Bulgaria’s AI Bill Rejected in Committee: What Companies Do Next

TL;DR: On 4 November 2026, Bulgaria’s parliamentary Committee on Innovation and Digital Transformation rejected at first reading the draft Law on the use and development of AI (bill 52-654-01-151). The vote was 5 in favour, 9 abstentions and 0 against. The Ministry of Innovation and Digital Transformation (MIDT) reported major legal and institutional defects and said it is preparing its own legislative act plus an institutional framework for public consultation. National AI legislation is still expected. For companies, the practical message is narrower: the EU AI Act already binds providers and deployers in Bulgaria. A delayed national bill does not pause those duties.

Key facts

• Vote outcome: first-reading rejection in the lead committee; 5 for, 9 abstain, 0 against (BTA, 4 Nov 2026).
• Bill identity: Law on the use and development of artificial intelligence, signature 52-654-01-151, filed 24 September 2026 by Bozhidar Bozhanov and MPs from Democratic Bulgaria.
• Ministry position: MIDT found substantial legal and institutional shortcomings; it is drafting its own act and a concept for the administrative and institutional framework, both planned for public consultation (BTA).
• Shared premise in the room: committee members and guests agreed that Bulgaria still needs national AI legislation.
• EU baseline unchanged: Regulation (EU) 2024/1689 applies directly. Member-state delay on designation and national measures does not suspend already applicable EU rules.

What the committee decided — and what it did not

Rejection at first reading in the lead committee stops this particular MP-initiated draft from advancing on that track. It is not a finding that AI regulation is optional for Bulgarian companies. It is also not a finding that the EU AI Act is paused inside Bulgaria.

According to BTA, Bozhanov presented the draft as widely discussed over the previous year and a half and argued that Bulgaria needs a law, clear structures and mechanisms to apply the EU regulation. Critics at the hearing — including industry and research voices present — challenged the text. One MP described it as outdated and overlapping with a 2025 attempt that did not pass. Another criticised gaps around the labour market and children’s digital literacy. Those are political and drafting arguments about this bill. They do not rewrite the EU calendar.

A useful distinction for boards:

1. This draft failed its first-reading vote in committee.
2. National implementing measures (authorities, penalties, sandbox, single point of contact) are still incomplete.
3. Directly applicable EU duties that already started — bans, AI literacy support measures, GPAI model rules for providers, and most transparency duties for operators — continue to apply.

Why MIDT pushed back

Deputy minister Mira Yosifova told the committee that MIDT’s legal and institutional review found substantial defects in the submitted draft, and that the ministry is preparing its own legislative act together with a concept for the administrative and institutional framework, to go to public consultation (BTA).

That sequence matters for companies more than the partisan framing. A ministry-owned draft that goes through consultation can still change. Until authorities, penalties and a sandbox are designated and notified, Bulgaria remains thin on national enforcement architecture. Independent tracking of AI Act readiness still places Bulgaria near the back of the EU-27 on designation of market surveillance and related bodies (Imiel Visser country note, reviewed against developments through late October 2026).

Pre-vote legal analysis of the MP draft — for example the CMS overview published on 2 November 2026 — showed how ambitious the text was: national coordinator, multi-authority market surveillance, national-security access to model parameters for certain systems, deepfake rules, public-sector AI use, investment incentives and child-protection clauses. Ambition without a clean institutional map is exactly the kind of defect a lead ministry flags. Companies should not build compliance programmes against every contested national clause in a rejected draft. They should build against the EU regulation that already applies, then map national add-ons when a consulted government text appears.

EU obligations do not wait for Sofia’s next draft

The EU AI Act is a regulation. It binds without waiting for a perfect Bulgarian statute. The Commission’s own regulatory framework pages remain the baseline. After the AI Omnibus entered into force on 27 July 2026, high-risk conformity duties for Annex III systems move toward 2 December 2027, and product-embedded Annex I high-risk duties toward 2 August 2028. That is extra time for heavy documentation — not a holiday from bans, literacy measures, GPAI duties or the transparency rules that already started.

For a Bulgarian mid-market group, the operational reading is:

• If a system is prohibited under the AI Act, it stays prohibited whether or not MIDT has tabled its bill.
• If staff use generative tools or customer-facing chatbots, literacy support and transparency duties are live management issues, not future legal theory.
• If the organisation buys or builds systems that may later fall into high-risk categories, inventory and role classification (provider vs deployer) should already be under way, because 2027 is a short runway for evidence, not for discovery.

National delay changes who may fine first and how a sandbox will look. It does not change whether the organisation needs an AI inventory, named ownership and evidence.

What companies should do while national law is delayed

Treat the committee vote as a planning input, not as permission to wait.

1. Freeze the wrong dependency. Do not condition AI Act work on the next Bulgarian bill number. Condition it on system inventory and role maps.

2. Keep a living inventory. For each AI system or heavily AI-assisted process: purpose, owner, data classes, affected people, vendor, provider/deployer role, and a provisional risk class. Update it when tools change.

3. Separate “applies now” from “prepare for 2027/2028”. Bans, literacy support, most transparency and GPAI provider duties belong in the first bucket. Full high-risk conformity packages belong in the second — with a real project plan, not a calendar reminder for late 2027.

4. Align with controls you already run. Information security, privacy, vendor risk and incident response already produce the audit artefacts regulators expect. Extend those processes to AI systems instead of inventing a parallel paper factory.

5. Train the people who actually operate the tools. Literacy under Article 4 is a support duty. Structured AI training for operators and managers is the concrete response, especially in Bulgarian-language teams that ship customer content or internal decisions with AI assistance.

6. Assign one accountable owner. Legal, IT, security and HR all touch AI. One person still needs end-to-end ownership — often framed as an AI Director function in mid-sized groups.

7. Stand up governance before the next national draft lands. Policies, approval gates for new tools, logging expectations and escalation paths are the AI governance layer that survives whichever bill eventually passes.

Who inside the company should act this month

• CEO / board: ask for a one-page status — inventory coverage, named owner, and which duties are treated as live versus deferred to 2027/2028.
• Legal / compliance: track MIDT consultation when it opens; do not rewrite contracts around clauses from the rejected MP draft unless counsel confirms they remain relevant.
• CIO / CISO: confirm logging, access control and vendor due diligence for AI tools already in production.
• HR / learning: schedule literacy support for roles that prompt, review or publish AI-assisted outputs.
• Product and operations leaders in regulated workflows: flag candidates for future high-risk classification early, while there is still time to redesign human oversight.

What not to do

• Do not treat “no Bulgarian AI law yet” as “no AI Act yet.”
• Do not rebuild the programme around every headline from a rejected draft (deepfake clauses, investment multipliers, national-security source-code access and similar contested items from pre-vote summaries such as CMS).
• Do not wait for a sandbox announcement before classifying systems you already run.
• Do not confuse political consensus that “a law is needed” with operational readiness inside your company.

How Encorp.ai frames the next step

Encorp.ai works with companies that need a durable operating model while national texts move: governance design, training for the people who use the tools, and ongoing oversight after go-live through AI Ops. For teams that want a structured gap view before writing a long policy, the free AI Act readiness test is a practical starting point. To discuss governance ownership and a 90-day plan for a Bulgarian or CEE organisation, use the contact page.

Key takeaways

• The Innovation and Digital Transformation Committee rejected bill 52-654-01-151 at first reading on 4 November 2026 (5–9–0).
• MIDT cited major legal and institutional defects and is preparing its own act and institutional framework for consultation.
• Stakeholders still agree Bulgaria needs national AI legislation; that agreement does not pause EU duties.
• Companies should run inventory, ownership, literacy and transparency work now, and use the Omnibus high-risk runway for evidence — not for delay.
• Build governance against the EU AI Act first; map national add-ons when a consulted government draft appears.