Bulgaria's Parliament Considers Amendments to the Cybersecurity Law in Second Reading

According to the approved program of today's plenary session, the National Assembly of Bulgaria will hold a discussion in second reading of the amendments to the Cybersecurity Act, which are included as the second item on the agenda.

These amendments were approved in first reading in February 2025 and represent a step towards fulfilling Bulgaria's obligations to transpose into national law by October 17, 2024, the requirements of the European directive on measures to ensure a high common level of cybersecurity, covering the protection of network and information systems (NIS), better known as "NIS2 Directive".

As noted in the explanatory part of the bill, prepared by the Council of Ministers, which is the initiator of the amendments, the document, in accordance with the "NIS2 Directive", creates the conditions for achieving the overall goal of increasing the level of protection against incidents, risks and threats to network and information security in the European Union.

The main goal of the bill is to ensure the legal integration of the Bulgarian cybersecurity system with the European one, including by implementing improved European requirements, for example, in the field of risk assessment. The amendments also cover issues of incident reporting, testing, raising awareness and forming an understanding that cyber incidents and the lack of an adequate response to them can create a threat to the stability of both public and private structures.

The draft law expands the range of affected sectors from eight to eighteen. These include: energy, transport, the banking sector, financial market infrastructure, healthcare, drinking water, wastewater disposal, digital infrastructure, management of information and communication technology services (between enterprises), public administration, the space sector, as well as other critical areas, such as postal and courier services, waste management, production, preparation and distribution of chemicals, production, processing and distribution of food products, industrial production, digital service providers and scientific research.

The first item on today's parliamentary agenda is the consideration and ratification of the "Multilateral Agreement between Competent Authorities on the Automatic Exchange of Information on Crypto Assets" and the "Addendum to the Multilateral Agreement between Competent Authorities on the Automatic Exchange of Information on Financial Accounts". With the ratification and entry into force of these two acts, it will be possible to exchange data with partner jurisdictions outside the EU, the report of the Foreign Policy Committee of the National Assembly emphasizes.

It is expected that on the basis of these agreements, Bulgaria will receive extremely important information necessary to determine the tax obligations of Bulgarian residents and companies on income and assets they own abroad.