The EU AI Act in Bulgaria

Per Bulgaria - AI in Education Strategy

• Ministry of Education and Science — Lead policy authority, governance Secretariat host, approved-systems register and education-sector implementation
• Council of Ministers (Government) — High-level policy approval and alignment with national AI Concept (strategic direction)
• Commission for Personal Data Protection (CPDP) — Data protection supervision, GDPR enforcement for pupil data and related DPIAs
• Executive Agency "Programme Education" (Managing authority for EU Education funds) — Co-funder oversight and alignment of EU-funded pilot programs and capacity building

Per Bulgaria - AI Regulation Draft (RAI-BG-NA-DAPBPXX-2025)

• National AI Coordinator (office to be established by the draft) — Central coordination, implementation support, liaison to EU bodies, and national reporting
• Commission for Personal Data Protection (CPDP) — Supervisory authority for data protection issues, DPIAs and automated decision-making matters
• Ministry of Electronic Government (Ministry of e-Government) — Oversight of public-sector AI deployment, e-government integration and procurement guidance

Per Bulgaria - AI Coordinated Plan (2021)

• European Commission (DG CONNECT) — Lead at EU level for digital policy, coordination of the Plan and liaison with Member States.
• AI Watch (Joint Research Centre) — Monitoring, data collection and technical support to track national strategy implementation and progress indicators.
• Ministry of Transport, Information Technology and Communications (Bulgaria) — National authority involved in Bulgaria's national AI strategy and coordination of AI policy (original 2020 concept); supporting alignment with the EU Plan.
• Ministry of Innovation and Growth (Bulgaria) — National implementing body supporting AI infrastructure, investments and participation in EU initiatives (e.g., AI factories selection, funding instruments).

Per Bulgaria - Digital Transformation Strategy

• Council of Ministers of the Republic of Bulgaria — Adopting authority and highest-level political coordination for national strategy implementation.
• Ministry of Transport and Communications (MTC) — Public steward and coordination point for digital transformation documentation; hosts official publication of the Strategy and annexes.
• Commission for Personal Data Protection (CPDP) — National data protection authority responsible for enforcement of data privacy rights and GDPR compliance (relevant to data sharing/open data actions in the Strategy).
• Regulatory Authority for Electronic Communications and Posts (Communications Regulator) — Sectoral regulator for electronic communications, spectrum management and oversight of network deployment and licensing.
• Ministry of Education and Science — Responsible for education policy, curriculum changes and digital skills integration in formal education.

Per Bulgaria - National AI Strategy

• Ministry of Electronic Governance (Republic of Bulgaria) — Primary coordinating body for national AI policy and e‑government (successor to MTITC responsibilities on AI policy coordination since late 2021).
• Ministry of Transport, Information Technology and Communications (MTITC / MTC) — Original lead ministry for the AI Concept (published the official Concept PDF and responsible for early coordination and technical policy prior to institutional changes).
• Bulgarian Academy of Sciences (BAS) — Key technical and research contributor to the Concept and ongoing research coordination and capacity building.

Per Bulgaria - AI in Education Strategy

• Temporary suspension of use of a non-compliant AI system in public schools
• Removal from the Ministry’s approved-providers list and prohibition from public procurement for a defined period
• Administrative fines and sanctions coordinated with Commission for Personal Data Protection for GDPR breaches
• Clawback of implementation funding and ineligibility for future public grants
• Contract termination and claims for damages under procurement and contractual law
• Public disclosure of enforcement actions and non-compliance reports

Per Bulgaria - AI Regulation Draft (RAI-BG-NA-DAPBPXX-2025)

• Administrative fines proportional to turnover for serious breaches (aligned with EU maxima in Regulation (EU) 2024/1689)
• Orders to suspend or withdraw non-conforming AI systems from the market or put into service
• Corrective measures and mandatory remediation plans enforced by supervisory authorities
• Public naming and blacklisting for repeat or egregious offenders
• Civil liability for damages caused by negligent deployment of AI systems and mechanisms for compensatory relief
• Criminal sanctions for deliberate misuse of AI in contexts that endanger public safety or national security (subject to criminal law procedures)

Per Bulgaria - AI Coordinated Plan (2021)

• The Coordinated Plan itself does not establish penalties; it is non-binding guidance.
• Enforcement and penalties relevant to AI use are provided by separate binding instruments (for example, the AI Act and sectoral EU laws), which set out administrative fines, corrective measures and enforcement mechanisms.

Per Bulgaria - Digital Transformation Strategy

• The Strategy itself does not establish direct administrative fines or criminal penalties; enforcement of obligations stemming from implementation measures is effected under existing sectoral and national laws.
• Non-compliance with data protection obligations will be subject to GDPR enforcement and fines by the Commission for Personal Data Protection under applicable law.
• Sectoral regulators (e.g., electronic communications regulator) retain sanctioning powers under their respective legal frameworks for breaches in licensed sectors.
• Public procurement irregularities arising during Strategy implementation are subject to administrative review, contracting authority sanctions and remedies under procurement law.
• Where funding conditions are breached, EU and national funding instruments may require recovery of funds or apply financial corrections.

Per Bulgaria - National AI Strategy

• The Concept itself does not set new administrative or criminal penalties; enforcement of requirements is expected through subsequent regulatory acts and existing legislation (e.g., Data Protection Act/GDPR, sectoral safety rules).
• Where applicable, existing sanctions (under GDPR and applicable sectoral laws) continue to apply to non‑compliant actors.
• Future regulatory instruments proposed in the Concept could create new enforcement and penalty mechanisms subject to legislative procedures.