Is a securities firm, in Bulgaria

DV br. 31/2025, chl. 2 al. 2 i 3, chl. 46 do 53, § 4 i prilozhenie 2 razdeli III, IV i VI i prilozhenie 5 ot Zakon za iziskvaniyata za dostapnost na produkti i uslugi (Закон за изискванията за достъпност на продукти и услуги) · Read the law's page

• If you offer a service listed in Article 2(2) (electronic communications services other than machine-to-machine transmission; services giving access to audiovisual media services; the websites, mobile services and applications, electronic tickets, travel information and interactive self-service terminals of air, bus, rail and waterborne passenger transport; consumer banking services; e-books and dedicated software; e-commerce services), provide it in line with the accessibility requirements of Annex 2, sections III and IV and the functional performance criteria of section VI (Arts. 2(2) and 46(1); implements Directive (EU) 2019/882, Art. 2(2) and Art. 4(1) and (3)).
• For urban, suburban and regional transport services, meet only section IV of Annex 2, which for them concerns the accessibility of the self-service terminals used to provide the services (Art. 46(2); Annex 2, section IV, urban, suburban and regional transport services).
• Make accessible the products you use to provide the service, give information on how the service works and, where products are used, on their accessibility features and compatibility with assistive devices, through more than one sensory channel and in text formats usable to create alternative assistive formats, with a non-text alternative, and make websites, related online applications and mobile applications perceivable, operable, understandable and robust; where you offer support services, give accessibility information in accessible modes of communication (Annex 2, section III).
• For electronic communications services, including emergency calls, provide real-time text beside voice, a total conversation with video beside voice, and make emergency calls using voice and text synchronised, and video where provided, and sent to the most appropriate emergency call centre (Annex 2, section IV, electronic communications services).
• For services giving access to audiovisual media services, provide electronic programme guides that are perceivable, operable, understandable and robust and show the available accessibility, and pass on the access services (subtitles for deaf and hard-of-hearing people, audio description, spoken subtitles and Bulgarian sign language translation) in full, with adequate quality, synchronised with sound and video and under user control (Annex 2, section IV, services giving access to audiovisual media services).
• For air, bus, rail and waterborne passenger transport services, give information on the accessibility of vehicles, infrastructure and the built environment and on assistance to people with disabilities, and information for smart ticketing, real-time travel information and additional service information (Annex 2, section IV, passenger transport services).
• For consumer banking services, provide identification methods, electronic signatures, security and payment services that are perceivable, operable, understandable and robust, and keep information understandable without exceeding level B2 of the Common European Framework of Reference for Languages (Annex 2, section IV, consumer banking services).
• For e-books and dedicated software, provide synchronised text and audio where the e-book has audio, do not let the digital files obstruct assistive technologies, give access to content, navigation and layout, allow alternative content delivery and interoperability with assistive technologies, make e-books findable through accessibility metadata, and do not let digital rights management block accessibility features (Annex 2, section IV, e-books and dedicated software).
• For e-commerce services, give information on the accessibility of the products and services on sale where you provide it, make identification, security and payment functionality supplied as part of the service accessible, and provide identification methods, electronic signatures and payment services that are perceivable, operable, understandable and robust (Annex 2, section IV, e-commerce services).
• Prepare the information required by Annex 5 explaining how the service meets the applicable requirements, include it in the general terms or an equivalent document with a general description of the service in accessible formats, make it available to the public in written and oral form including in ways accessible to people with disabilities, and keep it for as long as the service is provided (Art. 50(2) and (3); Annex 5; implements Directive (EU) 2019/882, Art. 13(2)).
• Apply procedures that keep the service in conformity throughout its provision, taking account of changes in how it is provided, in the applicable requirements and in the harmonised standards or technical specifications relied on (Art. 51).
• If the service does not conform, take the corrective measures needed and inform at once the competent authority under Article 54(1) and the competent authorities of the Member States where the service is provided, with details of the non-conformity and the measures taken (Art. 52; implements Directive (EU) 2019/882, Art. 13(4)).
• On a reasoned request, give the competent authority all information needed to show conformity, on paper or electronically, in Bulgarian, within the time it sets, and cooperate on action to bring the service into conformity (Art. 53; Directive (EU) 2019/882, Art. 13(5)).
• A service that meets the accessible-information requirements of the air, rail, maritime and bus passenger rights regulations or of the Railway Transport Act provisions on rail interoperability is treated as meeting the corresponding requirements of Article 46, and any additional requirement of the Act applies in full (Art. 49).
• The accessibility requirements of Article 46(1) and (2), and every obligation connected with meeting them, do not apply to a microenterprise that offers services (a microenterprise employs fewer than 10 persons and has an annual turnover or annual balance sheet total not above EUR 2,000,000 or the equivalent in leva, paragraph 1(1) point 15 of the additional provisions), and the Act does not apply to pre-recorded time-based media and office file formats published before 28 June 2025, online maps and mapping services meant for navigation where essential information is provided in an accessible digital manner, content of third parties that you did not fund, develop or control, or archive content not updated or edited after 28 June 2025 (Arts. 2(3) and 46(3); implements Directive (EU) 2019/882, Art. 2(4) and Art. 4(5)).
• You may keep using until 28 June 2030 products you lawfully used for similar services before that date, let service contracts concluded before 28 June 2025 run unchanged until they expire and for no more than five years after that date, and keep self-service terminals lawfully in use before 28 June 2025 in service until the end of their economically useful life and for no more than 20 years after they entered use (paragraph 4(1) to (3) of the final provisions; Directive (EU) 2019/882, Art. 32).
• Until 28 June 2027 the emergency-call obligations of Annex 2, section IV, letter (a) for electronic communications services may also be met through a relay service provider, including applications built into the operating system of terminal devices or other applications of the economic operator or of a third party (paragraph 4(4) of the final provisions; a national rule, which recital 45 of Directive (EU) 2019/882 allows for: a third-party relay service provider as an alternative for answering emergency communications).

DV br. 31/2025, chl. 3 i prilozhenie 1 ot Zakon za iziskvaniyata za dostapnost na produkti i uslugi (Закон за изискванията за достъпност на продукти и услуги) · Read the law's page

• If you rely on the exception, assess whether compliance with the accessibility requirements would require a significant change that fundamentally alters the nature of the product or service, or impose a disproportionate burden, using the criteria of Annex 1 (net compliance costs against total operating and capital costs and against net turnover, one-off organisational costs and ongoing production and development costs, and expected costs and benefits against the benefit to people with disabilities given the number and frequency of use) and any delegated acts of the European Commission (Art. 3(1) and (2); Annex 1; implements Directive (EU) 2019/882, Art. 14(1) and (2)).
• Document the assessment and keep all relevant results for five years from the last making available of the product or the last provision of the service, and give a copy to the market surveillance authority or the authority checking compliance of services on request (Art. 3(3); Directive (EU) 2019/882, Art. 14(3)).
• If you are a service provider relying on the disproportionate-burden exception, renew the assessment for each category or type of service when the service changes, when the authority asks, and in any event at least every five years (Art. 3(5); Directive (EU) 2019/882, Art. 14(5)).
• Unless you are a microenterprise, send information that you rely on the exception for a specific product or service to the market surveillance authority or the authority checking services of the Member State where the product is placed on the market or the service is provided (Art. 3(6); Directive (EU) 2019/882, Art. 14(8)).
• A microenterprise that deals with products and relies on the exception is exempt from documenting the assessment but must give the market surveillance authority the facts relevant to the assessment on request (Art. 3(4)).
• You may not rely on the disproportionate-burden exception where you receive funding, public or private and other than your own resources, provided to improve the accessibility of the product or service (Art. 3(7); Directive (EU) 2019/882, Art. 14(6)).
• Where the exception is applied, state in the EU declaration of conformity which accessibility requirements are the subject of the exception (Art. 8(2)).

DV br. 31/2025, chl. 54 do 58, 86 do 89 i 91 ot Zakon za iziskvaniyata za dostapnost na produkti i uslugi (Закон за изискванията за достъпност на продукти и услуги) · Read the law's page

• If an authority named in Article 54(1) inspects your service, give it free access to the premises and other sites used to provide the services, provide the Annex 5 information and, where you rely on Article 3, the assessment, hand over on request original accounting, commercial and other books and documents, and assist it in its duties (Art. 55(1) and (2)).
• Where the authority finds that a service does not meet the Act, take the corrective action it requires within the period it sets, and bring the service into conformity when it orders so (Arts. 57(1) and 58(3)).
• Cooperate with the authority's assessment of whether the service meets all the requirements of the Act (Art. 58(2); Directive (EU) 2019/882, Art. 23(1)).
• On a reasoned request, give the information needed to show conformity in Bulgarian within the time the authority sets (Art. 53(1)).

DV br. 31/2025, chl. 67 do 72 ot Zakon za iziskvaniyata za dostapnost na produkti i uslugi (Закон за изискванията за достъпност на продукти и услуги) · Read the law's page

• If an organisation of or for people with disabilities, or the Agency for Persons with Disabilities, sues over an act or commercial practice that breaches the Act, the court may order you to stop or refrain from it (Arts. 67 and 68 point 2; implements Directive (EU) 2019/882, Art. 29(2)).
• If the court finds a breach, it may order you, as manufacturer, importer, distributor or service provider, to publish the judgment or part of it at your own expense in an appropriate way, or to make a public corrective statement to remove the effect of the breach, and to order other appropriate measures to stop the breach (Art. 68 points 1 and 3).
• Expect an organisation of or for people with disabilities to be able to claim damages for harm to the collective interests of people with disabilities, which may be spent only on protecting those interests, and to sue on behalf of two or more identifiable consumers who suffered individual damage from you and gave it written authority (Arts. 69 and 70).
• These actions are not available in procedures for awarding public contracts under the Public Procurement Act (Art. 72; Directive (EU) 2019/882, Art. 29(3)).

Закон за киберсигурност (ЗКС), чл. 21 и 22, изм. с §§ 25 и 26 от Закона за изменение и допълнение на ЗКС, обн. ДВ, бр. 17 от 13.02.2026 г. (English: Cybersecurity Act, Arts. 21 and 22, as substituted by §§ 25 and 26 of the Act Amending and Supplementing the Cybersecurity Act, State Gazette No. 17 of 13 February 2026) · Read the law's page

• Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the security of the network and information systems you use in your core activity or in providing your services, sized to your exposure, your size, and the likelihood and severity of an incident.
• Cover, at minimum: risk-analysis and information-system-security policies, incident-handling procedures, business-continuity and backup management, supply-chain security, security in the acquisition, development and maintenance of your systems including vulnerability handling and disclosure, policies to evaluate the effectiveness of your own risk-management measures, basic cyber-hygiene practices and training, cryptography and encryption policies, human-resources security, access control and asset management, multi-factor or continuous authentication with secured communications and emergency communication systems where appropriate, change management of information assets, and the risk-management and reporting measures that apply to entities of the kind named in Annex I or II and to critical entities under Directive (EU) 2022/2557.
• Have your management body approve and oversee these measures, and have every member of your management body complete cybersecurity training every two years and organise the same training for your staff; a member who fails to do so faces a personal fine of EUR 500 to 5,000.
• This binds you where you are an essential or important entity under Articles 4 and 4a of the Cybersecurity Act: an entity of a kind named in Annex I or II that is at least a medium-sized enterprise, or that falls within one of the Article 4, point 3 cases whatever its size, as the national competent authority determines under Article 16(3), pt. 8. Annex II names a provider of an online marketplace, an online search engine, or a social networking services platform, so such a provider is reached on those terms; the wider sector classes the Act reaches (energy, transport, banking, health, drinking water, digital infrastructure, public administration, manufacturing and others) are reached on the same terms.

Закон за киберсигурност (ЗКС), чл. 23, изм. с § 27 от Закона за изменение и допълнение на ЗКС, обн. ДВ, бр. 17 от 13.02.2026 г. (English: Cybersecurity Act, Art. 23, as substituted by § 27 of the Act Amending and Supplementing the Cybersecurity Act, State Gazette No. 17 of 13 February 2026) · Read the law's page

• Notify СЕРИКС of every significant incident on this clock: an early warning within 24 hours of detecting the significant incident, an incident notification within 72 hours of detecting it (24 hours if you are a trust service provider), an interim report on request, and a final report no later than one month after the incident notification (or, if you have not dealt with the incident by then, an interim report followed by a final report within one month after you have finished handling it) (Article 23(5)).
• State in your early warning, where applicable, whether the incident is suspected to result from unlawful or malicious acts and whether it could have a cross-border effect; update that assessment with an initial severity and impact evaluation in your 72-hour notification; and cover in your final report the incident's scope and impact, its likely cause, your mitigation measures, and any cross-border effect.
• Where appropriate and without undue delay, notify the recipients of your service of a significant incident likely to adversely affect them and of any measures they can take, and of a significant cyber threat and its nature.
• Same penalty tier as the risk-management duty above: up to EUR 10,000,000 or 2 percent of worldwide turnover for an essential entity (not less than EUR 25,000), up to EUR 7,000,000 or 1.4 percent for an important entity (not less than EUR 12,500); this turnover-based sanction does not reach an essential entity that is itself an administrative body.
• This binds you where you are an essential or important entity under Articles 4 and 4a of the Cybersecurity Act, which for an Annex I or II entity means at least a medium-sized enterprise unless an Article 4, point 3 case applies, as the national competent authority determines under Article 16(3), pt. 8; Annex II names a provider of an online marketplace, an online search engine, or a social networking services platform among the digital service providers it reaches expressly; the wider sector classes are reached as on this jurisdiction's companion risk-management-and-governance row.

Закон за киберсигурност (ЗКС), чл. 24 и 27, изм. с §§ 28 и 31 от Закона за изменение и допълнение на ЗКС, обн. ДВ, бр. 17 от 13.02.2026 г. (English: Cybersecurity Act, Arts. 24 and 27, as replaced by §§ 28 and 31 of the Act Amending and Supplementing the Cybersecurity Act, State Gazette No. 17 of 13 February 2026) · Read the law's page

• Where a Council of Ministers decree under Article 24 requires it, use the specific ICT products, services and processes certified under a European cybersecurity certification scheme adopted under Article 49 of Regulation (EU) 2019/881, to show compliance with the Article 22 risk-management measures.
• Stop using a technology that a Council of Ministers decree restricts under Article 27(1) within three years of the decree's adoption, or within the shorter period the decree sets where the risk to national security is high (Article 27(2)).
• If you are an essential or important entity under Articles 4 and 4a of the Cybersecurity Act, including a provider of an online marketplace, an online search engine or a social-networking-services platform, these provisions bind you; the wider sector classes the Act reaches are reached too on the same terms: an entity of a kind named in Annex I or II that is at least a medium-sized enterprise, or that falls within one of the Article 4, point 3 cases whatever its size, as the national competent authority determines under Article 16(3), pt. 8.