CRA Compliance in Bulgaria

Bulgaria's CRA national competent authority functions are coordinated through SEGA and the National Cybersecurity Coordination Centre. Market surveillance for consumer and industrial products is coordinated with the State Agency for Metrological and Technical Surveillance (DAMTN) and the Commission for Consumer Protection (KZP). Bulgaria is developing its national cybersecurity regulatory framework under NIS2 transposition, and CRA implementing legislation will build on this foundation. The specific allocation of CRA NCA functions — whether to SEGA or a future dedicated cybersecurity authority — is to be confirmed through national implementing legislation expected ahead of December 2027.

Bulgarian manufacturers are expected to submit Article 14 notifications to CERT Bulgaria through SEGA's cybersecurity reporting channels. The Article 14 obligation requires an early warning within 24 hours of detecting active exploitation and a full notification within 72 hours. Bulgaria's NIS2 transposition framework designates the competent authority and CSIRT for incident coordination, and CRA Article 14 procedures will follow these designated channels. Manufacturers should confirm the current Article 14 reporting mechanism with SEGA or the competent authority, as Bulgaria's national implementing legislation may refine reporting channels ahead of December 2027.

Market surveillance for CRA products in Bulgaria is coordinated between SEGA, DAMTN, and KZP. The full CRA penalty regime applies: up to €15 million or 2.5% of global annual turnover for violations of essential cybersecurity requirements. Bulgaria has been building market surveillance capacity and DAMTN has conducted CE marking enforcement activities under EU product safety regulations. Bulgarian manufacturers should maintain technical documentation accessible for surveillance inspection and should monitor SEGA communications for updated CRA enforcement guidance.

SEGA publishes cybersecurity guidance for Bulgarian businesses through the e-Government portal. The Bulgarian Small and Medium Enterprises Promotion Agency (BSMEPA) supports SME investments in cybersecurity through EU-funded programmes. The Bulgarian Academy of Sciences provides technical research expertise relevant to conformity assessment activities. The Bulgarian Chamber of Commerce and Industry (BCCI) provides regulatory compliance guidance for manufacturing members. EU Cohesion Funds and the Recovery and Resilience Facility provide Bulgaria with resources for digital and cybersecurity infrastructure investments, including manufacturer support programmes.