AI Regulation Tracker  /  Legislative programme

Bulgaria Put Its AI Act Implementing Law on a Timetable, Not on the Books

Council of Ministers Decision No. 577 of July 29, 2026 adopted the government's legislative programme for July to December 2026. Item 21 is the bill that would name Bulgaria's AI Act authorities. It is a scheduled item, not a rule, and the schedule runs past August 2.

By Anthony Guerriero  ·  Reviewed by Anthony Guerriero  ·  Published August 3, 2026  ·  Updated August 3, 2026  ·  Legislative programme

Key facts

Regulatory briefing

Instrument

Council of Ministers Decision No. 577 of July 29, 2026, adopting the Legislative Programme of the Council of Ministers for July to December 2026, item No. 21

Authority

Council of Ministers of the Republic of Bulgaria; sponsoring department for item 21 is the Ministry of Innovation and Digital Transformation

Jurisdiction

Bulgaria, within the EU single market

Status

Adopted July 29, 2026, published July 30, 2026. The implementing law it schedules is still to be drafted

Bindingness

Draft or proposed. The programme binds the government as a planning act; it creates no obligations for providers or deployers

Effective date

Programme issued July 29, 2026. Item 21 milestones: consultation September 2026, tabling October 2026

Primary source

Legislative Programme, July to December 2026, item 21

What the Council of Ministers actually adopted

On July 29, 2026 the Bulgarian Council of Ministers adopted Decision No. 577, approving the government's legislative programme for the period July to December 2026. The Decision was submitted by the Prime Minister, rests on Art. 21(1) of the Normative Acts Act, and was published on the government's strategy.bg portal on July 30, 2026. The acts register records the same two dates: issued 29.07.2026, published 30.07.2026.

A legislative programme in Bulgarian practice is a planning instrument. It lists the bills a government intends to prepare in a six-month window, names the department responsible for each, records whether an impact assessment is required, and fixes the months for consultation, pre-clearance and tabling. It does not enact any of them. Nothing in Decision No. 577 changes a single obligation on a company operating in Bulgaria.

What makes item 21 worth reading is the description of contents. Here is the programme entry in the original, condensed to the operative lines:

№ 21 | Закон за въвеждане на национални мерки по прилагане на Регламент (ЕС) 2024/1689 (Акт за изкуствения интелект (ИИ)) ... Вносител: Министерство на иновациите и дигиталната трансформация ... Цели, основни положения и очаквани резултати: - осигуряване въвеждането на национални мерки за прилагането на Регламент (ЕС) 2024/1689 ... включително определяне на национални компетентни органи - органи за надзор на пазара и нотифициращ/и орган/и, установяване на правила за определянето на санкции и принудителни мерки при нарушения на регламента и за създаване на национална регулаторна лаборатория за ИИ ... Месец на публикуване за обществени консултации: 09.2026 ... Месец на изпращане за предварително съгласуване: 09.2026 ... Месец на внасяне в Министерския съвет: 10.2026Legislative Programme of the Council of Ministers for July to December 2026, item 21, adopted by Decision No. 577 of July 29, 2026

In our translation: the bill is to introduce national measures for the application of Regulation (EU) 2024/1689, including designation of national competent authorities, meaning market surveillance authorities and a notifying authority or authorities; establishment of rules for setting penalties and enforcement measures for infringements of the Regulation; and creation of a national AI regulatory sandbox. The Bulgarian phrase for that last item is literally a national regulatory laboratory for AI. Consultation and pre-clearance are marked for September 2026 and tabling in the Council of Ministers for October 2026. A full impact assessment is marked as required.

The programme also lists the collateral statutes the bill would have to amend: the Electronic Governance Act, the Electronic Communications Act, the Technical Requirements for Products Act, the Health Act, the Cybersecurity Act, and in the programme's own words all other normative acts relevant to the powers of the designated national competent authorities. That list tells you this is not a one-clause designation. It is a supervisory architecture spread across five existing laws, which is exactly the kind of drafting that takes longer than a government expects.

A schedule is not a rule, and the distinction matters here

I want to be blunt about the category, because this is the sort of item that gets summarised into something it is not. No enacted Bulgarian AI Act implementing law was identified in the sources reviewed for this entry. The item 21 bill is recorded as still to be drafted, its consultation month is September 2026, and it is not a bill before the National Assembly. What exists is a government decision saying the government intends to produce such a bill and expects to table it in October.

The binding effect runs inward. A legislative programme commits the executive to a work plan and gives the sponsoring ministry a mandate and a deadline. It does not reach a provider, a deployer, an importer or a distributor. If you are looking for something to comply with in Bulgaria, this document is not it.

That said, a planning act is not worthless information. It is the government stating on the record what its own implementing law does not yet contain. Read item 21 backwards and it tells you what was missing on July 29: named competent authorities, a penalties regime, and a sandbox. Governments do not schedule work that is already finished.

The other reason to take the dating seriously is the impact assessment. The entry marks a full impact assessment as required, which in Bulgarian legislative practice is the heavier procedure rather than the partial one. That is a real step with its own timeline, and it sits between today and a tabled bill.

The designation gap, in the government's own numbering

The most operationally useful line in item 21 is the cross-reference. The programme records the bill as implementing measures Nos. 138 and 139 of Bulgaria's 2026 Action Plan on measures arising from EU membership. Measure 138 is a draft Council of Ministers decision designating the national market surveillance authority under Regulation (EU) 2024/1689. Measure 139 is a draft Council of Ministers decision designating the national notifying authority.

Both are described as measures still to be implemented. That is the government's own characterisation on July 29, 2026, and it is the honest way to describe the state of play: no market surveillance authority designation and no notifying authority designation for the AI Act appear in the Bulgarian instruments reviewed for this entry, and the executive's own plan still carries both as pending work.

I would not phrase this as a claim that no authority exists. National designations can sit in instruments a foreign reader has not opened, and the responsible ministry is new. What I can say is narrower and more useful: none was identified in the sources reviewed, and the government's July 2026 programme treats both designations as outstanding items to be delivered through the item 21 bill.

One adopted Bulgarian AI Act designation instrument was identified. Council of Ministers Decision No. 398 of June 18, 2025, published June 19, 2025, designates the national bodies for the protection of fundamental rights, including the right to non-discrimination, under Article 77 of the Regulation: the Ombudsman, the Central Election Commission, the Commission for Protection against Discrimination, the Commission for Personal Data Protection, the Consumer Protection Commission, the State Agency for Child Protection, and the Executive Agency General Labour Inspectorate.

Do not read that list as a market surveillance answer. Article 77 bodies are a distinct designation with a distinct function: they are the public authorities that supervise or enforce fundamental rights obligations and that may request and access documentation created under the Act. They are not the market surveillance authority, and none of them has been designated as such in the instruments reviewed. In particular, do not assume the Commission for Personal Data Protection carries AI Act market surveillance because it appears on the Article 77 list.

What this means for a US company with Bulgarian exposure

Start with the point that reassures nobody and is nonetheless true: your obligations under the Regulation are unaffected. The AI Act is a regulation, directly applicable across the Union, and it became generally applicable on August 2, 2026. Prohibited practices, AI literacy, general-purpose model duties and the transparency provisions do not wait for a Bulgarian designation decision. A member state that has not yet named its supervisor has not created a grace period for anyone selling into it.

What an incomplete designation actually changes is procedure and timing. Three practical consequences are worth writing down.

First, notification. A conformity assessment body that wants to be notified in Bulgaria needs a notifying authority to notify it. On the record reviewed here, that designation is still a planned measure. If your high-risk conformity route assumed a Bulgarian notified body, that assumption needs re-examining now rather than in 2027, because the high-risk timetable under the Digital Omnibus runs to December 2, 2027 for stand-alone Annex III systems and August 2, 2028 for Annex I embedded products, and notified body capacity has to exist before those dates, not on them.

Second, incidents and complaints. Serious incident reporting and complaint handling under the Act run through a national market surveillance authority. Where the national counterpart is not yet named, the sensible operational answer is to document your reporting decision at the time you make it, keep the underlying record complete, and be ready to route to whichever authority is designated. Do not let an unnamed regulator become an undocumented decision.

Third, penalties. Article 99 leaves member states to lay down the rules on penalties, and item 21 is where Bulgaria proposes to do that. Until that law passes, the national penalty framework for AI Act infringements in Bulgaria is a matter for future legislation. That is a reason to be more careful, not less. Penalty regimes adopted late are frequently adopted with effect from a date that does not flatter anyone who spent the interim doing nothing, and the evidentiary record of what you did during 2026 is built now, not retroactively.

The Monday work is short. Confirm whether any of your entities place AI systems on the Bulgarian market or use them there as a deployer. Record in your authority register that Bulgaria's designation is pending and cite Decision No. 577 with its July 29 date so the entry is auditable. Put a calendar marker on September 2026 for the consultation and October 2026 for the tabling, because the consultation draft is the first document that will name proposed authorities and proposed penalty levels. And do not treat the absence of a Bulgarian supervisor as an absence of Bulgarian risk, because the substantive duties are the Regulation's and they already apply.

Last verified: August 3, 2026 against the primary sources listed above.