EC opens new infringement procedures against Bulgaria and 22 other EU countries over cybersecurity rules

The European Commission on November 28 announced it is opening infringement procedures by sending a letter of formal notice to Bulgaria and 22 other EU Member States for failing to fully transpose the EU legislation on cybersecurity.

EU countries had until 17 October to implement the rules, which affect critical sectors such as public electronic communications services, ICT service management, digital services, waste water and waste management, health, energy, transport, the manufacture of critical items, postal and courier services, and public administration. Full implementation of the legislation is important to improve resilience and incident response capacities, the Commission notes.

Bulgaria, the Czech Republic, Denmark, Germany, Estonia, Ireland, Greece, Spain, France, Cyprus, Latvia, Luxembourg, Hungary, Malta, the Netherlands, Austria, Poland, Portugal, Romania, Slovenia, Slovakia, Finland and Sweden have two months to respond, after which the EC may decide to issue a reasoned opinion, the statement adds.