Directive (EU) 2022/2555 (NIS2) was transposed into the Bulgarian Cybersecurity Act with effect from 13 February 2026. The reduced penalties ceased on 1 June 2026. This article addresses scope, the liability of management bodies and the contractual consequences.