NIS2 Hungary: Cybersecurity Act, Authorities & Key Requirements
Understand how Hungary implements the NIS2 Directive (EU) 2022/2555 through the new Cybersecurity Act, which entities are in scope, how registration and mandatory audits work, who supervises compliance, and what steps you should take to get ready.
Introduction: NIS2 Directive & the Hungarian context
Hungary has moved from a fragmented cybersecurity framework to a single, comprehensive Cybersecurity Act that implements the NIS2 Directive and extends obligations to a wide range of public and private entities. If you operate critical or important services in Hungary, you are likely subject to strict registration, audit and incident-reporting rules.
NIS2 Directive implementation in Hungary
Hungary initially implemented NIS2 through Act XXIII of 2023 on cybersecurity certification and cybersecurity supervision. This has now been replaced and consolidated by Act LXIX of 2024 on the cybersecurity of Hungary (the “Cybersecurity Act”), in force since 1 January 2025, together with detailed rules in Government Decree 418/2024.
Status
NIS2 is transposed. The unified Cybersecurity Act has applied since 1 Jan 2025.
Official law
The main instrument is Act LXIX of 2024 on the cybersecurity of Hungary, supplemented by Government Decree 418/2024 on implementation and several SZTFH decrees (e.g. on audits and supervisory fees).
Registration & audits
Entities classified as essential or important must register with the national cybersecurity authority and are subject to regular cybersecurity audits by accredited auditors, plus an annual cybersecurity supervisory fee.
The Act covers high-risk and at-risk sectors very similar to Annex I and II of NIS2, and also extends obligations to a wider set of organisations that support critical state and municipal functions.
NIS2 Hungary: what you need to know about compliance & audits
Hungary combines NIS2’s “essential / important” model with national classifications of “high-risk” and “at-risk” sectors, backed by mandatory audits and supervisory fees.
Scope & in-scope entities
- Service providers in sectors listed as high-risk (Annex 1) or at-risk (Annex 2) under the Act.
- Medium-sized and larger organisations (≥50 employees or ≥€10m turnover), plus certain entities in key sectors regardless of size.
- Public bodies and operators of electronic information systems critical to state and municipal functions.
Core obligations
- Implement risk-management and security measures for all in-scope electronic information systems.
- Register with the cybersecurity authority and keep data up to date.
- Conclude a contract with a registered cybersecurity auditor and undergo regular audits.
- Report significant cybersecurity incidents to the National Cyber Security Center (NCSC Hungary) within tight deadlines.
- Pay an annual cybersecurity supervisory fee to the authority.
Standards & certification
The Act does not mandate a single standard (such as ISO/IEC 27001), but allows regulators to require use of ICT products and services certified under Hungarian or European cybersecurity certification schemes. Aligning with recognised frameworks (ISO 27001, NIST CSF, IEC 62443, etc.) is strongly advised.
National NIS2 timeline & key dates (Hungary)
Sector-specific requirements (Hungary)
- High-risk sectors: energy, transport, banking and financial market infrastructures, health, drinking water, wastewater, digital infrastructure and ICT service management, public administration and others broadly aligned with NIS2 Annex I.
- At-risk sectors: postal and courier services, waste management, food production and distribution, manufacturing of key products (e.g. medical devices, pharmaceuticals, electronics), and certain digital services, reflecting Annex II of NIS2.
- State & municipal bodies: the Cybersecurity Act also captures many public bodies that operate critical electronic information systems, with specific duties for information security officers and system classification.
Penalties for non-compliance
Hungary’s regime closely follows (and in some cases sharpens) NIS2’s penalty levels. Administrative fines are imposed by SZTFH (or the relevant authority) and can be combined with orders to remediate, increased supervision or, in severe cases, restrictions on activities.
- For essential entities, fines can reach the HUF equivalent of EUR 10 million or 2% of worldwide annual turnover, whichever is higher.
- For important entities, caps are generally up to the HUF equivalent of EUR 7 million or 1.4% of worldwide annual turnover, whichever is higher.
- Specific breaches (e.g. failing to register, missing an audit deadline, not operating a risk-management framework, or not paying the supervisory fee) have their own fine ranges in HUF, and repeated non-compliance can lead to re-imposed or escalated fines.
- In serious or repeated cases, fines may also be imposed personally on the head of the organisation, alongside organisational penalties.
How to prepare for NIS2 in Hungary
- Confirm scope: map your services and electronic information systems against the high-risk and at-risk sector lists and determine whether you are an essential or important entity.
- Register (or update data): ensure your organisation is correctly registered with the competent cybersecurity authority and that all mandatory data (including cross-border service locations) is up to date.
- Classify systems: perform the required classification of electronic information systems, using the national security classes and templates referenced in the Cybersecurity Act and related decrees.
- Contract an auditor: select a registered cybersecurity auditor, sign the mandatory audit contract and plan your audit timeline so you meet statutory deadlines.
- Strengthen risk management: implement or enhance controls in line with recognised frameworks (ISO 27001 / NIST CSF / IEC 62443, etc.), covering IT and OT systems where applicable.
- Build incident readiness: set up monitoring, escalation and incident response processes that meet Hungarian incident reporting timelines to NCSC Hungary.
- Budget for supervisory fees: factor the cybersecurity supervisory fee and audit costs into your compliance budget and establish internal ownership for payments and declarations.
- Train leadership & staff: brief executives on their responsibilities (including potential personal liability) and roll out regular awareness training and exercises.