Bulgaria to introduce comprehensive AI law

EU AI Act implementation: governance structure

Under the draft law, the Minister of Innovation and Digital Transformation would serve as lead policymaker. A National Coordinator for AI, appointed by the Prime Minister, would oversee the National AI Strategy and report annually on AI risks. Ten national competent authorities would carry out market surveillance, with the Communications Regulation Commission serving as the single point of contact under Article 70(2) of the EU AI Act.

Prohibited practices 

Prohibited practices include remote biometric identification systems, AI in special intelligence means (except for preparing material evidence), AI recommender systems for online gambling, and judicial use of AI to interpret facts or law, or to apply a law to specific facts.

National security provisions

A dedicated regime would apply to AI systems posing national security risks. Where the Council of Ministers classifies a recommender system as high-risk, operators must provide the State Agency for National Security (SANS) with source code, technical documentation and model parameters of their systems without delay. The Council of Ministers may also restrict third-country AI services that pose national security risks.

Deepfakes

Publication of AI-generated deepfakes of persons holding high public office or of any other person without consent would be prohibited, with a 50-year post-mortem protection period. Removal orders would be issued by the Ministry of Interior and SANS, subject to judicial review. A satirical or parodic exception applies, provided the material is neither defamatory nor harmful.

Workforce upskilling

AI-skills training would be mandated across public sectors. The Institute of Public Administration would deliver civil-servant training and establish a competence-certification framework. Sectoral ministries would adopt coordinated upskilling programmes, and the Ministry of Labour and Social Policy would integrate AI skills into active employment policy.

Public-sector AI use

Several public-sector AI applications are envisaged, including AI-powered policy support systems, delivery of electronic administrative services through AI (e.g. chatbots), provision of computing resources for research and development, and publication of public data to support Bulgarian-language AI model training. An AI Regulatory Sandbox would be established by the Minister of Innovation and Digital Transformation.

Investment incentives and digital sovereignty

Investment incentives include targeted SME financing for AI adoption (subject to de minimis state aid rules), enhanced investment promotion (AI investments qualify at a multiplier exceeding 5x), access to EuroHPC computing resources and targeted funding for open-source AI tools and an AI Assistance Centre offering legal guidance. The draft law also articulates the principle of digital sovereignty, defined as Bulgaria’s ability to make independent decisions on critical digital technologies and reduce strategic dependencies on entities outside the EU and EFTA.

Open general-purpose AI models and data training

Open general-purpose AI models meeting specified criteria would be classified as models used for research and development under the EU AI Act. Training of such models using publicly available personal data would be treated as processing in the public interest under Article 6(1)(e) of the GDPR, subject to conditions including anonymisation measures and the exclusion of special-category and children's data. AI model training is expressly recognised as automated analysis within the meaning of copy right exceptions.

Child protection

Use of children's personal data for AI model training would be prohibited, except with parental consent for specialised educational or paediatric models. AI-generated child pornography is criminalised, as is dissemination of tools or AI models designed to produce such content.

Penalties

Administrative fines would range from approximately EUR 250 for minor infractions up to EUR 2.5 million for serious non-compliance by very large online platform operators.

Amendments to other legislation

Amendments to over 20 existing laws are included, such as new AI transparency obligations in the Labour Code, criminalisation of AI-generated child sexual abuse material, a prohibition on judicial AI use in the Judiciary Act, and AI-labelling requirements for campaign materials in the Elections Code.

Timing and next steps

Entry into force would occur two months after promulgation, with certain provisions proposed to take effect on 1 July 2027. The Council of Ministers must adopt the implementing regulation and the National AI Strategy within six months. Obligated persons would have nine months to bring their activities into compliance.

This MP-initiated legislative proposal is now pending review before the parliamentary committees. The lead committee is the Committee on Innovation and Digital Transformation. An earlier version was submitted in October 2025 during the 51st National Assembly but did not advance before that parliament dissolved. Whether this second attempt succeeds remains to be seen.

For more information on Bulgaria’s draft AI legislation, contact your CMS client partner or the CMS expert who authored this article: Andrea Andreev, Associate.