The rules an AI system has to meet

The EU's core AI law: prohibited practices, AI literacy, transparency, and requirements for high-risk systems and general-purpose models.

02.02.2025

Prohibited practices and AI literacy

02.08.2025

Obligations for general-purpose AI models

02.08.2026

Transparency: disclosing chatbots, labelling generated content

02.12.2026

Machine-readable marking for generative systems placed on the market before 2 Aug 2026 · upcoming

02.12.2027

High-risk systems under Annex III · upcoming

02.08.2028

High-risk systems under Annex I (in regulated products) · upcoming

Amends the AI Act: postpones the high-risk deadlines, clarifies the AI literacy duty and adds a new prohibition.

27.07.2026

In force

Lawful basis, data minimisation, security and the rights of people whose data the system processes. Affects almost every business AI system.

25.05.2018

Applies

The EU–US Data Privacy Framework and standard contractual clauses: the legal basis for sending data to cloud models outside the EEA.

When: When the model or cloud processes data outside the EEA (for example in the US).

27.06.2021

Standard contractual clauses (2021/914)

10.07.2023

EU–US Data Privacy Framework (2023/1795)

Cookies and access to information on the user's device. Implemented in Bulgaria through the Electronic Communications Act.

When: When the AI runs on a website or app: chat widgets, cookies, tracking.

31.10.2003

Transposition deadline

Cyber-risk management, supply-chain security and incident reporting. In Bulgaria, through the Cybersecurity Act.

When: When the client is an essential or important entity under NIS2, or supplies one.

18.10.2024

Applies in the EU

Access to and sharing of data from connected products, fair contract terms and switching between cloud providers.

When: When the system uses data from connected devices or cloud data-processing services.

12.09.2025

Applies

12.09.2026

Design requirements for new connected products

Mandatory cybersecurity requirements for products with digital elements, including software, across their whole life cycle.

When: When the AI solution is placed on the market as a product (software or device).

11.09.2026

Reporting of actively exploited vulnerabilities and incidents

11.12.2027

All requirements · upcoming

Explicitly covers software and AI systems. Until Bulgaria transposes it, Section IV (Art. 130 ff.) of the Consumer Protection Act applies.

When: When the system is offered as a product and could cause damage.

09.12.2026

Transposition deadline; for products placed on the market after this date · upcoming

The text-and-data-mining exception (Art. 4) and rightholders' right to opt out. In Bulgaria, through the Copyright Act.

When: When the system is trained or fine-tuned on third-party content.

07.06.2021

Transposition deadline

Content moderation, transparency of recommender systems and protection of users online.

When: When the system is part of an online platform or hosting service.

17.02.2024

Fully applicable

Accessibility requirements for products and services for people with disabilities, including chatbots and customer interfaces.

When: When the AI serves consumers in e-commerce, banking, transport, e-books and similar services.

28.06.2025

Applies

Safety of consumer products, including risks from software updates and connectivity.

When: When the AI is part of a consumer product.

13.12.2024

Applies

Rules on algorithmic management of people: transparency, human oversight and the right to review automated decisions.

When: When the system assigns, evaluates or manages people's work through a digital platform.

02.12.2026

Transposition deadline · upcoming

ICT risk management and oversight of third-party ICT providers in the financial sector.

When: When the client is a bank, insurer, investment firm or other financial entity.

17.01.2025

Applies

Software, including AI, with a medical purpose is a medical device and must pass a conformity assessment.

When: When the system has a medical or diagnostic purpose.

26.05.2021

MDR applies

26.05.2022

IVDR applies (with transitional periods)

Safety requirements for machinery, including machines with self-learning safety functions.

When: When the AI controls or protects a machine or industrial equipment.

20.01.2027

Applies · upcoming

The fundamental-rights authorities are designated (including the data protection, consumer protection and anti-discrimination commissions). According to BTA, the Communications Regulation Commission is national coordinator. Market-surveillance authorities are not yet designated.

18.06.2025

Fundamental-rights authorities designated

Bill for a national AI framework, submitted to the 52nd National Assembly. Not yet adopted.

24.09.2026

Submitted to the National Assembly

Supplements the GDPR in Bulgaria: powers of the data protection commission, special processing cases and penalties.

01.01.2002

In force (last amended: SG No. 69/2026)

Transposes NIS2 in Bulgaria: risk-management measures, incident reporting, supplier security.

When: When the client is in scope of NIS2 or supplies an in-scope entity.

13.11.2018

Promulgated

13.02.2026

NIS2 amendments (SG No. 17/2026)

Implements the ePrivacy Directive, including the rules on cookies and storing information on the user's device.

When: When the AI runs on a website or app.

22.05.2007

Promulgated (last amended: SG No. 66/2026)

Prohibits direct and indirect discrimination, including where a decision is made or prepared by an algorithm.

When: When the system takes part in decisions about people: hiring, credit, pricing, access to services.

01.01.2004

In force (last amended: SG No. 88/2026)

Employee rights, workplace monitoring, and informing and consulting employees.

When: When the system affects employees: hiring, evaluation, monitoring, assigning work.

01.01.1987

In force

Rights in the content a system is trained on or produces; implements the text-and-data-mining exception.

When: When the system uses or produces protected content.

01.08.1993

In force

Information online providers must give, commercial communications and concluding contracts electronically.

When: When the AI is part of an online service or sale.

24.12.2006

In force

Unfair commercial practices, consumer information and liability for damage caused by defective goods (Section IV, Art. 130 ff.).

When: When the AI interacts with consumers or is part of a product for them.

10.06.2006

In force (last amended: SG No. 87/2026)

Contractual and tort liability: who is responsible when an AI system makes a mistake or causes harm.

01.01.1951

In force

Protection of confidential business information, which matters when company data is sent to external AI models.

05.04.2019

Promulgated (SG No. 28/2019)

Interpret the AI Act: the AI-system definition, prohibited practices and obligations for general-purpose models. Draft guidelines on high-risk classification (May 2026) are expected in final form by the end of 2026.

02.2025

Guidelines on the definition and on prohibited practices

07.2025

Guidelines on general-purpose models

Voluntary code on transparency, copyright and safety. It binds model providers directly; for us it is a criterion when choosing a model.

When: When choosing or providing a general-purpose model.

10.07.2025

Published

How GDPR applies to AI models: legitimate interest, model anonymity, consequences of unlawful training, web scraping.

17.12.2024

Opinion 28/2024 on AI models

07.2026

Guidelines 03/2026 on web scraping for generative AI

Bulgaria's GDPR supervisory authority and a fundamental-rights authority under the AI Act.

—

Ongoing publications

International certifiable standard for managing AI responsibly within an organisation.

When: Voluntary; recommended for larger or regulated clients.

12.2023

Published

The information security management system the AI solution has to fit into.

When: Voluntary; often required by clients and under NIS2.

10.2022

Published

Guidance on identifying, assessing and reducing AI-related risks.

When: Voluntary; useful for any risk assessment.

02.2023

Published

How to assess an AI system's impact on people and society before and during use.

When: Voluntary; useful for systems that affect people.

2025

Published

Will give a presumption of conformity for high-risk systems. Not yet published; the Commission expects the first in 2026.

When: When the system is high-risk.

2026

First standards expected · upcoming

Determines whether the model may be used commercially, with what restrictions and attribution duties.

When: When an open-weight model is used.

—

Depends on the model version

Data retention, whether your data is used for training, ownership of outputs and permitted uses.

When: When a cloud model is used (Anthropic, OpenAI, Microsoft, Google, etc.).

—

Depends on the current version of the terms

Mandatory contract between the client (controller) and us or the provider (processor). The Commission offers standard clauses.

27.06.2021

Standard clauses (2021/915)