BulgariaCybersecurity Act, Incident and Cyber-Threat Reporting Obligations (Zakon za kibersigurnost, ZKS)
Закон за киберсигурност (ЗКС) чл. 23, изм. с § 27 от Закона за изменение и допълнение на ЗКС, обн. ДВ, бр. 17 от 13.02.2026 г. (English: Cybersecurity Act, Art. 23, as substituted by § 27 of the Act Amending and Supplementing the Cybersecurity Act, State Gazette No. 17 of )
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds you where you are an essential or important entity designated under the Cybersecurity Act's sector annexes, which name a provider of an online marketplace, an online search engine, or a social networking services platform among the digital service providers it reaches expressly; the wider sector classes are reached as on this jurisdiction's companion risk-management-and-governance row.
- Notify СЕРИКС of every significant incident on this clock: an early warning within 24 hours of detecting the significant incident, an incident notification within 72 hours of detecting it (24 hours if you are a trust service provider), an interim report on request, and a final report no later than one month after the incident notification (or, if you have not dealt with the incident by then, an interim report followed by a final report within one month after you have finished handling it) (Article 23(5)).
- State in your early warning, where applicable, whether the incident is suspected to result from unlawful or malicious acts and whether it could have a cross-border effect; update that assessment with an initial severity and impact evaluation in your 72-hour notification; and cover in your final report the incident's scope and impact, its likely cause, your mitigation measures, and any cross-border effect.
- Where appropriate and without undue delay, notify the recipients of your service of a significant incident likely to adversely affect them and of any measures they can take, and of a significant cyber threat and its nature.
- Same penalty tier as the risk-management duty above: up to EUR 10,000,000 or 2 percent of worldwide turnover for an essential entity (not less than EUR 25,000), up to EUR 7,000,000 or 1.4 percent for an important entity (not less than EUR 12,500); this turnover-based sanction does not reach an essential entity that is itself an administrative body.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Chapter Three of the amended Cybersecurity Act (Arts. 27i, 28 and 29) makes an Article 23 reporting failure an administrative offence carrying a fine or property sanction imposed by the competent authority, not a criminal offence; the Act attaches criminal liability to no reporting failure.
Penalty structure
Article 29(2), as substituted by Paragraph 36, sets an essential entity's sanction for an Article 22 or 23 failure at up to EUR 10,000,000 or up to 2 percent of the worldwide annual turnover of the undertaking to which the entity belongs, whichever is higher, but not less than EUR 25,000; this is the same penalty provision that governs the companion risk-management row. Article 29(3) sets an important entity's sanction at up to EUR 7,000,000 or up to 1.4 percent of turnover, whichever is higher, but not less than EUR 12,500. Article 29(5) exempts an essential entity that is itself an administrative body from the Article 29(2) turnover-based sanction. Article 51 of the amending Act's transitional provisions halved every fine and sanction under this chapter for a violation committed before .
- Rule
- Higher of
- As of
- Minimum
- 25,000
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The national competent authority the Council of Ministers designates per sector under Article 16(1) of the Cybersecurity Act, with СЕРИКС (the sectoral Computer Security Incident Response Team under Art. 18(1)) receiving and acknowledging the notification.
Settledness
- As of
- Open questions
- СЕРИКС is organised per sector under Article 18, and the amending Act requires each national competent authority to notify the European Commission of its sectoral СЕРИКС's identifying details. Is there a single national point of contact an entity spanning several sectors reports to, or must a multi-sector entity notify each sectoral СЕРИКС separately?
What this law does
Article 23 of the Cybersecurity Act, as substituted by Paragraph 27 of the amending Act, requires every essential and important entity to notify СЕРИКС of every significant incident. СЕРИКС is the sectoral Computer Security Incident Response Team the Act defines at Art. 18(1). The notification runs on a graduated clock.
An early warning is due within 24 hours of becoming aware of the incident, stating where applicable whether the incident is suspected to result from unlawful or malicious acts and whether it could have a cross-border effect. An incident notification is due within 72 hours, updating that assessment with an initial severity and impact evaluation, or within 24 hours instead of 72 where the notifying entity is a trust service provider. An interim report is due on СЕРИКС's request.
A final report is due no later than one month after the incident notification, covering the incident's scope and impact, the likely threat type or cause, the mitigation measures applied and ongoing, and any cross-border effect. Where the entity has not resolved the incident by the one-month mark, it files an interim report instead and a final report within one month of resolving it.
Where appropriate and without undue delay, the entity must also notify the recipients of its service of a significant incident likely to adversely affect them and of any measures or safeguards they can take, and of a significant cyber threat and its nature; notification to recipients may be delayed, with the competent authority's consent, where it would jeopardise the incident's investigation. СЕРИКС must acknowledge the early warning within 24 hours, except where objectively impossible, and, on request, provide operational guidance or further technical support.
This article transposes NIS2 Article 23, and applies, among the sector classes the Act's annexes name, to a provider of an online marketplace, an online search engine, or a social networking services platform.
When LexLint raises it
When your app profile says your app handles health records, runs an essential service, operates a social platform, is a bank or is a securities firm.
Back to the example · Lint your app
Page updated .