Does putting a human on the line help in Bulgaria?

No, and Bulgarian law says so more clearly than anywhere else. The automated calling rule covers calls made with or without human intervention, so the presence of a person changes nothing about whether it applies. What decides is the purpose, and an internal security test is not marketing or advertising.

Can we record the simulated calls in Bulgaria?

Take it to counsel. Both interception prohibitions are drawn around people who are not on the call, so the statutory route is open, but the Constitution bars recording someone without their knowledge save where the law provides. That conflict is unresolved. Consider whether you need the audio at all.

Do we need a Bulgarian company to hold a number?

We cannot tell you, and we would rather say that than guess. The regulator's numbering ordinance is not published in a readable form, so no local presence requirement is asserted or denied here. If your carrier asks for one, ask which instrument it comes from before treating it as a rule.

Compliance

Voice phishing simulations in Bulgaria

Phone numbers in BulgariaProvisioned by Callstrike after approval

Bulgaria draws the line on automated calling better than anywhere else in this portal. Its rule covers calls made with or without human intervention, so putting a person on the line changes nothing and the purpose alone decides, which leaves a voice phishing simulation outside it. What is genuinely unsettled here is recording, because the Constitution uses a knowledge standard rather than a permission one, and that is the decision to take before the campaign is designed.

Phone numbers

Supplied by Callstrike

Local numbers in Bulgaria, after a one-time approval.

Running a simulation

Permitted, and the purpose decides

A live caller and a synthetic one are treated identically. Only what the call is for matters.

Consent

Contested here, unusually

One published regulator answer on monitoring omits legitimate interests entirely.

Getting a phone number in Bulgaria

One approval per country, completed in the console.

Provisioned by Callstrike after approval

Your company files its regulatory details once for this country. Local rules require the order to be placed by the provider of record, so Callstrike provisions the number on your behalf once the filing is approved. Approval is a one-time, per-country step and usually takes 3 to 5 business days. We only ask for what the regulator requires.

Two documents carry the Bulgarian filing. An excerpt from the commercial register proves the business identity, and a utility bill, a tax notice, a rent receipt or a title deed proves the local address, dated within the last three months and sitting inside the locality or region the number's own prefix covers. Your unified identification code, your business website and the authorised representative's name, phone number and email go into the console form directly rather than being evidenced by anything.

One thing has to be said plainly, because the sourced position further down this page says something that would otherwise look inconsistent with the requirements below. Those documents come from the carrier's own onboarding, discharged in one place through the clearance form. What we could not establish is whether the Bulgarian regulator itself imposes any local presence or company registration requirement on the end user of a number: we read the relevant chapters of the electronic communications act and the Commission's own index of its instruments, and the numbering resources ordinance is not published in machine-readable form. So the page asserts no such regulatory requirement and does not deny one either. The two halves answer different questions, and the table below is what you will actually be asked for.

On what the person sees, present a number your provider has genuinely allocated to you. The identification is generated by the originating network, must carry the calling party's number, and, regardless of the technology used to provide the voice service, must display unchanged the number the undertaking provided to that party. That clause about technology is the one that matters for how this work is actually done, because it puts an origination over internet protocol squarely inside the rule rather than outside it. If your simulation runs through a corporate exchange, direct inward dialling decides whether the employee sees the full number with the extension or just a number identifying the exchange.

01Complete the regulatory clearance formYour administrator, in the Callstrike console. The form asks only for what the regulator requires.
02Approval is granted against your workspaceTypically three to five business days, and once only for as long as you operate here.
03A dedicated number in Bulgaria is assigned to youCallstrike
04Build and launch the campaignYour team

What you provide	Accepted evidence, any one of
Proof of business identity	Excerpt from the commercial register
Proof of local addressMust be within locality or region covered by the phone number's prefix; a PO Box is not acceptable where a local address is required. Address document must be dated in the last 3 months.	Utility bill, Tax notice, Rent receipt, Title deed

These requirements are set by the carrier and can change. The form in the console is generated from their current rules, so treat it as authoritative and this table as a summary of what to have ready. Checked 2026-09-07.

Is it lawful to run a simulation in Bulgaria?

The position in short, before your counsel reads the detail below.

Yes, and Bulgaria settles the question everyone else leaves open. Its transposition of the European automated-calling rule permits calls, messages or electronic mail, with or without human intervention, for the purposes of direct marketing and advertising only with prior consent. Read the two halves of that. The scope is a purpose, and an authorised test of your own workforce is neither marketing nor advertising, so the rule does not reach it. And because the words cover calls made with or without human intervention, a live caller and a synthetic one are treated identically: putting a person on the line changes nothing, and equally a synthetic voice pulls no non-marketing call into scope. Anyone selling human-in-the-loop delivery as a route around Bulgarian law is describing a distinction the statute expressly declines to draw. There is a further reading in your favour that we state as a reading rather than as settled law: the protected person is defined as someone using the service for purposes outside their trade, business, employment or profession, and an employee taking a call on a work line in the course of employment is not obviously within it.

The concrete Bulgarian obligation has no counterpart on most of these pages, and it is a document rather than an assessment. As controller you must adopt rules and procedures for the use of a breach reporting system, for restrictions on the use of internal company resources, and for the introduction of systems controlling access, working time and labour discipline. Those rules have to set out their scope, the obligations and the methods of applying them in practice, and workers must be informed of them. That is the natural home for the programme-level notice a simulation depends on. Be precise about its reach, though: the article does not use the words monitoring or security testing, so we are not asserting a simulation is unambiguously inside the third limb, while the second plainly covers an acceptable use policy for corporate phones. Consultation is information and consultation with no veto attached, with representatives elected at fifty workers and at twenty in a distinct unit.

Now the local fact that cuts against the standard European answer, which you should hear here rather than from your own data protection officer. The Bulgarian authority has published practical guidance saying that where data are processed for the purposes of an employment relationship the worker has no genuinely free choice, because of the obvious inequality between the parties. That endorses the position this portal takes everywhere. But the same authority's published question and answer on workplace monitoring says that where the purpose is control of the work process and working time, the controller may record only where there is a statutory basis or express consent, and it does not name legitimate interests as available at all. The second is about video surveillance rather than security testing, and it is a question and answer rather than a reasoned opinion. We are not going to resolve the tension and we are not going to leave it out. Expect it to come up and have your assessment ready.

Recording ends without an answer, and that is the honest outcome rather than a gap in the research. Both statutory prohibitions are drawn around people who are not on the call: the telecoms confidentiality rule reaches persons other than the sender and the recipient, and the criminal offence requires a message not addressed to the listener. A party satisfies neither description, so on the face of both texts the statutory route is open. The Constitution cuts the other way, providing that no one may be followed, photographed, filmed, recorded or subjected to other similar actions without his knowledge or despite his express refusal, save in the cases provided for by law. Read literally that is a knowledge standard, and a telephone simulation is by design conducted without the target's knowledge at the moment of the call. Whether the telecoms provision is a case provided for by law is an argument rather than a finding. Separately, the European transparency duty binds you as deployer since August 2026 and has no security-testing exception.

What your company needs to do

7 items, in the order you will need them.

Ask whether you need the audio at allBulgaria-specificThis is the Bulgarian decision and answering it no makes the hardest question on the page go away. A programme that records what happened and when, rather than the conversation, never has to reconcile the constitutional knowledge standard with the statutory participant framing. If you do want the audio, take that specific point to Bulgarian counsel before the campaign rather than after it.
Adopt and publish the written rules, and put the programme in themBulgaria-specificThe data protection act requires rules and procedures stating their scope, the obligations and the methods of applying them, with workers informed. That document already has to exist, so the question is whether an awareness exercise is named in it. Name it, and use the same document to carry the acceptable use policy for corporate phones that the second limb plainly covers.
Have the legitimate interests assessment ready for a question you will be askedBulgaria-specificThe regulator's own published answer on workplace monitoring names a statutory basis or express consent and does not mention legitimate interests. Your Bulgarian data protection officer will have read it. Write the assessment so it answers that reading directly, rather than assuming the standard European position will go unchallenged here.
Inform and consult, without waiting for agreementEmployee representatives are elected in undertakings of fifty or more, and at twenty or more in an organisationally and economically distinct unit. They are owed information and consultation, and no provision makes a decision conditional on their agreement. Do it early anyway, because the rules above are more persuasive when the representatives saw them first.
Disclose that the voice is generatedThe European transparency duty binds a deployer of a system generating audio constituting a deep fake at the latest at the first exposure, with carve-outs only for criminal-law authorisation by law and evidently artistic works. Your own authorisation of your own exercise is neither. The debrief that closes the call is where this belongs.
Present a number your provider allocated to youThe rules require the originating network to display unchanged the number the undertaking provided to the calling party, regardless of the technology used to carry the voice service, and interconnecting operators must pass it on without altering it. A number you genuinely hold satisfies all of that without an argument.
Keep the credential out of the systemMeasure the behaviour and discard what the pretext asked for. It is the cheapest way to keep the exercise proportionate on any reading of the tension described above, and it removes the largest category of data the rules you publish would otherwise have to account for.

The controls that do the work

How Callstrike is configured, and which provision in Bulgaria each choice answers.

Auto-hangup before disclosure

The bot ends the call at the moment an employee starts to give up a credential or a piece of personal data, so the thing the pretext asked for is never spoken into the system and never stored.

Bulgaria's hardest question is about what the exercise captures, so the control that shrinks the capture is the one that matters most here. The call ends the moment an employee begins to give up a credential, and what the programme keeps is that a call happened and what the person did rather than a recording of the conversation. That is what makes the advice in the sourced position below workable rather than merely sensible: the constitutional knowledge standard is about being recorded, and an exercise holding no recording of the exchange does not have to answer it at all.

In-call debrief and follow-up

A second voice breaks character as soon as the call ends, explains what just happened and why it worked, and a follow-up email repeats it in writing while the moment is still sharp.

The rules you have to adopt must state the methods of applying them in practice, which means how the exercise treats the people inside it is a term in a document rather than an internal understanding. A second voice that breaks character the moment the call ends, with vishing training in writing the same day, is exactly the kind of method that can be written down and shown to the employee representatives you are informing and consulting.

Consent Management

Two modes: collect consent now, over email, Slack or Teams with a full audit trail per employee; or record that your organisation already has this covered, by uploading the policy, handbook clause or agreement and confirming the scope it applies to. The document is hashed, the attestation is signed and timestamped, and an audit email is issued. Included on every plan.

The Bulgarian authority has said in its practical guidance that a worker has no genuinely free choice in the employment relationship, so this is not the ground the programme rests on, and this page does not pretend its two published statements agree with each other. What it produces is the evidence that workers were informed of the rules, dated, or a hashed copy of the rules and the acceptable use policy with a signed attestation of the scope they cover. Both regulator statements point at that same deliverable even where they disagree about the ground.

SCORM module

An interactive web presentation on voice-phishing risk, delivered through your own LMS, which then invites the learner to opt into a web call with the bot. A call the person starts themselves in a browser is not a telephone call, so telephony rules do not reach it.

This is the one delivery that answers the Bulgarian recording question rather than arguing about it. Callstrike's vishing simulator can deliver the same deepfake voice through a web call the learner starts themselves after working through the module. The constitutional provision is written about recording a person without his knowledge, and a learner who opts into the call after the module has that knowledge by construction, so the standard is met rather than debated. The automated calling rule was never engaged, and the European transparency duty still applies, which is why the module names the synthetic voice on its own face.

Consent Management is included on every plan. See AI voice phishing simulation and human-in-the-loop voice phishing for how each is delivered.

The sourced position

Everything above, with the instruments behind it. Every claim cites the statute or the regulator it comes from, so your counsel can verify it rather than rely on our summary.

The rules you must write down, and a tension worth knowing about

Bulgaria adds no national derogation for security testing, and its data protection act says in its own first article that it governs only to the extent the European Regulation does not. So the basis is legitimate interests under Article 6(1)(f), documented as an assessment, with an impact assessment for systematic monitoring.

There is one Bulgarian obligation that has no counterpart on most of these pages, and it is concrete. An employer, as controller, must adopt rules and procedures for the use of a reporting system for breaches, for restrictions on the use of internal company resources, and for the introduction of systems controlling access, working time and labour discipline. Those rules must set out their scope, the obligations and the methods of applying them in practice, and workers must be informed of them. That is a documentation and notice duty rather than a consent requirement, and it is the natural home for the programme-level notice a simulation depends on. We should be precise about its reach: the article does not use the words monitoring or security testing, so we are not asserting that a simulation is unambiguously inside the third limb. The second limb, restrictions on the use of internal company resources, plainly covers an acceptable use policy for corporate phones.

Now the tension, which we would rather you heard here than from your own data protection officer. The Bulgarian authority has published practical guidance saying that where data are processed for the purposes of an employment relationship the worker has no genuinely free choice and cannot refuse or withdraw without adverse consequences, because of the obvious inequality between the parties. That is a direct endorsement of the position this whole portal takes. But the same authority's published question and answer on workplace monitoring says that where the purpose is control of the work process and working time, the controller may record only where there is a statutory basis or express consent, and it does not name legitimate interests as available at all.

Those two statements sit uneasily together. The second is about video surveillance for work-process control rather than about security testing, and it is a question and answer rather than a reasoned opinion. We are not going to resolve it for you, and we are not going to leave it out, because a page that omits it is hiding the one local fact that cuts against the standard European answer. Expect it to come up and have your assessment ready.

Consultation is information and consultation rather than a veto. Employee representatives are elected in undertakings with fifty or more workers, and in organisationally and economically distinct units with twenty or more, and the employer owes them information and consultation. There is no provision making a decision conditional on their agreement.

Recording, and the constitutional standard nobody can close

This block ends without an answer, and that is the honest outcome rather than a gap in the research.

Both statutory prohibitions are drawn around people who are not on the call. The telecoms confidentiality rule prohibits listening to, recording, storing or otherwise intercepting communications by persons other than the sender and the recipient. The criminal offence requires that the message be one not addressed to the person, obtained unlawfully by special technical means. A party to a call is the sender or the addressee and satisfies neither description, so on the face of both texts the statutory route to a participant recording is open.

The Constitution cuts the other way, and this is the provision that cannot be reconciled from published sources. It provides that no one may be followed, photographed, filmed, recorded or subjected to other similar actions without his knowledge or despite his express refusal, save in the cases provided for by law. Read literally that is a knowledge standard, not a consent standard, and a simulation is by design conducted without the target's knowledge at the moment of the call. Whether the telecoms provision counts as a case provided for by law, because it defines the boundary of the prohibition, is an argument rather than a finding.

There is one place the legislature did legislate for business recording, and its shape is instructive. Recording is permitted where it is necessary and provided for by law to evidence the conclusion of commercial transactions, and where the sender and recipient have been notified in advance of the recording, its purposes, the retention period and the right to refuse. That does not cover awareness testing, and its advance-notice condition is the opposite of what a simulation needs. We cite it to show where the legislature did act, and that it did not act here.

So the practical advice is unsatisfying and correct. Take the recording question to Bulgarian counsel, and before you do, ask whether you need the audio at all. A programme that records only what happened and when, rather than the conversation, does not have to answer this question.

The cleanest drafting on this question in Europe

Bulgaria's transposition of the European automated-calling rule is drafted better for our purposes than any other in this cluster, and it settles two questions at once.

The provision permits the making of calls, messages or electronic mail, with or without human intervention, for the purposes of direct marketing and advertising, only with the prior consent of the consumer, withdrawable at any time. Three things follow and all three matter.

First, the rule is scoped by purpose and not by technology. The scope words are for the purposes of direct marketing and advertising. An authorised security test of an employer's own workforce is neither, so the rule does not reach it.

Second, and this is the part worth carrying to any supplier conversation, the words with or without human intervention mean the prior consent rule applies identically whether a person or a machine is speaking. So in Bulgaria there is nothing for a live operator to bypass, because the presence of a human changes nothing about whether the rule applies. Equally, using a synthetic voice does not pull a non-marketing call into scope. Anyone selling human-in-the-loop as a route around Bulgarian law is describing a distinction the statute expressly declines to draw.

Third, the protected person is defined as a natural person using a public electronic communications service for purposes outside the scope of their trade, business, employment or profession. An employee taking a call on a work line in the course of employment is, on the face of that definition, not within it. We state that as a reading of the definition rather than as settled Bulgarian law, because no case law or regulator opinion applying it to employer-to-employee calls could be found.

The rule that does reach an AI voice here is European. Article 50 of the EU AI Act has applied since 2 August 2026, requiring a system built to interact directly with people to be designed so the person is informed they are dealing with an AI system, and requiring whoever deploys a system generating or manipulating audio constituting a deep fake to disclose that the content is artificially generated, in both cases at the latest at the first interaction. The only exceptions on the face of the text are use authorised by law to detect, prevent, investigate or prosecute criminal offence, and evidently artistic or fictional works, where the duty is narrowed rather than removed. An employer's own authorisation is not authorisation by law. One element is genuinely open and we will not close it: whether a synthetic voice resembling no identifiable person meets a definition requiring resemblance to existing persons, objects, places, entities or events.

The transparency article is not the only part of that Regulation with a date on it, and the other one arrived first. The prohibition on using AI systems to infer emotions of a natural person in the workplace has applied since 2 February 2025, a full six months before the disclosure duties described above, so a product already in service has been inside its scope for longer than most buyers realise. Its exception is for medical or safety reasons and nothing else. What gates it is the definition of an emotion recognition system, confined to inference from biometric data, and the recitals put the mere detection of readily apparent expressions outside that. Logging outcomes is untouched. Inferring feeling from a voice is the question, and it carries seven per cent of worldwide turnover.

Present a number you actually hold

The Bulgarian regulator's rules on calling line identification are as close to an anti-spoofing rule as the country has, and they are directed at the originating network rather than at you. The identification is generated by the network the call originates from, must contain the calling party's number and a presentation indicator, and, regardless of the technology used to provide the voice service, must display unchanged the calling party's number that the undertaking has provided to that party for use. Freephone numbers from the 800 range may also be presented.

That clause about technology matters for how this work is actually done: an origination over internet protocol is squarely inside the rule rather than outside it. The operational read across is short. Present a number your provider has actually allocated to you.

Two further rules shape what the person sees. On interconnection, undertakings must pass the identification without altering it, and the originating undertaking must generate and deliver it without changing the settings the calling party entered. And the number displayed has to permit a return call, with an explicit rule for calls leaving a private branch exchange: with direct inward dialling the full number including the extension is shown, and without it a subscriber number identifying the exchange is shown. If your simulation runs through a corporate exchange, that determines what the employee sees when they look at their handset.

What the country matrix holds for Bulgaria

Number types:: Local
Restricted for automated outbound:: None recorded

Generated from the same country matrix the platform enforces at dispatch, so it cannot drift from what you can actually buy.

An open item, stated as one

This is the weakest block on the Bulgarian page and we would rather say so than fill it with reassurance.

What is established is the structure. Public electronic communications networks or services are provided after notification to the Commission, and are carried out by sole traders and legal persons. The Commission may also grant national numbering resources to undertakings that are not themselves providers, where sufficient resources are available and the undertaking demonstrates that it can manage them and comply with the conditions of the authorisation. Identifying the end user is an obligation on the undertaking rather than a clearance procedure imposed on you.

What is not established is whether the regulator imposes any local presence or company registration requirement on the end user of a Bulgarian number. We read the relevant chapters of the electronic communications act in full and the Commission's own index of its instruments, and attempted the numbering resources ordinance, which is not machine readable in the copy published. So we assert no such requirement and we do not deny one either. If your carrier asks for a Bulgarian registration, treat that as its own onboarding rather than as a rule you have been shown, and ask which instrument it comes from.

NIS2, transposed, with a duty that lands on the board

Bulgaria has transposed NIS2, which is not true of every country in this cluster. The Cyber Security Act was substantially amended by an act promulgated in the State Gazette on 13 February 2026 and further amended in June 2026. We confirmed that at the Gazette issue itself rather than at a consolidator, because a consolidator lagging a fresh amendment is exactly the failure this research is designed against.

The provision worth knowing is that workforce security training is framed as a personal duty of the management body rather than as a delegable operational task. That changes who has to care about the programme internally, and it is a useful thing to be able to point at when a testing budget is being argued over.

For financial entities DORA applies directly, with compulsory awareness and resilience training modules for all staff and senior management, a testing programme, and threat-led penetration testing for entities in scope. The national financial supervisor publishes its own information on applying it. As everywhere, social engineering is a standard technique within that testing and is not named in the Regulation, so treat a claim that DORA requires vishing as a sales line.

Take this further

Research prompt for your own AI assistant

Paste into Claude, Harvey or your firm's tool to pressure-test the position above.

You are advising on an authorised internal security exercise in BULGARIA. Our own employees receive a simulated voice-phishing call, placed by our vendor on our instruction, to measure susceptibility. No credential is captured or stored. The workforce is informed in advance at the programme level.

Verify or correct each proposition below against primary Bulgarian sources, and tell me whether we may record the calls:

1. ZES art. 261(1) covers calls «със или без човешка намеса» and is scoped to «пряко предлагане на стоки и услуги» purposes, so an internal test is outside it and a live operator changes nothing. Confirm both halves.
2. Is an employee taking a call on a work line a «потребител» within ZES's definition (purposes outside their trade, business, employment or profession)? We state this as a reading; is there any KZLD or court authority?
3. ⚠⚠ THE OPEN QUESTION: Конституция чл. 32(2) bars recording a person «без негово знание» save «в предвидените от закона случаи», while ZES art. 246 and НК чл. 171(3) are both drawn around NON-PARTICIPANTS. Does the ZES provision count as a case provided for by law? Supply Constitutional Court authority.
4. ЗЗЛД чл. 25и requires the employer-controller to adopt rules and procedures for the breach reporting system, restrictions on internal company resources, and systems controlling access, working time and labour discipline. Is an awareness simulation inside the third limb?
5. ⚠ KZLD's practical guidance says employment consent is not freely given, but its published Q&A on workplace monitoring names ONLY a statutory basis or express consent and omits legitimate interests. Which position governs a security test?
6. Кодекс на труда чл. 7а and 130в give information and consultation with no agreement requirement, at 50 workers and at 20 in a distinct unit. Confirm.
7. AI Act Art 50 binds us as deployer since 2 August 2026, with carve-outs only for criminal-law authorisation and evidently artistic works.
8. ⚠ THE GAP WE COULD NOT CLOSE: Наредба № 1 on numbering resources is not machine readable. Does the KRS impose any LOCAL PRESENCE or company registration requirement on the END USER of a Bulgarian number, as opposed to on the undertaking?

Flag anything that has changed since September 2026, and identify any obligation in our own колективен трудов договор that this analysis omits.

Common questions

Does putting a human on the line help in Bulgaria?: No, and Bulgarian law says so more clearly than anywhere else. The automated calling rule covers calls made with or without human intervention, so the presence of a person changes nothing about whether it applies. What decides is the purpose, and an internal security test is not marketing or advertising.
What does a Bulgarian employer have to write down?: Rules and procedures for its reporting system, for restrictions on the use of internal company resources, and for systems controlling access, working time and labour discipline. They must state their scope, obligations and methods, and workers must be informed of them. That is where your programme notice belongs.
Can we record the simulated calls in Bulgaria?: Take it to counsel. Both interception prohibitions are drawn around people who are not on the call, so the statutory route is open, but the Constitution bars recording someone without their knowledge save where the law provides. That conflict is unresolved. Consider whether you need the audio at all.
Do we need a Bulgarian company to hold a number?: We cannot tell you, and we would rather say that than guess. The regulator's numbering ordinance is not published in a readable form, so no local presence requirement is asserted or denied here. If your carrier asks for one, ask which instrument it comes from before treating it as a rule.

Elsewhere in Central and Eastern Europe

The rules differ by country even inside one region. These are the nearest guides to this one, each showing how phone numbers are obtained there.