Bulgaria's 17 October deadline for its NIS2 measures regulations passed with nothing in the State Gazette

The date, and what was due on it

Bulgaria's transposition sits in an act amending the Cybersecurity Act, in force since 17 February 2026. Its transitional provisions give the Council of Ministers four jobs on four clocks, and paragraph 47 is where they are written down. Two of them fell due on 17 October 2026, eight months to the day after entry into force.

Point 2 is an adoption of something that does not exist: the regulation under article 3(3), covering providers of public electronic communications networks and services, trust service providers, top-level domain name registries and DNS service providers. Point 3 is an alignment of something that does: the regulation under article 3(2), which covers entities generally. Between them they are the whole of what a Bulgarian entity has to implement, because article 3 of the act lists no measures itself — it delegates them.

That is why the date mattered, and why it is worth reporting that it passed.

What the State Gazette says, and how we asked it

The last issue of the Държавен вестник published before this was written is issue 95 of 16 October 2026. Its official section carries three acts of the National Assembly — an amendment to the Electronic Identification Act and two ratifications — Council of Ministers decree 188 of 12 October 2026 on the organisational rules of the small and medium enterprises agency, an amending regulation from the Ministry of Agriculture and Food, and regulation 33 of 6 October 2026 from the Ministry of Transport and Communications. There is nothing on cybersecurity in it.

One issue is not an answer, so we asked the gazette's own search instead, over the issues published between 3 and 19 October 2026 — that is issues 92 to 95, everything after the point to which we had previously read the record. The phrase "мрежова и информационна сигурност" returns no issue. The word "киберсигурност" returns no issue either.

A zero from a search engine deserves suspicion before it deserves belief, so we bracketed it with two queries that should answer and do. The same word "киберсигурност" across 2026 as a whole returns 28 issues, the most recent of them issue 86 of 18 September 2026. The same phrase "мрежова и информационна сигурност" across 2019 returns 13 issues, among them issue 59 of 26 July 2019 — the one that carries the regulation we are asking about. The index is live, it is current, and on the October window it is empty.

So the operative text is still the one written for the old directive

The regulation under article 3(2) is the Наредба за минималните изисквания за мрежова и информационна сигурност, adopted by Council of Ministers decree 186 of 19 July 2019. On the consolidated text we read today, current to issue 95 of 16 October 2026, its history is three lines long: in force from 26 July 2019, promulgated in issue 59 of 2019, amended in issue 36 and issue 47 of 2022. Nothing in 2026, on either side of the deadline.

Its article 1 is the part to show a board. It defines its own scope by administrative bodies, by operators of essential services within the meaning of the Cybersecurity Act, and by digital service providers within the meaning of the Cybersecurity Act. Those are the entity categories of the directive NIS2 repealed. The act that now governs works with essential and important entities. An entity that has correctly worked out which of those two it is still cannot read its obligations out of the regulation, because the regulation does not use the words.

The article 3(3) side is stranger, and it has been stranger since February. Paragraph 50 keeps the old telecommunications security rules applicable "until the regulation under article 3(3) enters into force" — rules made under article 243(3) of the Electronic Communications Act, an article that paragraph 52 of the same act repealed. A stopgap keyed to the arrival of a regulation that has not been adopted does not expire. It just continues, and on 17 October it began continuing past the date the act had set for its end.

What is established here, and what is not

Promulgation follows adoption. A decree adopted on, say, 14 October would reach the gazette in a later issue, so the absence we are reporting is an absence from the published record rather than proof that the Council of Ministers has done nothing. We looked for the adoption directly and could not settle it either way: the government publishes its sitting agendas and decisions one page per sitting, and the last one published is 7 October 2026. The pages for the following week return the site's own "page not found".

One confusion is worth heading off, because it will be made. This is not an EU infringement matter. The Commission closed its procedure against Bulgaria on 1 October 2026, after Bulgaria notified full transposition on 6 March 2026, and that file stays closed. Paragraph 47 is a deadline Bulgarian law set for the Bulgarian executive, in Bulgarian law, for secondary legislation. Nobody in Brussels is going to resolve it, and nothing about it reopens the question of whether the directive was transposed.

What to do this week

Nothing about the delay suspends anything. The duties in the amended act — governance, incident notification, the article 6 filings for digital providers, the two-week change notifications — are in force and are owed under the act, not under the regulation. What the regulation would have given you is the specification: the minimum measures, at a level of detail you can hand to an engineer and audit against.

Until it arrives, the defensible position is the one the act itself leaves you: implement against article 21(2) of the directive and against the regulation you are in fact subject to today, and write down which of the two each control answers to. That record is what makes the eventual alignment a mapping exercise rather than a restart. And if you are a telecommunications operator, the rules you are held to remain the ones paragraph 50 preserves, for as long as the article 3(3) regulation stays unadopted.

The next date on paragraph 47 is 17 November 2026, for the National Cybersecurity Strategy. It is the only one of the four still ahead, and a strategy obliges no entity. The two that would have told entities what to do are the ones that went by on Saturday.