Bulgaria: technology regulation at a glance

Framework: EU Markets in Crypto-Assets Regulation (MiCA, Reg. (EU) 2023/1114) implemented nationally via Bulgaria's Markets in Crypto-Assets Act (adopted 20 June 2025; in force 8 July 2025). Financial Supervision Commission (FSC) is the principal competent authority; Bulgarian National Bank (BNB) supervises e-money token issuers. AML supervision sits with the Financial Intelligence Directorate of the State Agency for National Security (FID-SANS); tax administration with the National Revenue Agency (NRA).

Crypto is legal in Bulgaria and is now governed by the EU MiCA framework as transposed by the national Markets in Crypto-Assets Act, in force since 8 July 2025. CASPs must obtain a MiCA licence from the FSC, with a transitional grandfathering period for previously NRA-registered VASPs running until 1 July 2026, after which unlicensed providers must cease activity. Stablecoins (EMTs and ARTs) require dedicated authorisation, and crypto income is taxed under existing personal/corporate income tax rules at the standard 10% flat rate.

Framework: EU AI Act (Regulation (EU) 2024/1689, directly applicable); national coordinator: Ministry of Electronic Governance (MoEG); foundational national document: Concept for the Development of AI in Bulgaria until 2030 (2020)

Bulgaria is directly subject to the EU AI Act, which entered into force on 1 August 2024 and has applied progressively since February 2025. National implementation structures are still being built: Bulgaria designated seven fundamental-rights protection bodies in June 2025 but has not yet appointed a national market surveillance authority or National AI Coordinator, with the full national framework expected only by March 2026. The Ministry of Electronic Governance leads AI policy coordination and an interdepartmental working group is drafting the national regulatory framework.

Framework: EU GDPR (Regulation (EU) 2016/679) directly applicable, supplemented by Bulgaria's Personal Data Protection Act (PDPA, State Gazette No. 17/26.02.2019, in force 2 March 2019); supervised by the Commission for Personal Data Protection (CPDP)

Bulgaria operates under the EU GDPR as the primary binding framework, complemented by the national PDPA which exercises permitted national discretions covering employment data, children's consent for digital services, personal identification numbers, and data of deceased persons. The Commission for Personal Data Protection (CPDP) is the independent supervisory authority, while the Inspectorate to the Supreme Judicial Council holds concurrent competence for judicial-body processing. NIS2 transposition via Cybersecurity Act amendments entered into force in February 2026, integrating incident-reporting pathways with GDPR breach notification.

Framework: Payment Services and Payment Systems Act (PSPSA, in force 2018, transposing EU PSD2), supplemented by BNB Ordinance No 16 on licensing of payment institutions and e-money institutions; supervised by the Bulgarian National Bank (BNB). EU regulations (MiCA, GDPR) and CCD2 apply as baseline.

Bulgaria operates a clear, dedicated licensing regime for digital payments and fintech: the BNB authorises and supervises payment institutions (PIs), electronic money institutions (EMIs) and payment system operators under the PSPSA, which transposes PSD2. Licences passport across the EEA, open-banking APIs are live, and a SEPA-compliant instant-payment rail (BLINK/BISERA6) operates 24/7. Bulgaria adopted the euro on 1 January 2026, integrating its payment infrastructure with the Eurosystem (TARGET/TIPS).

Framework: Article 24p, Foreigners in the Republic of Bulgaria Act (national assembly amendment adopted 18 June 2025); implementing Council of Ministers regulations in force 11 December 2025; administered by the Migration Directorate (Ministry of Interior) and consular network (Ministry of Foreign Affairs)

Bulgaria launched a dedicated Digital Nomad Residence Permit on 20 December 2025, codified under the new Article 24p of the Foreigners in the Republic of Bulgaria Act. Third-country nationals who work remotely for employers, clients, or companies registered outside the EU/EEA/Switzerland may obtain a one-year permit (renewable once for a maximum of two years) by demonstrating prior-year annual income of at least EUR 31,000. A separate residency-by-investment (Golden Visa) programme requiring EUR 512,000 in regulated funds also remains open and was bolstered by Bulgaria's Schengen accession on 1 January 2025.

Framework: EU Digital Services Act (Regulation (EU) 2022/2065), implemented nationally via amendments to the Electronic Communications Act designating the Communications Regulation Commission (CRC) as Digital Services Coordinator; plus EU GDPR and the Audiovisual Media Services framework (Council for Electronic Media)

Bulgaria's online content/safety regime is anchored by the directly-applicable EU Digital Services Act, with national implementing rules now in force. Amendments to the Electronic Communications Act adopted on 6 November 2025 (effective 25 November 2025) designate the Communications Regulation Commission (CRC) as the Digital Services Coordinator and competent authority, alongside the Council for Electronic Media (video-sharing platforms) and the Commission for Personal Data Protection. Bulgaria has no separate national age-verification law for online content; platform liability and content-moderation duties flow from the DSA's harmonised EU framework.

Framework: Bulgarian Cybersecurity Act (Закон за киберсигурността), as amended 5 February 2026 (State Gazette 13 February 2026), transposing EU Directive 2022/2555 (NIS2); competent authority: Ministry of Electronic Governance (Министерство на електронното управление)

Bulgaria transposed the NIS2 Directive by amending its Cybersecurity Act, adopted by Parliament on 5 February 2026 and in force from 13 February 2026, after infringement proceedings and a May 2025 CJEU referral by the European Commission for late transposition. The amended Act introduces a dual classification of 'essential' and 'important' entities across 18 sectors, mandates tiered incident-reporting to sectoral CSIRTs, and imposes GDPR-scale administrative fines. In several areas Bulgaria opted for stricter national rules than the NIS2 minimum, notably expanding food-sector obligations beyond the Directive's scope.

Framework: Commerce Act (Търговски закон); Registry Agency / EPZEU Commercial Register; Ministry of Economy and Industry; Point of Single Contact (PSC) portal, psc.egov.bg

Bulgaria imposes no foreign-ownership limits: non-residents may own 100% of an OOD/EOOD (LLC) or AD (JSC), act as sole director, and register entirely online via the EPZEU portal with a power of attorney. The statutory minimum capital for an OOD/EOOD is €1 (previously BGN 2, converted upon Bulgaria's eurozone accession on 1 January 2026), and routine registrations are completed within 1-3 business days. Corporate income tax is a flat 10%, among the lowest in the EU.