EU AI Act in Bulgaria: Authorities, Enforcement, and What Companies Must Do

If you are looking for the single Bulgarian authority that enforces the EU AI Act, here is the honest answer as of mid-2026: Bulgaria has not yet designated one. The country missed the 2 August 2025 deadline in Article 70 for naming its national competent and market surveillance authorities, and the key designations still exist only as unadopted drafts. That does not pause your obligations — the EU AI Act, Regulation (EU) 2024/1689, applies directly in Bulgaria regardless — but it does change how a Bulgarian company should plan.

This guide sets out what is firmly in place, what is still pending, how the timeline reads after the Digital Omnibus, and the practical steps for Bulgarian providers and deployers.

---

A Regulation, Not a Directive: Obligations Apply Without Bulgarian Law

The EU AI Act is a Regulation. It entered into force on 1 August 2024 and applies directly in every Member State — including Bulgaria — under Article 288 of the Treaty on the Functioning of the European Union. Bulgarian companies do not wait for a national statute before the duties bite. Article 5's prohibited practices have applied since 2 February 2025, the Article 4 AI literacy duty since the same date, and the Chapter V GPAI obligations since 2 August 2025.

What Bulgaria still has to provide is the national enforcement scaffolding: which body investigates, which imposes fines, who is the single point of contact for the EU AI Office, and how penalties are administered under Bulgarian procedure. That scaffolding is what is missing.

---

Who Enforces the EU AI Act in Bulgaria? (The Honest Status)

As of early 2026, the lead body coordinating Bulgaria's implementation is the Ministry of Electronic Governance (Министерство на електронното управление), with a coordinating role also assigned to the Ministry of Economy and Energy. But — by the Ministry's own account, given in a public-access-to-information response — the country was still "in the preparatory stage," with no final decision on the market surveillance authority, the high-risk oversight model, or the national sanctions regime.

Here is what is settled versus pending:

The one part that is complete is the Article 77 list of fundamental-rights protection bodies, set by Council of Ministers Decision No. 398 of 18 June 2025. These seven include the National Ombudsman, the Central Election Commission, the Commission for Protection against Discrimination, the Commission for Personal Data Protection (CPDP — Комисия за защита на личните данни), the Commission for Consumer Protection, the State Agency for Child Protection, and the General Labour Inspectorate.

A Word on the CPDP

It is tempting to assume Bulgaria's data protection authority, the CPDP, will end up the AI Act's lead supervisor — that pattern holds in several Member States. It is not confirmed for Bulgaria. The CPDP's designated AI Act role so far is narrow: it is one of the seven Article 77 fundamental-rights bodies, alongside its standing GDPR remit. Whether it becomes a market surveillance authority for high-risk AI is exactly the kind of decision still sitting in the unadopted draft. Treat any claim that "the CPDP enforces the AI Act in Bulgaria" with caution — it does not, yet.

GPAI Is Supervised From Brussels, Not Sofia

One thing does not depend on Bulgaria finishing its set-up: providers of general-purpose AI models are supervised directly by the EU AI Office in Brussels, not by any national authority. Bulgarian foundation-model developers should engage with the AI Office's codes of practice process rather than wait for a Bulgarian regulator.

---

National Strategy and Implementing Legislation

Bulgaria has a national AI strategy — the "Concept for the Development of Artificial Intelligence in Bulgaria until 2030," adopted in December 2020 — but it predates the Act and is a policy document, not implementing legislation. A standalone draft AI law has been tabled in Parliament by opposition members, proposing a national coordinator and an ethics body, but it is a private-member's bill, not government legislation, and has not been adopted. The government's own framework was targeted for early 2026 and was not in place when the application window opened.

For a Bulgarian business, the takeaway is concrete: do not plan around a Bulgarian implementing act that does not yet exist. Plan against the Regulation's own text and dates.

---

The EU AI Act Timeline as It Applies in Bulgaria

Two cautions belong on every Bulgarian compliance plan.

First, the high-risk deadline is no longer 2 August 2026. Under the Digital Omnibus — the Commission's amendment package, for which Parliament and Council reached political agreement on 6–7 May 2026 — stand-alone high-risk Annex III systems are deferred to 2 December 2027, and product-embedded high-risk systems to 2 August 2028. This deferral is now adopted: the European Parliament approved it on 16 June 2026 and the Council formally adopted it on 29 June 2026, with entry into force on Official Journal publication, expected before 2 August 2026. Stand-alone high-risk Annex III obligations now apply from 2 December 2027.

Second, the gaps in Bulgaria's national set-up do not delay the dates that have already arrived. Article 5 prohibitions and the GPAI duties are live now, and the Commission — not a Bulgarian authority — already enforces the GPAI layer.

---

Penalties: What Bulgarian Companies Face

The fine ceilings come from Article 99 of the Regulation and apply Bulgaria-wide. There are exactly three tiers — and Bulgaria has not yet set its own national penalty procedure, so no Bulgaria-specific figures exist to cite.

• €35,000,000 or 7% of total worldwide annual turnover (whichever is higher) — for breaching the Article 5 prohibitions. Art 99(3).
• €15,000,000 or 3% — for most other obligations: high-risk requirements (Articles 9–15), provider duties (Article 16), deployer duties (Article 26), and Article 50 transparency. Art 99(4).
• €7,500,000 or 1% — for supplying incorrect, incomplete, or misleading information to authorities or notified bodies. Art 99(5).

For SMEs and start-ups, Article 99(6) caps the fine at the lower of the fixed sum or the percentage. A Bulgarian company with €8M turnover cannot face a €15M fine for a high-risk breach — 3% of €8M is €240,000, and that is the ceiling. Note the third tier is 1%, never 1.5%; there is no 1.5% tier anywhere in the Regulation. GPAI model providers face a separate instrument — up to €15 million or 3% under Article 101, imposed by the Commission.

---

Worked Example: A Bulgarian SaaS Deployer

Consider Veliko Soft EOOD, a fictional Plovdiv software company — about 70 employees, ~€9M turnover — that has rolled out an AI CV-screening tool to filter applicants for its own hiring.

CV-screening for recruitment is an Annex III employment use case, so on the high-risk side Veliko Soft is a deployer under Article 26: it must run human oversight under Article 14, follow the provider's instructions, and keep records. Because the system profiles candidates, the Article 6(3) "no significant risk" filter will not rescue it from high-risk status — profiling of natural persons is always high-risk.

What about enforcement? With no Bulgarian market surveillance authority yet designated, there is no national regulator currently positioned to audit Veliko Soft's high-risk file — but that is cold comfort. The high-risk obligations attach to the system regardless of whether the regulator is ready, and a Bulgarian authority will be designated, with retrospective scrutiny of records that should already exist. The Article 5 prohibitions (and the Commission-enforced GPAI duties, if Veliko Soft built on a third-party model) are live today. The right posture is to build the inventory, classification, and human-oversight controls now — not to treat the empty regulator slot as a holiday.

---

How Confir Helps

Bulgarian teams face the same documentation-heavy obligation set as everyone else, with the added friction that there is no national guidance to lean on yet. Confir is an EU-hosted compliance tool built for exactly this work. Its classification engine is deterministic and rule-based — it encodes Articles 5 and 6 with Annex III logic as explicit rules, so the same intake always yields the same finding with a human-readable explanation of which rule fired. It builds the AI inventory, derives the provider/deployer role, generates the Annex IV technical documentation and the Article 27 FRIA, and runs a structured assessment across risk classification, data robustness, transparency and human oversight, and post-market monitoring — so a Bulgarian company is ready the day its authority switches on.

---

What Bulgarian Companies Should Do Now

Immediately: Audit any AI that could be an Article 5 prohibited practice — social scoring, untargeted facial-image scraping, biometric categorisation by sensitive traits, or workplace/education emotion recognition. Those prohibitions bind today, enforced under Article 99 once Bulgaria's procedure exists, and the GPAI layer is enforced now by the Commission.

Before 2 August 2026: Prepare for Article 50 transparency — label AI chatbots, mark synthetic content, and disclose deepfakes. This date was not deferred.

Through 2026–2027: Build the AI inventory, classify each system, apply the Article 6(3) filter, assign roles, and start the high-risk documentation. Build against 2 December 2027, the now-adopted high-risk deadline.

Ongoing: Track the designation. Watch for the Council of Ministers decision that names Bulgaria's market surveillance authority and single point of contact — that is the moment the abstract becomes concrete, and the first enforcement priorities will follow it.

---

Related guides

• EU AI Act fundamentals
• Compliance for small businesses
• Article 5: prohibited practices
• Article 99 penalties explained
• The Digital Omnibus, defined
• Market surveillance authority, defined
• Extraterritorial scope of the Act