Data centres in Bulgaria: The regulatory framework takes shape

Bulgaria is becoming one of the data centre markets attracting the greatest investor interest in South Eastern Europe. According to data from the Electricity System Operator (ESO), as at 3 August 2026 applications and investment intentions for connecting data centres to the transmission grid totalled 9,330 MW. This exceeds the country's peak winter consumption of about 7,000 MW. At the same time, EU law shapes most of the legal framework governing these facilities, with Bulgarian law adding its own requirements on grid connection, cybersecurity and foreign investment.

Background

Demand for artificial intelligence computing capacity drives interest in the sector. In January 2026, the Council of Ministers signed a memorandum of understanding with the German developer Brinell Compute for an AI data centre campus of about 809 hectares in the Rakovski Industrial Zone, Maritsa municipality, north of Plovdiv. The reported investment totals EUR 3 billion, and construction was announced for autumn 2026. In addition, Bulgaria hosts BRAIN++, one of the EuroHPC AI Factories, at Sofia Tech Park. The project has a budget of EUR 90 million, and the government has committed to providing 50% national funding from 2026.

ESO has issued opinions on the connection conditions for 3,795 MW of the 9,330 MW requested, while the remaining 5,535 MW are at the stage of investment intentions. Demand is concentrated in Plovdiv (2.26 GW), Burgas (1.86 GW) and Pleven (1.14 GW).

This update outlines the main legal instruments that investors and operators of data centres in Bulgaria should take into account.

Energy efficiency: from reporting to rating

Directive (EU) 2023/1791 on energy efficiency and Commission Delegated Regulation (EU) 2024/1364 require owners and operators of data centres with an installed IT power demand of at least 500 kW to publish key performance indicators each year by 15 May and to submit them to the European database. In Bulgaria, amendments to the Energy Efficiency Act in force since 10 June 2025 introduced these requirements for the first time. The information to be disclosed includes, among other things:

1. the name, owner and operator of the data centre, the date it commenced operations and the municipality in which it is located;
2. the floor area, the allocated electrical capacity, the annual incoming and outgoing data traffic and the volume of data stored and processed; and
3. indicators for the last full calendar year on energy consumption, waste heat utilisation, set-point temperatures, water consumption and the use of energy from renewable sources.

Operators of data centres of 1 MW or more must take into account the best practices in the EU Code of Conduct on Data Centre Energy Efficiency. Data centres used for national defence and civil protection purposes are exempt. The first reporting period under the national rules ended on 15 May 2026 and covered 2025.

Common Union rating scheme

On 21 September 2026, the European Commission adopted a Delegated Regulation establishing a common Union rating scheme for data centres. Each reporting data centre will receive two separate ratings from A to G, generated from the data it reports: one for energy efficiency, based on power usage effectiveness (PUE), and one for water usage, based on water usage effectiveness (WUE). An A rating requires a PUE of 1.15 or below and a WUE of 0.1 or below. The first labels are expected by 15 August 2027. The label will show the energy sources used, distinguishing new renewable or nuclear capacity commissioned within the last ten years from older installations. Guarantees of origin will count where they come from the same bidding zone or Member State and are matched to the consumption period. The European Parliament has extended its scrutiny period, and the deadline for objections has moved to 21 January 2027.

In addition, the Commission has launched a public consultation on binding minimum performance standards for new and refurbished data centres, which closes on 14 December 2026. A legislative proposal is expected in Q2 2027.

For Bulgarian projects, the rating scheme means that the structure of power purchase agreements will affect the published rating. Data centres exceeding 1 MW must use their waste heat or demonstrate that this is not feasible from a technical or economic perspective, which makes proximity to district heating networks a relevant factor in site selection. The Commission has indicated that the ratings will be used under the proposed Cloud and AI Development Act, so a weak rating may affect access to financing and public procurement before any binding minimum standards apply.

The AI Act

Regulation (EU) 2024/1689 (the AI Act) does not impose energy obligations on data centre operators. The obligations fall on providers of general-purpose AI models, who must maintain technical documentation that includes information on the energy consumption of the model, or an estimate based on the computational resources used. Providers of models placed on the market before 2 August 2025 have until 2 August 2027 to comply. Energy consumption is one of the factors that may lead to a model being classified as presenting systemic risk.

Where a data centre hosts AI workloads, the energy efficiency regime and the AI Act may apply in parallel. For Bulgarian campuses that target AI model developers, the practical consequence is contractual: customers will need reliable energy data from the operator to meet their own documentation obligations, and colocation and GPU-as-a-service agreements should provide for regular and auditable metering.

The proposed Cloud and AI Development Act

On 3 June 2026, the European Commission published a proposal for a Cloud and AI Development Act (CADA) as part of its Tech Sovereignty Package. The proposal aims to triple data centre capacity in the EU by 2030 and to enable operators to obtain all permits needed to build and operate a data centre within 18 months. The Commission expects the legislative process to be completed by the end of 2027, with the Regulation applying from around 2029.

Acceleration zones

Under the proposal, each Member State in which data centre capacity is being deployed would have to designate at least one data centre acceleration zone within six months of the Regulation entering into force. Projects in these zones would benefit from a permit-granting procedure of no more than 12 months, an aggregated baseline permit covering the authorisations that data centres require in most cases, and a single information point for planning, building, environmental, water, heat reuse and grid connection matters. When designating the zones, Member States would have to consider grid capacity, the possibilities for on-site storage and clean energy generation, connectivity, waste heat reuse potential and the availability of brownfield sites.

Strategic projects

The Commission would be able to designate data centre strategic projects that meet at least two of several criteria, including support for essential public sector functions, sustainable or innovative features of a high standard, a contribution to grid stability (in particular through co-location with clean energy generation and storage), the integration of chips designed or manufactured in the EU, and addressing a major shortage of compute capacity. Strategic projects outside acceleration zones would benefit from a permitting deadline of 18 months and from priority access to EU funding.

Union assurance levels

The proposal introduces four Union assurance levels for cloud services, ranging from Level 1 (establishment and data residency in the EU, based on self-assessment) to Level 4 (no third-country control, with certification at a high assurance level). Public bodies would be required to procure services of at least Level 1, and for activities relating to public order in sectors covered by the NIS 2 Directive, services of Levels 2 to 4, which require an independent audit.

At present, Bulgaria has no specific permitting regime for data centres. If the proposal is adopted, Plovdiv, Burgas and Pleven, where most of the grid connection applications are concentrated, would be natural candidates for acceleration zones. Projects targeting public sector cloud demand should consider the ownership and control requirements of the higher assurance levels when structuring joint ventures. The proposal accelerates permitting but does not in itself create additional generation capacity or relieve grid congestion, which remain the main constraints in Bulgaria.

Grid connection and power supply

In practice, access to the grid is likely to be the decisive factor for data centre projects in Bulgaria. Large consumers apply to ESO under Ordinance No. 6 on connection to the electricity grid. ESO does not conclude preliminary connection contracts with data centre applicants but issues opinions on the conditions for connection, which are valid for one year. Whether a project progresses within that period depends on the investor.

The volume of requests exceeds the capacity of the system by a wide margin. For comparison, total installed generation capacity in Bulgaria is estimated at about 15 GW and total cross-border transmission capacity at 4.4 GW. Market participants have raised concerns that part of the requested capacity is speculative, and proposals have been made to require data centres to be connected to two independent substations, in line with the applicable technical standards, as a means of filtering out such applications. At present, no such requirement, nor a grid bond comparable to the one introduced in 2023 for generation projects, applies to large consumers. It remains to be seen whether the legislator will introduce one.

Securing a stable power supply is of equal importance. AI data centres require long-term supply arrangements of 10 to 15 years, and the number of suppliers in Bulgaria able to provide such volumes at stable prices is limited. Investors should plan financing, land and permitting milestones so that the project can move to a connection contract within the validity of ESO's opinion, and should structure their power purchase agreements with the new EU rating scheme in mind.

Cybersecurity and foreign investment screening

NIS 2

Bulgaria transposed Directive (EU) 2022/2555 (NIS 2) through amendments to the Cybersecurity Act, promulgated in State Gazette No. 17 of 13 February 2026. Data centre service providers fall within the digital infrastructure sector listed in Annex I. Large providers qualify as essential entities and medium-sized providers as important entities. They must implement risk management measures approved and overseen by their management bodies, and report significant incidents in three stages: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. Essential entities face fines of up to EUR 10 million or 2% of their total worldwide annual turnover, whichever is higher, and members of management bodies may face personal liability. As these obligations cannot be passed on to tenants, colocation and GPU-as-a-service agreements should allocate responsibility for controls and incident notifications. The implementing secondary legislation under the amended Act remains pending.

Foreign direct investment screening

The amendments to the Investment Promotion Act adopted on 22 February 2024 introduced a foreign direct investment screening mechanism in Bulgaria. Prior approval by the Inter-ministerial Council for Screening of Foreign Direct Investments is required for investments by investors under direct or indirect control from outside the EU, including from the United States and the United Kingdom, where the target operates in a sensitive sector, such as critical infrastructure (including data processing or storage), critical technologies or access to sensitive information, and the investment either:

1. involves the acquisition of at least 10% of the capital of an undertaking operating in Bulgaria; or
2. exceeds EUR 2 million, including greenfield investments.

The Council must issue a decision within 45 days, which may be extended by 30 days, and the absence of a decision within these periods is construed as tacit approval. An investment made without the required approval remains valid, but is subject to an administrative fine of 5% of its value, but not less than BGN 50,000 (the equivalent of EUR 25,565), as well as possible corrective measures. Investors in Bulgarian data centre projects backed by non-EU capital should build the screening procedure into the transaction timetable alongside merger control.

What is next

The coming months will be important for the sector. The key milestones include:

1. 14 December 2026, when the Commission's consultation on minimum performance standards for data centres closes;
2. 21 January 2027, the deadline for the European Parliament and the Council to object to the Delegated Regulation on the rating scheme;
3. 15 May 2027, the next annual reporting deadline under the Energy Efficiency Act;
4. 15 August 2027, when the first data centre ratings are expected to be generated; and
5. the adoption of the secondary legislation under the amended Cybersecurity Act and the progress of the CADA proposal through the EU legislative process.

Bulgaria has a clear opportunity to attract significant investment in digital infrastructure. Whether the more than 9 GW of requested capacity translates into projects that are built will depend on the pace of grid development and on whether the Bulgarian legislator introduces a transparent framework for screening grid applications and designating suitable sites before the CADA requires it.

For further information and to stay up to date on forthcoming developments, contact your usual CMS contact or our local CMS Sofia expert, Ivan Gergov.