BulgariaCybersecurity Act (Zakon za kibersigurnost, ZKS), Certified ICT Products and Restriction of Risky Technologies
Закон за киберсигурност (ЗКС) чл. 24 и 27, изм. с §§ 28 и 31 от Закона за изменение и допълнение на ЗКС, обн. ДВ, бр. 17 от 13.02.2026 г. (English: Cybersecurity Act, Arts. 24 and 27, as replaced by §§ 28 and 31 of the Act Amending and Supplementing the Cybersecurity Act, State Gazette No. 17 of )
In force since .
A product security requirements rule binding public and private bodies.
- Private right of action
- No
- Obligation class
- Security
As of .
What it requires
- If you are an essential or important entity under Articles 4 and 4a of the Cybersecurity Act, including a provider of an online marketplace, an online search engine or a social-networking-services platform, these provisions bind you; the wider sector classes the Act reaches are reached too, by declaring that you are an essential or important entity.
- Where a Council of Ministers decree under Article 24 requires it, use the specific ICT products, services and processes certified under a European cybersecurity certification scheme adopted under Article 49 of Regulation (EU) 2019/881, to show compliance with the Article 22 risk-management measures.NIST CSF 2.0ID.RA-09
- Stop using a technology that a Council of Ministers decree restricts under Article 27(1) within three years of the decree's adoption, or within the shorter period the decree sets where the risk to national security is high (Article 27(2)).NIST CSF 2.0PR.PS-02
These lines are LexLint's reading of the law's text, as of .
In the frameworks
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does Article 27(1) of the Cybersecurity Act, which has the Cybersecurity Council base its proposal for a restricting decree on the information provided under Article 26(2) about coordinated Union-level risk assessments, allow a decree that restricts a technology or supply chain no coordinated assessment has covered?
- When a decree under Article 27(1) restricts a technology only in part, for example for certain uses or functions, does Article 27(2), which obliges an entity already using 'a technology that is restricted' to stop using it within three years of the decree's adoption, require the entity to stop all use or only the restricted use?
What this law does
Article 24 of the Cybersecurity Act, as replaced by Paragraph 28 of the Amending Act promulgated in State Gazette issue 17 of , lets the Council of Ministers, on the Cybersecurity Council's proposal, require essential and important entities by decree to use specific ICT products, services and processes certified under a European cybersecurity certification scheme adopted under Article 49 of Regulation (EU) 2019/881, to show compliance with the Article 22 risk-management measures.
Article 27(1), as replaced by Paragraph 31, has the Cybersecurity Council propose to the Council of Ministers a decree restricting the use by the entities under Articles 4 and 4a of specific technologies or critical ICT supply chains. Under Article 27(2), an entity that already uses a technology such a decree restricts must stop using it within three years of the decree's adoption, or within the shorter period the decree sets where the risk to national security is high.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform, is a bank or is a securities firm.