The European Commission has closed an infringement case against Bulgaria over the NIS2 cybersecurity directive, the innovation and digital transformation ministry says. The ministry got the notice today.
The Commission opened case No. 2024/0257 after Bulgaria was late telling Brussels how it planned to bring in Directive (EU) 2022/2555 in full. It closed the case after Bulgaria passed changes to its cybersecurity law and told Brussels on March 6, 2026, that it had fully adopted the directive.
The changes widen the cybersecurity rules to cover more activities and tighten the rules on managing risk and reporting cyber incidents. They apply to services in energy, transport, health care, digital infrastructure and government bodies. The aim is to protect people and businesses better and make key services in these fields more resilient.
The ministry calls the closing of the case an important result of its work and that of other bodies on Bulgaria's EU commitments on cybersecurity.
Earlier the same day, the European Commission gave updates on six infringement cases against Bulgaria. In two of them, it is referring the country to the EU Court of Justice.