The Bulgarian Artificial Intelligence Bill
On 8 October 2025, the first bill for implementing the European AI Act in Bulgaria was introduced in the National Assembly. The Bill on the Use and Development of Artificial Intelligence is pivotal for our legal landscape, because for the first time it expressly regulates the conditions for deploying, supervising, and developing AI technologies in Bulgaria and creates legally binding mechanisms for overseeing systems that may affect fundamental rights, the economic environment, or our national security.
Its intended scope is broad: the provisions would apply both to the public sector and to companies that develop, integrate, or use artificial intelligence systems, and in some cases even to the users of AI systems who are individuals.
Scope and addressees of the law
Article 1 of the bill expressly states that it governs the social relations connected with both the use and the development of AI, in both the public and the private sectors. The law is not limited to the "creation" of AI solutions; it also covers those entities that deploy ready-made models, configure them, train them on local data, or use them in processes that have legal consequences for citizens or clients.
In practice, this means that even companies that are not AI developers but use high-risk systems in sectors such as human resources, credit scoring, healthcare services, or infrastructure fall within the reach of the legislation.
Institutional model and supervision
The Bulgarian law adopts a decentralized approach. Article 5 designates the competent supervisory authorities by sector: for example, the Financial Supervision Commission (КФН) oversees the use of AI in the insurance, investment, and pension-insurance sectors; the Bulgarian National Bank (БНБ) oversees the banking and payments sectors; the Executive Agency "Medical Supervision" and the Drug Agency oversee healthcare; the Commission for Personal Data Protection (КЗЛД) monitors data protection in the use of AI systems; and the State Agency for National Security (ДАНС) oversees cases that pose a threat to national security.
Alongside this, a National Coordinator is established, with the authority to draft and assess a National Artificial Intelligence Strategy, coordinate the interplay between institutions, and issue opinions on key deployments.
Legal regime for artificial intelligence systems
The bill uses the same risk-based classification of AI systems that the European regulation employs, but it supplements the rules on use and development in certain sectors.
Article 12 contains an explicit prohibition on the use of remote biometric identification systems regardless of the context in which they are used, building on the general framework of the Regulation, which prohibits such use only in specific areas. Also prohibited is the use of systems that may pose a threat to national security, as well as the publication of deep fake content where it depicts real persons and where it creates a deception about the source or poses a danger to public order.
The bill goes a step further, criminalizing the creation of pornographic content through deep fake technologies, as well as the creation or distribution of the very technology that enables the creation of such content. It is unclear how this provision, if adopted, would apply to large-scale video-generation systems such as Sora or Veo, which, although capable of generating illegal content, are not intended for such activity.
Article 14 also restricts the use of AI services from third parties identified as posing a risk to national security by state bodies, strategic facilities, and operators of critical infrastructure.
Requirements for providers and distributors in the private sector
For businesses that supply or distribute artificial intelligence systems, the core obligation is demonstrable accountability. The provider or deployer must be able to establish when, how, and with what parameters a system was used. The law also imposes an additional retention period for storing data and logs in the case of high-risk systems. For enterprises that operate critical structures, it is further provided that the AI systems used in their operations are subject to entry in a dedicated register.
Use of AI in the public sector
As regards the deployment and use of AI in the public sector, the bill sets a higher standard of accountability than for the private sector. It provides for the adoption of methodological guidelines for deploying AI systems in the state administration, including guidelines for a prior ethical assessment of a system's impact before deployment and a code of ethics for its use. This means that the administration cannot introduce an automated decision-making system solely on the basis of technical expediency - an analysis is required of whether the model could lead to discrimination, opacity, or restricted access to services.
The bill also provides for requirements on the registration and conformity assessment of systems used in the administration if they fall into high-risk or systemic-risk categories.
To support development and encourage the use of AI models, the bill provides for the public disclosure of up-to-date information by administrative bodies about their activities, including data on their powers, functions, the acts they issue, their information assets, budgets, public procurement, and more, with the aim of ensuring transparency and facilitating access to public information, including in electronic form.
Upskilling and fostering innovation
The bill also places emphasis on workforce qualifications as an essential element of the safe use of AI systems. It introduces systematic training for civil servants through the Institute of Public Administration, as well as sector-specific programs tailored to the particular risks in different fields (healthcare, social services, education, and others).
In a separate set of provisions, the bill also envisions incentives for development and innovation in the field of artificial intelligence. It creates opportunities for so-called regulatory sandboxes, as well as a special regime for open general-purpose models, under which the use of publicly available data for training is permitted subject to certain personal-data protection safeguards, while the models themselves benefit from the research exemptions provided for in the AI Act.
These rules provide facilitation and incentives for developers and users of open-source models, in addition to the exemptions set out in the AI Act. To learn what these exemptions are and how we can take advantage of them, read our article The AI Act and the Exemptions for Open-Source Software.
In addition, the bill provides for access to funding and measures to encourage the building and development of artificial intelligence systems in the country, including through the provision of computing resources and the construction of a State Hybrid Cloud.
Penalties and consequences of breach
The bill provides for administrative penalties for non-compliance with its provisions, with fines and pecuniary penalties varying depending on the nature and severity of the breach, and in some cases reaching up to BGN 5,000,000. These penalties are independent of those provided for in the EU AI Act, which is why both public authorities and businesses should carefully monitor their legal compliance with the provisions of both acts, should the Bulgarian bill become reality.
Conclusion
The Bill on the Use and Development of Artificial Intelligence marks the beginning of a comprehensive legal framework for regulating AI technologies in Bulgaria - one that not only implements the European AI Act but also supplements it with national mechanisms for transparency, supervision, and the promotion of innovation. It strikes a balance between security and development, simultaneously protecting the public interest and stimulating technological progress.
If adopted, the law would make Bulgaria one of the first EU member states with a clear, detailed, and adaptive regulatory framework for artificial intelligence, combining high ethical standards with support for innovation and business. While we wait to see what legal compliance we will need to apply, however, the ethical considerations that must be observed are already a reality.
Learn more about them in our article series "Ethics and Artificial Intelligence".
