Operates a social platform, in Bulgaria

Закон за радиото и телевизията (ЗРТ, Zakon za radioto i televiziyata), chl. 17a i 19d, izm. DV br. 109 ot 2020 g. · Read the law's page

• Applies to media service providers and video-sharing platform providers.
• Do not create or distribute programmes that could harm a child's physical, psychological, moral or social development (Art. 17a(1)).
• Follow the Code of Conduct the Council for Electronic Media adopts with providers, including the public broadcasters BNT and BNR, which prescribes measures such as scheduling, age-verification tools and encoding to assess, label and restrict access to harmful programmes.
• If you run a video-sharing platform, take appropriate measures, including age-verification systems, to protect children from user-generated videos and audio-visual commercial communications that could harm their development, alongside signalling, parental-control and media-literacy measures (Art. 19d).

Copyright and Related Rights Act (Закон за авторското право и сродните му права, ЗАПСП, Zakon za avtorskoto pravo i srodnite mu prava), чл. 22б, ДВ бр. 100 от 1.12.2023 г. · Read the law's page

• Obtain authorization from rights holders for the electronic access you offer to works your users upload, or be able to prove the conditions that avoid liability: all possible efforts to obtain authorization, all possible efforts to keep unavailable the works for which rights holders gave you relevant and necessary information, and prompt action on a sufficiently substantiated notice, with all possible efforts to prevent the works being uploaded again.
• If your service is genuinely new, show only all possible efforts to obtain authorization and prompt action on a sufficiently substantiated notice; once your average monthly visitors in the previous calendar year exceed 5,000,000, also show all possible efforts to prevent the future upload of the notified works.
• On a rights holder's request, give adequate information on how your practices work, and, where you hold an authorization, information on the use of the authorized works.
• Put in your terms and conditions an address and an electronic address for complaints, the time limit for deciding them, and the possibilities for permitted free use of works; decide each complaint without undue delay, give reasons for refusing one, and have a person review each decision to stop access to or remove uploaded content.
• Do not identify individual users in applying these rules, and process personal data only as the data-protection rules allow.

Electronic Communications Act (Закон за електронните съобщения, ЗЕС, Zakon za elektronnite sabshteniya), чл. 1, ал. 3, чл. 21, ал. 6, чл. 49г, чл. 310а-310и, чл. 323в-323х, изм. ДВ бр. 99 от 21.11.2025 г. · Read the law's page

• Comply with every duty that Regulation (EU) 2022/2065 sets for your kind of intermediary service, because the Electronic Communications Act applies its fines to a breach of any of them.
• When the Communications Regulation Commission, or for a video-sharing platform the Council for Electronic Media, asks for information by reasoned decision, supply it by the deadline the officials set, complete, accurate, reliable and not misleading.
• Give the supervising officials access to your premises, documents and records in any medium, copies of them, and access to information carriers including servers, and cooperate with them in an inspection.
• Carry out the measures the authority orders under Article 51(2)(b) or (d) or Article 51(3) of the Regulation, and any commitments it has approved, by the date it sets.

Закон за киберсигурност (ЗКС), чл. 21 и 22, изм. с §§ 25 и 26 от Закона за изменение и допълнение на ЗКС, обн. ДВ, бр. 17 от 13.02.2026 г. (English: Cybersecurity Act, Arts. 21 and 22, as substituted by §§ 25 and 26 of the Act Amending and Supplementing the Cybersecurity Act, State Gazette No. 17 of 13 February 2026) · Read the law's page

• Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the security of the network and information systems you use in your core activity or in providing your services, sized to your exposure, your size, and the likelihood and severity of an incident.
• Cover, at minimum: risk-analysis and information-system-security policies, incident-handling procedures, business-continuity and backup management, supply-chain security, security in the acquisition, development and maintenance of your systems including vulnerability handling and disclosure, policies to evaluate the effectiveness of your own risk-management measures, basic cyber-hygiene practices and training, cryptography and encryption policies, human-resources security, access control and asset management, multi-factor or continuous authentication with secured communications and emergency communication systems where appropriate, change management of information assets, and the risk-management and reporting measures that apply to entities of the kind named in Annex I or II and to critical entities under Directive (EU) 2022/2557.
• Have your management body approve and oversee these measures, and have every member of your management body complete cybersecurity training every two years and organise the same training for your staff; a member who fails to do so faces a personal fine of EUR 500 to 5,000.
• This binds you where you are an essential or important entity under Articles 4 and 4a of the Cybersecurity Act: an entity of a kind named in Annex I or II that is at least a medium-sized enterprise, or that falls within one of the Article 4, point 3 cases whatever its size, as the national competent authority determines under Article 16(3), pt. 8. Annex II names a provider of an online marketplace, an online search engine, or a social networking services platform, so such a provider is reached on those terms; the wider sector classes the Act reaches (energy, transport, banking, health, drinking water, digital infrastructure, public administration, manufacturing and others) are reached on the same terms.

Закон за киберсигурност (ЗКС), чл. 23, изм. с § 27 от Закона за изменение и допълнение на ЗКС, обн. ДВ, бр. 17 от 13.02.2026 г. (English: Cybersecurity Act, Art. 23, as substituted by § 27 of the Act Amending and Supplementing the Cybersecurity Act, State Gazette No. 17 of 13 February 2026) · Read the law's page

• Notify СЕРИКС of every significant incident on this clock: an early warning within 24 hours of detecting the significant incident, an incident notification within 72 hours of detecting it (24 hours if you are a trust service provider), an interim report on request, and a final report no later than one month after the incident notification (or, if you have not dealt with the incident by then, an interim report followed by a final report within one month after you have finished handling it) (Article 23(5)).
• State in your early warning, where applicable, whether the incident is suspected to result from unlawful or malicious acts and whether it could have a cross-border effect; update that assessment with an initial severity and impact evaluation in your 72-hour notification; and cover in your final report the incident's scope and impact, its likely cause, your mitigation measures, and any cross-border effect.
• Where appropriate and without undue delay, notify the recipients of your service of a significant incident likely to adversely affect them and of any measures they can take, and of a significant cyber threat and its nature.
• Same penalty tier as the risk-management duty above: up to EUR 10,000,000 or 2 percent of worldwide turnover for an essential entity (not less than EUR 25,000), up to EUR 7,000,000 or 1.4 percent for an important entity (not less than EUR 12,500); this turnover-based sanction does not reach an essential entity that is itself an administrative body.
• This binds you where you are an essential or important entity under Articles 4 and 4a of the Cybersecurity Act, which for an Annex I or II entity means at least a medium-sized enterprise unless an Article 4, point 3 case applies, as the national competent authority determines under Article 16(3), pt. 8; Annex II names a provider of an online marketplace, an online search engine, or a social networking services platform among the digital service providers it reaches expressly; the wider sector classes are reached as on this jurisdiction's companion risk-management-and-governance row.

Закон за киберсигурност (ЗКС), чл. 24 и 27, изм. с §§ 28 и 31 от Закона за изменение и допълнение на ЗКС, обн. ДВ, бр. 17 от 13.02.2026 г. (English: Cybersecurity Act, Arts. 24 and 27, as replaced by §§ 28 and 31 of the Act Amending and Supplementing the Cybersecurity Act, State Gazette No. 17 of 13 February 2026) · Read the law's page

• Where a Council of Ministers decree under Article 24 requires it, use the specific ICT products, services and processes certified under a European cybersecurity certification scheme adopted under Article 49 of Regulation (EU) 2019/881, to show compliance with the Article 22 risk-management measures.
• Stop using a technology that a Council of Ministers decree restricts under Article 27(1) within three years of the decree's adoption, or within the shorter period the decree sets where the risk to national security is high (Article 27(2)).
• If you are an essential or important entity under Articles 4 and 4a of the Cybersecurity Act, including a provider of an online marketplace, an online search engine or a social-networking-services platform, these provisions bind you; the wider sector classes the Act reaches are reached too on the same terms: an entity of a kind named in Annex I or II that is at least a medium-sized enterprise, or that falls within one of the Article 4, point 3 cases whatever its size, as the national competent authority determines under Article 16(3), pt. 8.

Bill No. 52-654-01-151 of 24 September 2026 (Законопроект № 52-654-01-151), Fifty-Second National Assembly, Закон за използването и развитието на изкуствения интелект · Read the law's page

• This is a bill, not law: it was filed in the National Assembly on 24 September 2026 and has not been enacted. Read the lines below as what would apply if it is enacted as filed.
• Do not use remote biometric identification systems, and do not engage in the AI practices that Article 5 of Regulation (EU) 2024/1689 prohibits (Article 12(1), points 1 and 3).
• Do not publish on an online platform AI-generated content that is a convincing forgery in the name of a person in high public office or a state body, or in the name of another person where that person has not consented in advance (Article 15(1)).
• If a recommender system you operate is identified as high-risk for national security by the Council of Ministers, give the State Agency for National Security and the Ministry of Innovation and Digital Transformation without delay its source code and technical documentation, a description of its training data, its main model parameters and statistics on its results (Article 13(2)).
• Do not use children's personal data to train an AI model unless their parents or guardians consent and the model is a specialized one for children's education or pediatric innovation (Article 32).
• If you provide, import or distribute AI systems in Bulgaria, give a current telephone number when you register in the Commercial Register and hold a profile in the secure electronic delivery system (Article 11).