ITER/BGBulgaria
What the record establishes for Bulgaria: the bodies an insider event is reported to, the channel each takes, and the act that transposes the NIS2 Directive, Directive (EU) 2022/2555.
Recipients
| Reached under | Body | Channel | Source |
|---|---|---|---|
| Data protection authorityGDPR, article 33 | Commission for Personal Data Protection reported | — | edpb members |
| CSIRT or competent authorityNIS2, article 23 | СЕРИКС, as the act names the recipient binding | Not set by the act. | bg zakon za kibersigurnost |
| Financial supervisorDORA, article 19 | Bulgarian National Bank reported | — | eba competent authorities |
| Market authorityMAR, article 17 | Комисия за финансов надзор (FSC) reported | — | esma mar nca |
Transposition of NIS2 binding
| Act | Закон за киберсигурност, as amended by ДВ бр. 17 and бр. 55 of 2026 |
|---|---|
| In force | not established in the text read |
| Recipient | СЕРИКС, as the act names the recipient |
| Moves a term | Yes. The anchor is establishment, not awareness. Both stages run «след установяването» of the significant incident: the early warning «до 24 часа след установяването на значителен инцидент», the incident notification «до 72 часа след установяването на значителния инцидент», with twenty-four hours for trust service providers. The Directive measures both from becoming aware. Everything after that is the Directive's: an interim report at the recipient's request, a final report «не по-късно от един месец след подаването на уведомлението за инцидента», and where the incident is not resolved by then, an interim report and the final report within one month of resolving it. |
| Standing | Read in the consolidated act on Lex.bg, in the version carrying the 2026 amendments that transpose the Directive. The act also puts a duty on the recipient: after the early warning, СЕРИКС returns a response with initial information and, on request, guidance. Bulgaria is the fourth country in this record to replace awareness with a word of its own: установяване, alongside Slovakia's zistenie, Finland's havaitseminen and Slovenia's zaznava. |
| Source | bg zakon za kibersigurnost |
An event in Bulgaria
The five types, each opened on this jurisdiction: the acts it obliges, the term on each, and where the report goes.