Bulgaria's Long Road To NIS2 Is Over

February 2026 – Across most of the European Union, the NIS2 Directive has already become operational reality. Bulgaria's path to transposition, however, has been materially delayed. The Cybersecurity Act amendments intended to implement the NIS2 Directive were first submitted to the Parliament in September 2024, passed at first reading in February 2025 and reached final adoption in February 2026, with the new framework entering into force on 17 February 2026.

This delay has consequences that go beyond the mere legal uncertainty. While Bulgaria was still preparing its implementation framework, in January 2026 the European Commission proposed a new EU cybersecurity package, including amendments to the NIS2 Directive and a draft Regulation that will replace the Cybersecurity Act. As a result, Bulgarian in-scope entities will begin implementing a framework that is already being reconsidered and further developed at EU level.