administrative bodies, approve the cybersecurity risk-management measures and oversee their implementation; members of management bodies must undergo training at least every two years and organise it for their staff. A manager who does not can be fined €500 to €5,000 personally, and at essential entities the authority can seek a temporary ban from management functions. Under DORA the management body defines, approves and oversees the ICT risk-management framework and bears ultimate responsibility for ICT risk; verification tasks may be outsourced, but the responsibility stays with the entity. Delegating the work does not delegate the accountability.
Incident reporting under NIS2 (Cybersecurity Act): what are the deadlines? #
Essential and important entities report significant incidents to the sectoral CSIRT (СЕРИКС) under Article 23(5) of the Cybersecurity Act. Early warning: within 24 hours of establishing the significant incident. Incident notification: within 72 hours of establishing the significant incident — for trust-service providers this second deadline is 24 hours. Intermediate report: on the CSIRT’s request. Final report: no later than one month after the incident notification. If the incident is still being handled when that month ends, an intermediate report is submitted instead and the final report follows within one month of handling the incident. Recipients of the service are informed where appropriate, and of measures they can take against a significant cyber threat. Bulgarian Article 23(5) ties these periods to establishing a significant incident, not every suspicious event. For the digital entities covered by Regulation 2024/2690, recital 31 explains awareness through a timely initial assessment and reasonable certainty that a significant incident has occurred. Record the facts and assessment time; later management approval cannot reset an already running deadline.
Incident reporting under DORA: what are the deadlines and exceptions? #
Major ICT-related incidents are reported to the competent supervisory authority (Article 19 DORA) within the time limits of Delegated Regulation (EU) 2025/301, Article 5. General rule: the initial notification is due within 4 hours of classifying the incident as major and no later than 24 hours from becoming aware of it. If the incident is classified as major only after those 24 hours, the initial notification is due within 4 hours of the classification. The intermediate report is due within 72 hours of the initial notification, with updates without undue delay and in any case when regular activities are recovered; the final report no later than one month after the intermediate report or its latest update. Where a deadline falls on a weekend or a bank holiday, the report may be submitted by noon of the next working day — but for the initial notification and the intermediate report this extension does not apply to credit institutions, central counterparties, trading venue operators and entities that are essential or important under NIS2, and competent authorities may exclude other entities they designate. A national CSIRT channel, where one exists, does not replace the report to the supervisor.
Incident and vulnerability reporting under the CRA and the GDPR: what are the deadlines? #
CRA (manufacturers of covered products, from 11 September 2026, Article 14): for an actively exploited vulnerability — early warning within 24 hours of becoming aware, vulnerability notification within 72 hours of becoming aware, final report no later than 14 days after a corrective or mitigating measure is available; for a severe incident with an impact on the product’s security — early warning within 24 hours of becoming aware, incident notification within 72 hours, final report within one month after the incident notification. Reports go to the CSIRT designated as coordinator and to ENISA (EU Agency for Cybersecurity) through the single reporting platform. GDPR (Article 33): a personal-data breach is notified to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk. One incident can trigger several regimes at once; the process is designed once and run from one playbook.
What is required for suppliers and third parties? #
Under DORA, maintain a register of all contractual arrangements for ICT services, distinguishing those supporting critical or important functions. Assess and monitor provider risk proportionately, retain evidence and agree the applicable contract provisions on security, incident assistance, service and data locations, and termination. Additional access, audit and exit-transition provisions apply to services supporting critical or important functions. NIS2 requires supply-chain security measures proportionate to risk; the depth of review does not limit the DORA register to selected suppliers.
Which functions are actually required by law? #
The legal duty and the job title are different questions. DORA requires covered non-micro financial entities to assign ICT-risk management and oversight to a control function with appropriate independence; compliance-verification tasks may be outsourced, while the entity retains the function and responsibility. DORA also requires a role monitoring ICT-provider arrangements or senior-management responsibility, and a crisis-management function, without prescribing those job titles. A DPO (data protection officer) is required only in the cases in GDPR Article 37. Bulgarian whistleblowing rules generally apply to private employers with 50 or more staff and, below that threshold, to the activities specifically identified in Part I, letter B and Part II of the statutory annex; an external party may receive and register written reports, while examination remains internal. We confirm the exact basis before proposing a role.
What does the EU AI Act require today? #
As of September 2026, prohibited practices, measures supporting AI literacy, general-purpose AI obligations and applicable transparency duties are already in force on their respective dates. Regulation (EU) 2026/1744 rewrote Article 4: providers and deployers must take measures supporting staff AI literacy, considering their context and knowledge, but do not have to guarantee a particular level for each person; national supervision of this duty began on 3 August 2026. Article 50 duties differ by role and use. A transition to 2 December 2026 applies to the machine-readable marking duty for qualifying generative systems placed on the market before 2 August 2026; pre-August-2025 GPAI models have a separate transition to 2 August 2027. High-risk obligations were rescheduled to 2 December 2027 for Annex III systems and 2 August 2028 for AI built into regulated products. Article 26 applies to deployers of high-risk systems, not every organisation using an ordinary AI tool.
What does the GDPR have to do with your services? #
Two things. Article 37 makes a data protection officer mandatory for public authorities and bodies and for organisations whose core activities involve large-scale regular and systematic monitoring or large-scale processing of special-category data; the DPO may be external and must be free of conflicts of interest. We provide the DPO function as an external role where those conditions allow. Second, personal-data breaches must be notified to the supervisory authority within 72 hours where required — a duty we build into the same incident process as NIS2 and DORA reporting. We do not provide general GDPR legal advice.
What is the Cyber Resilience Act and does it affect me? #
The CRA assigns duties to manufacturers, importers, distributors and other specified actors for products with digital elements placed on the EU market; open-source software stewards have a distinct regime. The reporting duties for covered products have applied since 11 September 2026, and the main product-security obligations apply from 11 December 2027. An organisation that only uses software is not a manufacturer for that reason alone. We offer reporting readiness and a consultancy analysis of the product against the requirements. Formal conformity assessment and certification follow the Regulation’s procedures, including notified bodies where applicable; we do not perform them.
What is the whistleblowing-channel duty and what can be outsourced? #
Private employers with 50 or more workers and public-sector bodies generally need an internal reporting channel. Below 50 workers, the exception is tied to the activities identified specifically in Part I, letter B and Part II of the annex to the Bulgarian Act, not every activity mentioned anywhere in the annex. Current CPDP guidance allows a private-sector obliged entity to outsource receipt and registration of written reports, while examination remains with a designated internal employee; public bodies cannot outsource these functions. We confirm the legal design with your lawyer.
Are ISO 27001, ISO 42001, ISO 22301 and SOC 2 legal requirements? #
No. They are voluntary frameworks that customers, tender rules or regulators increasingly ask for as proof. ISO/IEC 27001, ISO/IEC 42001 and ISO 22301 are certified by independent certification bodies; SOC 2 is an attestation report issued by a licensed CPA firm — not a certificate. We prepare you and can act as your external officer where a standard requires one; the certificate or report comes from the independent body, never from us.
Our provider is compliant. Does that make us compliant too? #
No. A provider’s certification or compliance can support part of your supply-chain evidence, but it does not discharge your own duties to govern, report, contract and test. Your authority or customer can still require evidence from your organisation.