Bulgaria AI Regulation Overview

Overview

Bulgaria's artificial intelligence regulatory architecture combines national strategic planning, active participation in European Union policy coordination, and emerging legislative initiatives. The baseline national policy was established by the Council of Ministers through the adoption of the Concept for the Development of Artificial Intelligence in Bulgaria until 2030 (in December 2020) and the Digital Transformation of Bulgaria for the period 2020–2030 (adopted in July 2020). These foundational frameworks position AI as a key driver of digital transformation, economic growth, and public service modernization while emphasizing ethical alignment, digital skills, research infrastructure, and data governance.

As an EU Member State, Bulgaria's regulatory landscape is directly connected to EU framework actions, including the EU Coordinated Plan on Artificial Intelligence (2021 review) and the EU AI Regulation (Regulation (EU) 2024/1689). National governance responsibilities were centralized in December 2021 under the Ministry of Electronic Governance, which serves as the principal coordinating authority for e-government and digital policy. To operationalize EU requirements and structure national implementation, proposals such as the Draft AI Act (presented in September 2025) and the Draft Strategy for AI in Education (proposed in May 2025) have been introduced to set out concrete national oversight structures, high-risk compliance procedures, and sector-specific deployment guidelines.

Regulatory Approach

Bulgaria's current approach relies on strategic soft law and cross-sectoral planning, complemented by incoming risk-based legislative proposals aligned with European Union mandates. Adopted national documents, including the 2020 AI Concept and the Digital Transformation strategy, establish non-binding strategic goals and cross-governmental principles: cybersecurity by design, technology neutrality, user-centric public services, open data access, and reliable, ethical AI development without establishing direct administrative penalties within the strategy texts themselves.

The emerging legislative approach—reflected in the Draft AI Act (2025) and sector-specific policy drafts—adopts the EU's horizontal, risk-based classification. Unacceptable AI practices (such as social scoring and unauthorized mass biometric surveillance) are prohibited, while high-risk applications in public administration, educational assessment, and critical infrastructure are subjected to mandatory conformity assessments, technical documentation (model cards), Data Protection Impact Assessments (DPIAs), human-in-the-loop oversight, and centralized registration. Low- and medium-risk tools remain subject to baseline transparency, data protection under GDPR, and technical quality standards.

Key AI Legislation

• Concept for the Development of Artificial Intelligence in Bulgaria until 2030 (National AI Strategy): Adopted by the Council of Ministers on 16 December 2020 (Protocol No. 72). Formulates national objectives across six strategic pillars: communications/scientific infrastructure, education and lifelong learning, research and technology transfer, data governance, priority sector adoption, and ethical/regulatory alignment with EU trustworthy AI principles.
• Digital Transformation of Bulgaria for the period 2020–2030: Adopted by the Council of Ministers on 21 July 2020 (Decision No. 493). Establishes a cross-sectoral umbrella strategy defining six strategic goals and 17 impact areas to accelerate national digital transition and align with EU Digital Economy and Society Index (DESI) benchmarks.
• Coordinated Plan on Artificial Intelligence (EU, 2021 review): Published by the European Commission on 21 April 2021. Operates as an applicable EU policy coordination instrument guiding Bulgarian public investments, research network participation, testing facilities, and alignment with EU single market and AI Act governance structures.
• Draft AI Act (Project bill by political party 'Da, Bulgaria'): Published for public discussion in April 2025 and formally presented on 23 September 2025. Proposes a national horizontal law to clarify national application of EU Regulation (EU) 2024/1689, establish a National AI Coordinator, introduce conformity assessment and market surveillance rules, and enable public data access for training open AI models.
• Draft Strategy for the Development and Integration of Artificial Intelligence in Bulgarian Education: Proposed in May 2025. Sets an education-specific policy framework defining low-, medium-, and high-risk educational AI applications, establishing safety and procurement baselines, mandating teacher CPD, and governing pupil data protection.

Governance & Enforcement Bodies

Institutional oversight for AI in Bulgaria is distributed across central executive ministries, independent authorities, and proposed national oversight bodies. Primary operational coordination for national AI policy and public-sector digital integration is managed by the Ministry of Electronic Governance (assigned in December 2021 as the coordinating ministry for the 2020 AI Concept). The Council of Ministers acts as the supreme executive adopting authority for national strategies and interdepartmental policy decisions.

Data protection and automated decision-making oversight across all AI applications are enforced by the Commission for Personal Data Protection (CPDP) under existing data protection laws and GDPR principles. Proposed governance models in draft initiatives include the creation of a dedicated National AI Coordinator (a single national contact point to facilitate EU integration and public procurement guidelines), a Consultative Council for Ethical AI, an interministerial Steering Board for AI in education chaired by the Ministry of Education and Science, and an AI market surveillance oversight unit working alongside European AI Board structures.

Penalties & Enforcement

The adopted strategic framework documents—including the 2020 AI Concept, the Digital Transformation Strategy 2020–2030, and the EU 2021 Coordinated Plan—do not contain standalone penalty schedules or criminal sanctions. Legal liabilities, compliance orders, and administrative enforcement currently operate through pre-existing statutory channels, including national data protection law, electronic communications statutes, administrative procedure laws, and public procurement frameworks.

Proposed legislation introduces direct administrative enforcement and supervisory sanctions. Under the Draft AI Act (2025), national market surveillance units and the data protection authority would be empowered to issue administrative fines, mandate system modifications, order the temporary suspension or complete market withdrawal of non-compliant high-risk AI systems, and provide remedies for individuals harmed by prohibited or non-compliant AI applications. Similarly, the Draft Strategy for AI in Education proposes administrative sanctions, system usage suspensions, removal from approved supplier registries, and withdrawal of state funding for non-compliant educational AI vendors.

Data Protection Framework

Data governance and privacy standards for AI development and deployment in Bulgaria are anchored in the EU General Data Protection Regulation (GDPR) and overseen by the Commission for Personal Data Protection (CPDP). National policy documents emphasize data as a strategic national resource while mandating strict adherence to privacy, data quality, and secure data sharing protocols across both public and private sector AI deployments.

The Draft Strategy for AI in Education and the Draft AI Act introduce specialized data handling and privacy requirements for AI models. Educational AI deployments processing data of minors require mandatory Data Protection Impact Assessments (DPIAs), pseudonymization, strict data retention limits, localized or contractually restricted data residency, and clear parental or student consent procedures. For model training, the Draft AI Act proposes opening legacy public broadcaster archives (such as BNT, BNR, and BTA) under controlled conditions to build open training datasets, subject to safeguards and data protection compliance.

Sector-Specific Rules

Sector-specific AI guidelines in Bulgaria are most detailed within the educational sector. The Draft Strategy for AI in Education (2025) establishes a risk tiering structure for educational tools: low-risk applications (content recommendation, administrative bots) requiring basic transparency; medium-risk systems (formative feedback, adaptive learning engines) requiring rigorous testing and data governance; and high-risk applications (automated high-stakes educational decision-making, biometric proctoring, profiling affecting access to education) which are subject to strict restrictions, formal conformity assessments, and human-in-the-loop oversight requirements.

Broader sectoral priorities outlined in the 2020 AI Concept and the Digital Transformation strategy identify healthcare (telemedicine and e-health), public administration, agriculture, transport, energy, and environment as priority areas for AI adoption. The corpus contains no record of separate, self-contained national regulatory codes specifically governing financial AI or autonomous vehicles outside these strategic sector adoption goals and general EU framework alignment.

International Alignment

Bulgaria's national AI policy is closely aligned with European Union regulatory initiatives and international frameworks. National strategy documents explicitly adopt the European framing of trustworthy, human-centric AI and structure national priorities around EU funding instruments, including Horizon Europe, Digital Europe, the Recovery and Resilience Facility, and EU Structural and Investment Funds. National performance metrics are continually evaluated against EU benchmarks such as the Digital Economy and Society Index (DESI).

Legislative and strategic proposals in Bulgaria are designed to integrate with EU-level statutory requirements. The Draft AI Act and Draft Strategy for AI in Education explicitly seek to operationalize obligations under the EU Artificial Intelligence Regulation (Regulation (EU) 2024/1689), aligning national definitions, high-risk registries, conformity testing methods, and market surveillance processes with the European Artificial Intelligence Board and EU AI Office procedures. International policy reporting is also maintained through channels such as the OECD.

Future Developments

Future regulatory developments in Bulgaria center on the legislative progression of the Draft AI Act presented by 'Da, Bulgaria' in September 2025. If enacted, this bill will establish Bulgaria's horizontal national legal framework for AI, defining the operational mandates of the National AI Coordinator, creating a single national registry for high-risk systems, and establishing formal administrative enforcement mechanisms for market surveillance under the EU AI Act.

Concurrently, the proposed Draft Strategy for AI in Education is planned for phased operationalization. Key upcoming milestones outlined in the draft include Phase 0 preparatory guidance (DPIA templates, procurement rules, and security baselines), Phase 1 regional school pilots (involving collaborations with national research institutes such as INSAIT and its BgGPT model), and eventual scale-up across general, vocational, and higher education curricula alongside an accredited teacher training registry.

Enforcement Bodies