Bulgaria closed its infringement file on 1 October. Its measures regulation is still the 2019 one

What closed, and what closing means

On 1 October 2026 the Bulgarian Ministry of Innovation and Digital Transformation published a notice saying that it had received formal notification that the European Commission had closed the infringement procedure against Bulgaria over the failure to notify measures transposing Directive (EU) 2022/2555. The state news agency and the general press carried it the same day. The closure follows the amendments to the Cybersecurity Act and Bulgaria's formal notification of full transposition, which the ministry dates to 6 March 2026.

Hold those two dates next to each other, because the gap is the interesting part. The amending act entered into force on 17 February 2026. Notification followed seventeen days later. Closure was announced nearly seven months after that. An infringement procedure does not close when a member state says it is done; it closes when the Commission has finished reading what was sent. Any entity waiting for a national file to be "resolved" before it starts work should take the measure of that interval.

What closure establishes is narrow and worth stating plainly: the Commission accepts that the directive has been transposed into Bulgarian law. It is not a finding that the national regime is operational, and on the evidence below, parts of it are not.

The Bulgarian measures are not in the Bulgarian act

This is the point that a reader coming from Austria or Poland will get wrong. In Austria the ten measures of article 21(2) sit in section 32(4) of the NISG 2026, lettered a) to j). In Bulgaria there is no such article. Article 3 of the Cybersecurity Act, retitled by the amending act to "measures for a high common level of cybersecurity", does not list measures at all. It delegates them.

Two regulations, not one, and which of them governs you depends on what you do. Article 3(2) covers entities under articles 4 and 4a generally, excluding those under article 4(3)(a). Article 3(3) covers providers of public electronic communications networks and services, trust service providers, top-level domain name registries and DNS service providers, and is made on the joint proposal of the Communications Regulation Commission and the minister. Both are Council of Ministers regulations. Neither may require the use of a particular type of technology. Under article 3(4) neither applies to the bodies listed in article 5(2).

So the question "what must I implement in Bulgaria" is a question about a regulation. And the regulation is the part that is late.

Eleven days, two obligations

Paragraph 47 of the transitional provisions sets three clocks running from entry into force. Six months — so 17 August 2026 — for the Council of Ministers to designate by decision the administrative bodies that act as national competent authorities under article 16(1), and to adopt the methodology of article 16(3)(8). Nine months, so 17 November 2026, for the National Cybersecurity Strategy. And eight months, so 17 October 2026, for two separate things that are easy to run together and should not be.

Point 2 is an adoption: the article 3(3) regulation does not exist and must be made. Point 3 is a conformity exercise: the article 3(2) regulation does exist, and must be brought into line with the amended act. Both fall due on 17 October 2026, eleven days after this is written and sixteen days after the Commission closed the file.

What the article 3(2) regulation still says

The regulation under article 3(2) is the Naredba za minimalnite iziskvaniya za mrezhova i informatsionna sigurnost, adopted by Council of Ministers decree 186 of 19 July 2019 and promulgated in State Gazette issue 59 of 26 July 2019. On the consolidated text we read today, current to State Gazette issue 91 of 2 October 2026, it carries that 2019 adoption and two amendments from 2022, in State Gazette issues 36 and 47. Nothing from 2026.

Its article 1 is where the age shows. It defines its own scope by administrative bodies, by operators of essential services within the meaning of the Cybersecurity Act, and by digital service providers within the meaning of the Cybersecurity Act — the entity categories of the directive that NIS2 repealed. The amended act no longer works with those categories; it works with essential and important entities. A regulation whose scope provision names the old categories is not a regulation an entity can map cleanly onto its new classification.

A set of rules that outlived its enabling article

The article 3(3) side has a stopgap, and it is a curious one. Paragraph 50 keeps the pre-existing telecommunications security rules alive until the new regulation arrives.

Read that against paragraph 52 of the same act, which amends the Electronic Communications Act and repeals section I of its chapter fifteen together with articles 243 to 244a. Article 243(3) is the provision under which those Rules were made, and it is gone. The Rules themselves continue to apply, by the express terms of paragraph 50, until the article 3(3) regulation enters into force. A telecommunications operator in Bulgaria is therefore held today to rules whose parent article has been repealed, and will be held to a regulation that has not yet been published. Both halves of that sentence are in the same act, nine paragraphs apart.

And you do not register yourself

One more structural difference, because it changes what an entity should be doing this month. Bulgaria runs no registration window. There is no Bulgarian equivalent of the Polish wykaz application or the Austrian USP filing. Under article 16(3)(8) the national competent authorities determine the essential and important entities, in accordance with a methodology adopted by the Council of Ministers, and notify the minister. You are designated; you do not apply.

The register itself sits with the minister under article 6, holding name, address and contact data, IP ranges, the sector, subsector and type of entity, the member states where in-scope services are provided, and the representative's contact data where one is appointed. And it is closed.

That matters practically: you cannot confirm your own classification by looking it up, and neither can a customer performing supply chain due diligence on you. Two duties do fall on the entity itself. Under article 6(2) the digital providers — DNS services, TLD registries, domain name registration services, cloud, data centres, content delivery networks, managed services, managed security services, online marketplaces, search engines and social networking platforms — must give the competent authority the address of their main establishment and of their other legal establishments in the Union, or of their article 27a(2) representative where there is no Union establishment, within two months of coming into being. And under article 6(3) any entity must notify changes in that data within two weeks, with the authority forwarding them to the minister and the national single point of contact within one week.

Who your authority is, and what we could not confirm

One authority is named by statute and is therefore the one you can rely on today. Paragraph 52 inserted article 21(6) into the Electronic Communications Act: the Communications Regulation Commission is the national competent authority for providers of public electronic communications networks and services, for trust service providers, and for the entities in Annex II item 1. The energy sector gets its own structure under paragraph 49, which charges the Minister of Energy with building and maintaining a cybersecurity centre for public undertakings in that sector.

Every other sector depends on the Council of Ministers decision under paragraph 47(1), and here we stop. We could not verify that the decision has been adopted. That matters more than it looks, because paragraph 48 runs five months from the adoption of that decision, not from a calendar date: the authorities have up to five months from the decision to determine the essential and important entities and notify the minister, paragraph 42 gives them two further months to supply the article 6 information, and paragraph 43 gives the single point of contact three months after that to send the Commission the list. The whole identification chain hangs off an act we have not seen. Deriving dates from it would be inventing the Bulgarian timetable, so we have not.

A last point that is already spent but still governs past conduct, and it is the kind of thing that is easy to miss in a file opened later. Paragraph 51 provides that fines and property sanctions for infringements committed up to 1 June 2026 are imposed at half the amounts set in chapter three — the same chapter whose amounts this act redenominated from leva into euro. If you are answering for something that happened in the spring, that halving is in the statute, not in the regulator's discretion.

What to do with all of this

Bulgaria is a worked example of a distinction worth carrying to every other member state: the question of whether a directive has been transposed and the question of whether a regime is operable are different questions, decided by different instruments, on different clocks. The Commission answered the first on 1 October. The second is answered by a Council of Ministers regulation, and the date to put in your calendar is 17 October 2026.