NIS2 and the Cybersecurity Act: Who Is Affected and What Businesses Need to Do

If you are at least a medium-sized company operating in energy, transport, chemical manufacturing, utilities, water supply, waste management or ICT services, and your information security is managed from Bulgaria, this article is for you.

1. Why Cybersecurity Is Now a Management Issue

Digitalisation did not begin with the pandemic, but the pandemic made it unavoidable. Almost every service, product or process has a digital component or operates entirely in the cloud. The security of these components matters to our lives and work, to businesses and to national security.

Two supply-chain cyberattacks in 2020–2021 changed the philosophy of cybersecurity in the United States and Europe. Before the attacks on SolarWinds and Kaseya, the model resembled a medieval castle surrounded by a moat: once someone crossed it, they became a trusted insider within the company’s information environment. That model no longer holds.

SolarWinds (2020) is a company that develops software for managing and monitoring large-scale networks and IT infrastructure. Russian intelligence secretly infected updates to its Orion platform and penetrated US government agencies, causing direct losses exceeding USD 100 million, excluding reputational damage and compromised processes.

Kaseya (2021) is a global provider of remote monitoring, management and automation software for IT departments and managed services. The ransomware attack exploited unpatched code vulnerabilities and affected more than 1,500 businesses. Losses were limited thanks to the efforts of ethical hackers, while the attack cost Kaseya tens of millions of dollars.

In 2021, attacks also affected physical infrastructure in energy and healthcare: Colonial Pipeline and Ireland’s Health Service Executive (HSE).

The lesson is that a supplier’s vulnerability directly affects its customers. This is why the second version of the European framework is built around the Zero Trust principle: “never trust, always verify”.

2. Regulatory Framework

Directive (EU) 2022/2555 (NIS2) — measures for a high common level of cybersecurity across the Union.

Directive (EU) 2022/2557 (CER) — the resilience of critical entities. The two directives complement each other.

Commission Implementing Regulation (EU) 2024/2690 — cybersecurity risk-management measures and the classification of incidents as significant for digital providers covered by NIS2.

Act Amending and Supplementing the Cybersecurity Act — adopted by the National Assembly on 5 February 2026 and promulgated in State Gazette No. 17 of 13 February 2026. It transposes NIS2 approximately 16 months after the deadline.

Draft Critical Entities Resilience Act — the public consultation recently closed. It will affect entities of particular importance to vital societal functions or economic activities.

Forthcoming secondary legislation — the Council of Ministers must adopt a methodology for identifying essential and important entities, a new national cybersecurity strategy and ordinances setting out detailed requirements. The expected deadline is eight months after the Act’s entry into force, and adoption is already delayed.

3. Who Falls Within Scope

The previous model, under which operators of essential services were designated by a decision, has been replaced by automatic coverage based on two criteria: business activity and size. These create two categories of entities covered by NIS2: essential and important entities. Each company must assess for itself whether it falls within scope. The expansion is substantial: 18 sectors are covered, including medium-sized enterprises.

The sister directive sets out the criteria for critical entities in the same fields of activity — entities whose disruption or exposure to incidents would have a particularly significant impact on vital societal services and economic activities.

3.1. Size: At Least a Medium-Sized Enterprise (Subject to Exceptions)

The Cybersecurity Act covers entities that qualify as medium-sized enterprises under the Small and Medium-Sized Enterprises Act (SME Act), or exceed that threshold, in the fields of activity specified in its annexes. The criteria under the SME Act are slightly modified in relation to partly state-owned enterprises and are as follows:

The staff criterion and one of the two financial conditions (turnover or assets) apply cumulatively: an enterprise with 50 or more staff cannot be small, even if its turnover is below EUR 10 million.

The category changes when the thresholds have been exceeded or fallen below for two consecutive financial years.

Staff numbers are measured as an annual average expressed in full-time equivalents.

Importantly, turnover and asset values are not considered on a standalone basis where the company belongs to a group, but on a consolidated basis.

3.2. Exceptions to the Size Requirement

The size threshold does not apply where the entity is:

• a provider of public electronic communications networks or services;
• a trust service provider;
• a top-level domain name registry;
• a DNS service provider;
• the sole provider of an essential service;
• an entity whose disruption would affect public safety, security or health.

A small company therefore cannot be excluded automatically: its sector and its position in the supply chain also matter.

3.3. Sectors

Digital infrastructure (point 8 of Annex 1) covers providers of internet exchange points, DNS services (excluding operators of root name servers), top-level domain name registries, cloud computing services, data centre services, content delivery networks, trust services, and providers of public electronic communications networks and services.

3.4. Essential and Important Entities

Main Establishment

For companies belonging to a group operating in the EU, it is particularly important to determine which company will fulfil the NIS2 requirements — in other words, in which country it will register and to which national supervisory authority it will primarily report. This is determined by three factors: where information security decisions are taken, where the relevant operations are carried out and where the largest number of employees is located. The law assigns different weight to these factors depending on the circumstances.

4. What the Act Requires

4.1. Entry in the Register Maintained by the Ministry of Innovation and Digital Transformation

The register records the entity’s contact details and category.

4.2. Risk-Management Measures

The Act aims to ensure that entities within its scope achieve a high common level of cybersecurity.

Essential and important entities must implement appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems they use. The measures must be technologically neutral and take account of European and international standards. They cover:

• policies on risk analysis and information system security;
• incident handling;
• business continuity;
• supply-chain and system security;
• cyber hygiene and staff training;
• the use of encryption.

In practice, the core principles of this approach are continuous authentication, mandatory network segmentation and a detailed audit of the software supply chain (SBOM).

4.3. Management Responsibility

Management bodies approve cybersecurity risk-management measures and oversee their implementation. Their members undergo cybersecurity training every two years and arrange regular training for employees. They are personally liable for infringements.

4.4. Incident Reporting

Notifications are submitted to the competent sectoral computer security incident response team (CSIRT). The short deadlines also serve to warn other companies that may be affected along the supply chain.

5. Enforcement and Penalties

The competent authorities may issue binding instructions, order mandatory security audits and require public disclosure.

For essential entities, the court may be asked to temporarily suspend licences, registrations and certificates, and to prohibit the exercise of management functions.

If an infringement affects personal data, the Commission for Personal Data Protection imposes a penalty under data protection law. Where a financial penalty has already been imposed for the same infringement, a second fine is not imposed for it.

A temporary reduction in fines is provided for during the first months following the Act’s entry into force — check the current text.

Supervision

One of the main differences in the regulation of important and essential entities is whether supervision is ex ante — ongoing and without prior warning, as for essential entities — or ex post and event-driven, following incident reports by important entities. The national supervisory authorities for the different sectors covered by the Cybersecurity Act are to be designated through secondary legislation.

6. The Supply Chain and the Market

The ordinances and methodology are unlikely to differ substantially from existing soft-law instruments and EU regulations that already provide examples of compliance. We therefore recommend not waiting for their adoption. European partners will start requesting evidence of compliance, because responsibility extends along the supply chain. As Kaseya demonstrated, a compromised supplier directly affects its customers.

Participation in competitive procedures and the conclusion of contracts may become more difficult if the requirements have not been met and evidence cannot be provided. This also affects companies that are not themselves directly within scope but serve entities that are.

7. How to Get Started

• Assess whether you fall within scope: sector under Annexes 1 and 2, size under the SME Act, linked enterprises and exceptions.
• Determine the category — essential or important entity.
• Conduct a gap analysis against the risk-management measures.
• Adopt policies and procedures: risk management, incident response, business continuity, supplier security and encryption.
• Implement a process for reporting incidents within the 24-hour / 72-hour / one-month deadlines.
• Arrange training for management and employees.
• Document everything — you will need evidence for partners, contracting authorities and regulators.

When something is urgent, the lawyers are always called first and asked: does this affect us, and what are the fines? We can help you assess whether you fall within scope and prepare the necessary policies and documents.

This article is for information purposes only and does not constitute legal advice. It reflects the legal position as at October 2026.