Skip to main content

    AI by country · Central and Eastern Europe

    AI in Bulgaria: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Bulgaria know before starting with AI?

    Bulgaria applies the EU GDPR, its Personal Data Protection Act, and the EU AI Act directly. The government had not designated an AI Act market surveillance authority when we checked, and a bill on the use and development of AI from a group of MPs has been before the National Assembly since 24 September 2026. A company should map where its AI makes decisions about people and check whether any system is high-risk.

    At a glance

    Bulgaria at a glance

    Key facts about Bulgaria
    Data protection lawEU GDPR (applies since 25 May 2018) and the Personal Data Protection Act, amended in 2019 to implement it, in force
    RegulatorCommission for Personal Data Protection (CPDP); AI Act market surveillance authority not yet confirmed
    AI policyConcept for the Development of AI in Bulgaria until 2030 (December 2020). AI bill before Parliament since September 2026; no national AI law as of 29 October 2026
    Time zoneEET, UTC+2 in winter and UTC+3 in summer (India is 3.5 or 2.5 hours ahead)
    CurrencyEUR (euro)
    Business languageBulgarian, with English common in technology firms

    Why now

    Why Bulgaria is worth watching

    Each point links to the document it comes from.

    • Eurostat reports that 8.55% of Bulgarian enterprises with 10 or more staff used AI in 2025, against an EU average of 19.95%.[1]

    • The government approved the Concept for the Development of Artificial Intelligence in Bulgaria until 2030 on 16 December 2020. It covers research capacity, education, data as a resource and AI in key sectors.[10]

    • Council of Ministers Decision No. 398 of 18 June 2025 named the bodies that protect fundamental rights under the AI Act, according to the Ministry of e-Government.[8]

    • In December 2025 the ministry said a decision naming the Bulgarian Accreditation Service as notifying authority was ready, and a draft on market surveillance authorities had not yet gone to inter-ministry review.[8]

    • A group of MPs introduced a bill on the use and development of artificial intelligence on 24 September 2026. The Committee on Innovation and Digital Transformation leads on it.[9]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    General Data Protection Regulation (EU) 2016/679 and the Personal Data Protection Act

    In force2019People have a right not to be subject to a decision based solely on automated processing with legal or similarly significant effects, with exceptions for contracts, law and explicit consent (GDPR Article 22). High-risk processing needs a data protection impact assessment first, and breaches go to the CPDP within 72 hours where feasible. The Bulgarian act was amended by State Gazette No. 17 of 26 February 2019 to sit alongside the GDPR.[2]

    EU Artificial Intelligence Act, Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744

    Phased2024Bans on certain AI practices have applied since 2 February 2025 and rules for general-purpose AI models since 2 August 2025. Most other rules, including transparency duties, apply from 2 August 2026. The Digital Omnibus on AI, adopted and in force since 27 July 2026, moved high-risk rules to 2 December 2027 for Annex III uses such as hiring and credit, and to 2 August 2028 for AI in regulated products.[4]

    Bill on the use and development of artificial intelligence (No. 52-654-01-151)

    Draft2026It was introduced by MPs on 24 September 2026 and sent to several committees. A policy tracker reports that it would split AI Act market surveillance among sector regulators. The bill text we found is a scanned file, so we do not state its detailed duties or fines.[9]

    Where AI fits first

    Where AI fits first

    Software and IT outsourcing

    Code review support, test generation and internal knowledge search.

    A firm that places an AI system on the EU market under its own name is a provider under the AI Act and carries the provider duties.[3]

    Banking and insurance

    Document checks, fraud alerts and Bulgarian-language customer service, with staff reviewing any refusal.

    Credit scoring is an Annex III high-risk use, with rules from 2 December 2027. GDPR Article 22 applies already.[4]

    Manufacturing

    Visual quality inspection and predictive maintenance.

    AI built into products covered by EU product law, such as machinery, falls under high-risk rules from 2 August 2028.[4]

    Your first steps

    Your first steps

    1. List every AI tool in use and note which ones make or shape decisions about people.
    2. Check each use against the AI Act bans and the Annex III high-risk list, and plan for the 2 December 2027 and 2 August 2028 dates.
    3. Run a data protection impact assessment before AI touches credit, hiring, health or monitoring of staff.
    4. Label chatbots and AI-generated content where the AI Act transparency rules require it.
    5. Give staff basic AI training, which the amended AI Act asks providers and deployers to support.
    6. Follow the AI bill in the National Assembly and any Council of Ministers decision naming market surveillance authorities.
    7. Keep a breach process that can reach the CPDP within 72 hours.

    AI services for Bulgaria

    AI consulting and development for teams in Bulgaria

    We work remotely with companies in Bulgaria, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. Indian hours of 9:30 to 18:30 at UTC+5:30 are 04:00 to 13:00 UTC. In winter Bulgaria is on UTC+2, so a 9:00 to 17:00 Bulgarian day overlaps from 09:00 to 15:00, about 6 hours; in summer, on UTC+3, the overlap is 09:00 to 16:00, about 7 hours.

    Questions

    Common questions about AI in Bulgaria

    Does Bulgaria have its own AI law?

    Not as of 29 October 2026. The EU AI Act applies directly. A bill on the use and development of AI was introduced on 24 September 2026 and was still at committee stage when we checked.

    Who supervises AI in Bulgaria?

    We could not confirm a designated market surveillance authority. The European Commission list we read showed none for Bulgaria. The CPDP supervises personal data, including data used by AI.

    When do the high-risk AI rules start?

    After the EU Digital Omnibus on AI, from 2 December 2027 for Annex III uses such as hiring, education and credit, and from 2 August 2028 for AI in regulated products.

    What are the fines?

    Under GDPR, up to EUR 20 million or 4% of worldwide turnover. Under the AI Act, breaches of the bans can reach EUR 35 million or 7% of worldwide turnover. National AI Act penalty rules depend on the pending law.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] Eurostat, 2026-06-15. Enterprises using artificial intelligence technologies (isoc_eb_ai), 20…(ec.europa.eu)
      Full title and what we used it for

      Enterprises using artificial intelligence technologies (isoc_eb_ai), 2025 data. Primary statistics, queried on 29 October 2026. Used for the 8.55% Bulgarian figure and the EU figure of 19.95% from the same dataset.

    2. [2] Official Journal of the European Union, 2016-04-27. Regulation (EU) 2016/679 (General Data Protection Regulation)(publications.europa.eu)
      Full title and what we used it for

      Regulation (EU) 2016/679 (General Data Protection Regulation). Primary text, read via the EU Publications Office because EUR-Lex blocked automated access. Used for Articles 22, 33, 35 and 83.

    3. [3] Official Journal of the European Union, 2024-07-12. Regulation (EU) 2024/1689 (Artificial Intelligence Act)(publications.europa.eu)
      Full title and what we used it for

      Regulation (EU) 2024/1689 (Artificial Intelligence Act). Primary text. Used for Article 113 application dates, provider duties and Article 99 fines.

    4. [4] Official Journal of the European Union, 2026-07-24. Regulation (EU) 2026/1744 (Digital Omnibus on AI)(publications.europa.eu)
      Full title and what we used it for

      Regulation (EU) 2026/1744 (Digital Omnibus on AI). Primary text. Used for the high-risk dates of 2 December 2027 and 2 August 2028.

    5. [5] European Commission, 2026-10-29. AI Act: regulatory framework for AI(digital-strategy.ec.europa.eu)
      Full title and what we used it for

      AI Act: regulatory framework for AI. Primary. Used for the timeline and the AI Omnibus entry into force on 27 July 2026.

    6. [6] European Commission, 2026-09-07. Market surveillance authorities under the AI Act(digital-strategy.ec.europa.eu)
      Full title and what we used it for

      Market surveillance authorities under the AI Act. Primary. No Bulgarian authority was listed on the version we read.

    7. [7] Pernik Administrative Court (justice.bg), 2019-11-26. Zakon za zashtita na lichnite danni (Personal Data Protection Act), con…(pernik-adms.justice.bg)
      Full title and what we used it for

      Zakon za zashtita na lichnite danni (Personal Data Protection Act), consolidated copy. Copy of the law hosted by a court. Used for the original State Gazette No. 1 of 4 January 2002 and the GDPR amendment in State Gazette No. 17 of 26 February 2019. The CPDP site had a certificate error.

    8. [8] Ministry of e-Government, via the government access-to-information platform, 2025-12-22. Reply to access-to-information request No. 17911(pitay.government.bg)
      Full title and what we used it for

      Reply to access-to-information request No. 17911. Primary ministry reply. Used for Decision No. 398 of 18 June 2025 and the status of draft decisions on the notifying and market surveillance authorities as of December 2025.

    9. [9] National Assembly of the Republic of Bulgaria, 2026-09-24. Bill on the use and development of artificial intelligence, No. 52-654-…(parliament.bg)
      Full title and what we used it for

      Bill on the use and development of artificial intelligence, No. 52-654-01-151. Primary register entry. Used for the date, sponsors and committees. The split of market surveillance is from Digital Policy Alert, a secondary tracker.

    10. [10] OECD.AI Policy Navigator, 2025-12-25. Concept for the development of AI in Bulgaria until 2030(oecd.ai)
      Full title and what we used it for

      Concept for the development of AI in Bulgaria until 2030. Policy database entry supplied by the national contact point. Used for the approval date of 16 December 2020 and the objectives. The ministry page linked from it did not load.

    This is general information, not legal advice. Bulgaria's AI Act authorities and national penalty rules were not settled when we checked. Check with a qualified Bulgarian lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Bulgaria?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score