Where we work · Bulgaria
ISO and GRC certification consulting in Bulgaria
Achieve ISO and GRC certification in Bulgaria with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 22 standards, one team
- Accredited certification route
- Frankfurt office team
- Effivity and Academy included
Sectors that ask for certification in Bulgaria
Clients include
ISO and GRC certification in Bulgaria at a glance
Bulgarian demand for ISO and GRC certification comes from three directions: an export-oriented industrial base, EU regulation that arrives through national statutes, and public buyers that ask for accredited certificates. Automotive and electronics manufacturing, IT services and outsourcing, and health and life science feature among InvestBulgaria Agency's key sectors, and food processing falls under the Food Act. The Cybersecurity Act was amended in State Gazette no. 17 of 13 February 2026 to implement the NIS 2 Directive, the Commission for Personal Data Protection supervises the GDPR under the Personal Data Protection Act, and the Financial Supervision Commission handles DORA for the entities it supervises. Under the Public Procurement Act, certificates presented in tenders must come from bodies accredited by BAS, the Bulgarian Accreditation Service, or another EA MLA signatory. Certificates are issued by accredited certification bodies, never by Sterling. Sterling brings 20+ years and 8,100+ client engagements in 60+ countries, serves Bulgarian clients from its Frankfurt office, and includes Effivity and Sterling Academy in every engagement.
ISO and GRC standards Sterling delivers in Bulgaria
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Bulgaria (9)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| General Data Protection Regulation (GDPR) and the Personal Data Protection Act (Закон за защита на личните данни) Commission for Personal Data Protection (КЗЛД, Комисия за защита на личните данни), which the Act calls a permanently operating independent supervisory authority and which the European Data Protection Board lists as Bulgaria's authority; the Inspectorate to the Supreme Judicial Council supervises processing by courts when they act in their judicial capacity | The Act regulates the protection of natural persons' data to the extent the GDPR does not, adds rules for law enforcement processing, and covers the Commission's status, the legal remedies and the accreditation and certification framework. It excludes processing for national defence and security unless a special law says otherwise. | |
| Accreditation of GDPR certification bodies Commission for Personal Data Protection, on requirements that it or the European Data Protection Board sets | The Act has the Commission accredit certification bodies under the GDPR for a term that can be renewed, and withdraw the accreditation if the conditions are no longer met. It also provides that a data protection certificate cannot be made a mandatory condition for appointing a data protection officer. | |
| Whistleblower protection Commission for Personal Data Protection, as the central body for external reporting and protection; employers run their own internal channels | The Act protects people in the public and private sectors who report breaches of Bulgarian or EU law. Private-sector employers with 50 or more workers, and some smaller ones depending on their activity, must set up an internal reporting channel, and the Commission forwards reports about high public office-holders to the anti-corruption commission. | |
| Minister of e-Government, who keeps the register of covered entities; the Cybersecurity Council, which manages large-scale incidents and crises; and the sector competent authorities that the Council of Ministers designates by decision Essential and important entities in the sectors listed in the two annexes of the Cybersecurity Act, plus public administration bodies | Закон за киберсигурност (Cybersecurity Act), promulgated in State Gazette no. 94 of 2018 and amended and supplemented by the Act published in State Gazette no. 17 of 13 February 2026, which the National Assembly adopted on 5 February 2026. The amended Act states that it implements Directive (EU) 2022/2555. Management bodies approve the cybersecurity risk-management measures and oversee them, and the Council of Ministers may require use of ICT products certified under European cybersecurity schemes. The text refers to relevant standards but does not name ISO/IEC 27001 or ISO 22301. | ISO/IEC 27001, ISO 22301 |
| Financial Supervision Commission (КФН, Комисия за финансов надзор) Insurance, social insurance and investment entities, and other financial entities in DORA's scope | Regulation (EU) 2022/2554 (DORA), which applies from 17 January 2025. The Commission's DORA page in its legal framework section lists the delegated and implementing regulations on ICT risk management, incident reporting, the register of information and oversight. The page does not name ISO/IEC 27001. | |
| Bulgarian Drug Agency (ИАЛ, Изпълнителна агенция по лекарствата) Medical device manufacturers, authorised representatives, traders and importers | Medical Devices Act (Закон за медицинските изделия) and Regulation (EU) 2017/745, whose Article 10 requires manufacturers to run a quality management system. The Agency says it registers devices under Chapter II of the Act in an electronic database and that registration is mandatory. Its page does not name ISO 13485. | |
| Ministry of Agriculture and Food (Министерство на земеделието и храните) and the Bulgarian Food Safety Agency (Българската агенция по безопасност на храните), which keeps the national register of operators and sites under the Food Act Food businesses | Закон за храните (Food Act), State Gazette no. 52 of 9 June 2020, and Regulation (EC) No 852/2004. The Act requires business operators other than primary producers to put in place and maintain permanent procedures based on the HACCP principles, in line with Article 5 of the Regulation. Neither source makes a third-party certificate compulsory. | HACCP |
| Executive Agency General Labour Inspectorate (Изпълнителна агенция „Главна инспекция по труда“) and the other inspection bodies the Labour Inspection Act names Employers and workplaces | Закон за инспектиране на труда (Labour Inspection Act), State Gazette no. 102 of 28 November 2008, under which labour inspection covers control under the Healthy and Safe Working Conditions Act, and Directive 89/391/EEC on the employer's duty to ensure workers' safety and health. Neither text names ISO 45001. | |
| The authorities designated under the Energy Efficiency Act (Закон за енергийната ефективност) Energy-intensive enterprises | Directive (EU) 2023/1791, Article 11, which requires enterprises above an energy consumption threshold to run a certified energy management system, with energy audits for other large users. The amending act in State Gazette no. 105 of 30 December 2016 changed the Energy Efficiency Act's provisions on mandatory energy audits to take account of declared energy or environmental management systems. Neither text names ISO 50001. | ISO 50001, ISO 14001 |
Accreditation and recognition
- BAS (Изпълнителна агенция „Българска служба за акредитация“, the Executive Agency Bulgarian Accreditation Service): National accreditation body.
- BDS (Български институт за стандартизация, the Bulgarian Institute for Standardization): National standards body (standards role only).
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement under the Public Procurement Act (Закон за обществените поръчки), State Gazette no. 13 of 16 February 2016 (Contracting authorities (възложители) under the Act): Each contracting authority sets its own conditions. As promulgated, the Act lets it require bidders to apply quality management systems and environmental protection systems or standards. Where it asks for certificates, it must refer to the relevant European standards series for quality management, or to EMAS and other recognised environmental systems or standards, and the certificates must come from independent bodies accredited by BAS or by another national accreditation body that is an EA MLA signatory.
Economic zones
- Customs free zones reported by Bulgaria to the European Commission: logistics and port-linked industry, trade, manufacturing
- Automotive and electronics manufacturing: automotive, electronics, components
- IT and business process outsourcing: software and IT services, business process outsourcing, global business services
- Health and life science, robotics and mechatronics: pharmaceuticals and chemicals, healthcare, robotics and mechatronics
Sterling in Bulgaria
Sterling delivers in Bulgaria from its Frankfurt office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Bulgaria clients ask
Are certification audits in Bulgaria carried out in Bulgarian or English?
Often in both. The certification body fixes the audit language with you at application, and Bulgarian is the official language while English is commonly used in business. Tell the body early whether your procedures and records are in Cyrillic or in English, because that decides auditor allocation. A customer contract or a regulator's procedure can add its own language rule.
Has Bulgaria transposed the NIS2 Directive?
Bulgaria has amended its Cybersecurity Act for this purpose. The amending Act was adopted on 5 February 2026 and promulgated in State Gazette no. 17 of 13 February 2026, and it states that the Cybersecurity Act implements Directive (EU) 2022/2555. Covered entities, sector authorities and deadlines are for the Minister of e-Government, the Council of Ministers or your counsel to confirm.
Which authority supervises the GDPR in Bulgaria?
The Commission for Personal Data Protection, which the Personal Data Protection Act describes as a permanently operating independent supervisory authority. Courts acting in their judicial capacity fall under the Inspectorate to the Supreme Judicial Council instead. For a specific processing activity, put the question to the Commission or to your counsel.
Which body accredits certification bodies in Bulgaria?
BAS, the Executive Agency Bulgarian Accreditation Service, which says it is the sole accreditor of conformity assessment bodies in Bulgaria. It reports that EA confirmed its multilateral agreement status for management system certification on 1 October 2026. Ask any certification body for its BAS accreditation certificate and check that your standard and sector appear on it.
Do Bulgarian public tenders accept ISO certificates?
They can. As promulgated, the Public Procurement Act lets a contracting authority ask for certificates against European quality management standards or for EMAS and other recognised environmental systems. The certificates must come from independent bodies accredited by BAS or by another EA MLA signatory. Each tender sets its own criteria, so read the notice and check with the contracting authority.
What does the Bulgarian food regime ask of food businesses?
Permanent procedures built on HACCP principles, in the words of the Food Act, which follows Regulation (EC) No 852/2004 and exempts primary producers. A third-party certificate is not compulsory, though retailers and exporters may still ask for ISO 22000 or FSSC 22000. The Bulgarian Food Safety Agency can confirm how your registration is handled.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- General Data Protection Regulation (GDPR) and the Personal Data Protection Act (Закон за защита на личните данни) — dv.parliament.bg; edpb.europa.eu; eur-lex.europa.eu (accessed 18 Oct 2026)
- Accreditation of GDPR certification bodies — dv.parliament.bg (accessed 18 Oct 2026)
- Whistleblower protection — dv.parliament.bg (accessed 18 Oct 2026)
- Закон за киберсигурност (Cybersecurity Act), promulgated in State Gazette no. 94 of 2018 and amended and supplemented by the Act published in State Gazette no. 17 of 13 February 2026, which the National Assembly adopted on 5 February 2026. The amended Act states that it implements Directive (EU) 2022/2555. Management bodies approve the cybersecurity risk-management measures and oversee them, and the Council of Ministers may require use of ICT products certified under European cybersecurity schemes. The text refers to relevant standards but does not name ISO/IEC 27001 or ISO 22301. — dv.parliament.bg; eur-lex.europa.eu (accessed 18 Oct 2026)
- Regulation (EU) 2022/2554 (DORA), which applies from 17 January 2025. The Commission's DORA page in its legal framework section lists the delegated and implementing regulations on ICT risk management, incident reporting, the register of information and oversight. The page does not name ISO/IEC 27001. — fsc.bg; eur-lex.europa.eu (accessed 18 Oct 2026)
- Medical Devices Act (Закон за медицинските изделия) and Regulation (EU) 2017/745, whose Article 10 requires manufacturers to run a quality management system. The Agency says it registers devices under Chapter II of the Act in an electronic database and that registration is mandatory. Its page does not name ISO 13485. — bda.bg; eur-lex.europa.eu (accessed 18 Oct 2026)
- Закон за храните (Food Act), State Gazette no. 52 of 9 June 2020, and Regulation (EC) No 852/2004. The Act requires business operators other than primary producers to put in place and maintain permanent procedures based on the HACCP principles, in line with Article 5 of the Regulation. Neither source makes a third-party certificate compulsory. — dv.parliament.bg; eur-lex.europa.eu; efsa.europa.eu (accessed 18 Oct 2026)
- Закон за инспектиране на труда (Labour Inspection Act), State Gazette no. 102 of 28 November 2008, under which labour inspection covers control under the Healthy and Safe Working Conditions Act, and Directive 89/391/EEC on the employer's duty to ensure workers' safety and health. Neither text names ISO 45001. — dv.parliament.bg; eur-lex.europa.eu (accessed 18 Oct 2026)
- Directive (EU) 2023/1791, Article 11, which requires enterprises above an energy consumption threshold to run a certified energy management system, with energy audits for other large users. The amending act in State Gazette no. 105 of 30 December 2016 changed the Energy Efficiency Act's provisions on mandatory energy audits to take account of declared energy or environmental management systems. Neither text names ISO 50001. — eur-lex.europa.eu; dv.parliament.bg (accessed 18 Oct 2026)
- BAS (Изпълнителна агенция „Българска служба за акредитация“, the Executive Agency Bulgarian Accreditation Service) — nab-bas.bg; european-accreditation.org (accessed 18 Oct 2026)
- BDS (Български институт за стандартизация, the Bulgarian Institute for Standardization) — bds-bg.org (accessed 18 Oct 2026)
- Public procurement under the Public Procurement Act (Закон за обществените поръчки), State Gazette no. 13 of 16 February 2016 — dv.parliament.bg; eur-lex.europa.eu (accessed 18 Oct 2026)
- Customs free zones reported by Bulgaria to the European Commission — taxation-customs.ec.europa.eu (accessed 18 Oct 2026)
- Automotive and electronics manufacturing — investbg.government.bg (accessed 18 Oct 2026)
- IT and business process outsourcing — investbg.government.bg (accessed 18 Oct 2026)
- Health and life science, robotics and mechatronics — investbg.government.bg (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Frankfurt team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
germany@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice