Bulgaria's Draft AI Law vs the EU AI Act: What It Adds for Companies
TL;DR: Bulgaria's draft Law on the Use and Development of Artificial Intelligence (bill No. 52-654-01-151) is item one on the agenda of the lead parliamentary committee on innovation and digital policy at 15:30 Sofia time on 4 November 2026, for a first-reading vote. The EU AI Act already applies directly in Bulgaria. The bill would decide who enforces it here and add national rules on top. For companies with 30 to 30,000 employees, four parts matter most: which of ten sector regulators would supervise their AI, new AI information duties in the Labour Code, national fines, and a nine-month window to comply after the law is published. Nothing is final yet, but the draft shows clearly where Bulgarian rules are heading.
Key facts
- The bill: submitted on 24 September 2026 by a group of ten MPs led by Bozhidar Bozhanov (National Assembly bill page).
- Today's step: a presentation, discussion and first-reading vote in the lead committee on 4 November 2026 (committee schedule). A committee vote is not adoption: the bill still needs plenary votes at first and second reading.
- Who is in scope: public bodies, employers (for staff qualification), companies (for AI investment), and providers and deployers covered by the EU AI Act that operate in Bulgaria (full bill text, Art. 2).
- Timing if adopted: in force two months after promulgation, some provisions from 1 July 2027, and nine months for obligated persons to bring their activities into line (CMS Bulgaria legal update).
- Fines: from roughly €250 for minor breaches up to €2.5 million for the most serious non-compliance by very large online platforms (CMS).
- History: an earlier version was filed in October 2025; on 27 November 2025 a committee recommended rejecting it at first reading, by 9 votes to 6 with 2 abstentions (committee report).
Why a national law matters when the AI Act already applies
The AI Act is an EU regulation, so its obligations do not wait for Bulgarian legislation. The AI literacy duty in Article 4 has applied since 2 February 2025, and most other rules since 2 August 2026. After the AI Omnibus agreement, the high-risk rules for sensitive use cases in Annex III move to 2 December 2027 and those for AI built into regulated products to 2 August 2028 (European Commission).
What the regulation leaves to each member state is the machinery: which authority supervises which sector, how penalties work beyond the maximums in Article 99, where documentation is filed, and who a company calls with a question. Bulgaria has not yet settled these points. This bill is the current attempt to do it, and it goes further than the minimum.
Side by side: EU AI Act and the Bulgarian draft
| Topic | EU AI Act | What the Bulgarian draft adds |
|---|---|---|
| Supervision | Each member state designates market surveillance authorities; the AI Office oversees general-purpose AI models | Ten authorities split by sector, with the Communications Regulation Commission as the single point of contact |
| Prohibited practices | The Article 5 list applies EU-wide | National bans on remote biometric identification, AI recommender systems for online gambling, AI in special intelligence means (except preparing evidence) and courts using AI to interpret facts and law |
| Logs of high-risk systems | Deployers keep logs for at least six months (Article 26) | 12 months for employment-related high-risk systems, 24 months for law-enforcement systems, and longer during legal proceedings |
| Documentation | Providers keep technical documentation available to authorities | Must be kept electronically; authorities may not demand paper |
| Deepfakes | Deployers must disclose deepfakes (Article 50) | Bans publishing convincing AI fakes of senior officials, or of anyone without consent, with a 50-year protection after death and a satire exception |
| Skills | AI literacy duty for providers and deployers | Training programmes for the public sector, AI skills in active employment policy, a national AI competence framework |
| Penalties | Maximum fines set at EU level | National fines from about €250 to €2.5 million (CMS) |
The ten market surveillance authorities in Article 5 of the draft are the Financial Supervision Commission (insurance, investment, pensions), the Bulgarian National Bank (credit and payment institutions), the Executive Agency for Medical Supervision, the Bulgarian Drug Agency, the Council for Electronic Media, the Automobile Administration agency, the Commission for Personal Data Protection (for certain high-risk systems), the Inspectorate of the Supreme Judicial Council, the Minister of Justice (for alternative dispute resolution), and the State Agency for Metrological and Technical Surveillance for every other sector. In practice, a manufacturer, retailer or logistics company would most likely deal with the last one, while a bank or insurer would deal with its existing financial supervisor.
What changes for employers
Employers are named directly in the scope of the bill. Three provisions deserve attention from HR and legal teams:
- Labour Code transparency. One amendment adds the words "including whether the system uses artificial intelligence" to an existing employer information duty. Another adds a new item on whether AI was relevant to the reasons for concluding or terminating an employment contract.
- Longer logs for HR systems. High-risk systems in Annex III point 4 (recruitment, promotion, task allocation, performance monitoring) would need logs kept for 12 months instead of the EU minimum of six.
- Fines tied to rights. Breaching the fundamental rights impact assessment duty (AI Act Article 27) or the right to an explanation of individual decisions (Article 86) would carry fines of roughly €5,100 to €25,600, based on the draft's amounts converted at the fixed euro rate.
For companies that sell or resell AI systems in Bulgaria, Article 11 adds two practical duties: list a current phone number in the Commercial Register and keep a profile in the state secure electronic delivery system for correspondence with regulators.
Where the draft makes adoption easier
The bill is not only about control. Article 26 provides targeted funding for SMEs to implement AI systems, explicitly including training and consulting, within EU de minimis state aid limits; the SME promotion agency would have six months after promulgation to open the programme. Article 28 creates a single AI help centre offering legal guidance on applicable rules and information on funding. Article 29 states that training AI models counts as automated text and data analysis under the copyright exceptions. Article 8 sets up an AI regulatory sandbox.
What is still open
The committee vote is an early step. The previous attempt stopped at the committee stage in 2025, and several ministries and agencies filed opinions on this version in October, as listed on the parliament bill page. Much of the practical detail, from sandbox rules to register procedures, would sit in an implementing regulation due within six months of promulgation. Wording can also change between the first and second reading.
That uncertainty is not a reason to wait. Every EU obligation in the comparison above applies regardless of how the Bulgarian vote goes.
Who should act now
- HR directors: list every tool used in recruitment, performance reviews and monitoring, and be able to say which of them use AI. That answer is the starting point for the proposed Labour Code duties.
- CIOs and CTOs: map AI systems to the likely sector regulator and check whether log retention for HR-related systems can be extended to 12 months.
- Legal and compliance: follow the bill through committee and plenary, and draft a nine-month compliance plan that can start on promulgation day. Review marketing rules on synthetic likeness and consent.
- SME owners and CFOs: watch for the targeted funding programme; training and consulting are eligible costs under the draft.
- Companies that sell AI systems in Bulgaria: update the Commercial Register contact data and set up a secure electronic delivery profile.
A quick way to see where a company stands on the EU obligations that already apply is the free AI Act readiness test from Encorp.ai. Its result works as a baseline for any national rules added later. Teams that still need to cover Article 4 can start with AI training, and ownership of policies, inventories and logs belongs in a structured AI governance setup.
