Hungary NIS2 Transposition
National implementation of Directive (EU) 2022/2555. Covers essential and important entities in critical infrastructure. Supervised by the National Directorate General for Disaster Management.
| Jurisdiction | Hungary |
|---|---|
| Category | Cybersecurity |
| Status | Active |
| Latest development |
Analysis
Hungary has fully transposed the NIS2 Directive (Directive (EU) 2022/2555) through Act LXIX of 2024 on the Cybersecurity of Hungary, in force since 1 January 2025, complemented by Government Decree 418/2024 (XII.23.) and earlier Act XXIII of 2023 on cybersecurity certification and supervision for staged implementation and registration.Act LXIX overview | CMS summary of Cybersecurity Act & Decree 418/2024 | Chambers Cybersecurity 2025 – Hungary | Lex Mundi NIS2 Hungary
Below is a structured compliance-oriented analysis tailored to NIS2 in Hungary.
Key Requirements
Hungary’s NIS2 regime is primarily set out in Act LXIX of 2024 on the Cybersecurity of Hungary (often called the 2024 Cybersecurity Act) and detailed in Government Decree 418/2024 (XII.23.) on implementation.Act LXIX overview | CMS summary of Cybersecurity Act | Chambers Cybersecurity 2025 – Hungary
Scope and Entity Classification
- Coverage of “essential” and “important” entities
- Hungary follows NIS2 by categorizing in‑scope operators as essential entities (EEs) and important entities (IEs), based on sector, size, and criticality, aligning with Annexes I and II of NIS2.Eversheds NIS2 Hungary | Act LXIX description | Lex Mundi NIS2 Hungary
- The Act consolidates previous laws (notably Act XXIII of 2023) and applies to both public and private operators of critical services and infrastructure, including digital providers.Eversheds NIS2 Hungary | Chambers Cybersecurity 2025 – Hungary
- Sectoral coverage and exclusions
- The 2024 Cybersecurity Act implements NIS2 and CER (critical entities resilience) together, creating a unified framework for critical infrastructure sectors.Eversheds NIS2 Hungary | Lex Mundi NIS2 Hungary
- Certain sectors are excluded or handled by other EU acts, e.g. banking and financial market infrastructures (Annex I Sections 3–4 of NIS2) are handled under DORA, and classified/nuclear‑related systems fall under separate regimes.Chambers Cybersecurity 2025 – Hungary | Lex Mundi NIS2 Hungary
Registration and Designation Obligations
- Mandatory registration of in‑scope entities
- Under Act XXIII of 2023 and transitional rules, Hungary required entities subject to NIS2 to register by 30 June 2024 with the Hungarian Supervisory Authority for Regulated Activities (SZTFH/SARA).DLA Piper article – registration deadline | OpenKRITIS NIS2 Hungary | nisd2.eu Hungary page
- The new Act LXIX of 2024 and Government Decree 418/2024 further specify registration procedures, use of the national cybersecurity portal, and data to be submitted.CMS summary of Cybersecurity Act | NIS Solutions Hungary explanation
Cybersecurity Risk Management and Technical / Organisational Measures
- Comprehensive risk‑management obligations
- Essential and important entities must implement appropriate and proportionate technical and organisational measures to manage cybersecurity risks, consistent with NIS2 Article 21 (e.g. risk analysis, incident handling, business continuity, supply‑chain security, encryption, multi‑factor authentication).Directive (EU) 2022/2555 – NIS2 | CMS summary of Cybersecurity Act | Eversheds NIS2 Hungary
- Hungary’s Act LXIX of 2024 explicitly transposes these requirements and adds sector‑specific rules and audit requirements for covered infrastructure.Chambers Cybersecurity 2025 – Hungary | Act LXIX overview
- Governance and management accountability
- The Act mirrors NIS2’s management‑body responsibility, requiring top management to approve cybersecurity risk‑management measures, oversee implementation, and can be held personally liable (including possible temporary bans in serious cases).Directive (EU) 2022/2555 – NIS2 | Lex Mundi NIS2 Hungary | CMS summary of Cybersecurity Act
Incident Reporting Duties
- Multi‑stage incident notification
- Entities must report significant incidents following NIS2’s staged model: early warning within 24 hours, incident notification within 72 hours, and a final report within one month, as transposed into the Hungarian Act.Directive (EU) 2022/2555 – NIS2 | CMS summary of Cybersecurity Act | Eversheds NIS2 Hungary
- Government Decree 418/2024 sets procedural details for reporting (channels, templates, information required, competent authorities).CMS summary of Cybersecurity Act | NIS Solutions Hungary explanation
Supervision, Audits, and Enforcement
- Supervisory authority and audit regime
- Hungary established a comprehensive cybersecurity supervision regime in Act XXIII of 2023, now consolidated under Act LXIX of 2024, including certification, mandatory audits, supervisory fees, and enforcement powers.nisd2.eu Hungary page | CEE Legal Matters – Cybersecurity saga | Chambers Cybersecurity 2025 – Hungary
- The National Cyber Security Center (NKI) and SZTFH/SARA play major roles in supervision and audits, consistent with Hungary’s NIS2 implementation practice.NIS Solutions Hungary explanation | OpenKRITIS NIS2 Hungary
- Sanctions and fines
- Act LXIX of 2024 provides for administrative fines aligned with NIS2 levels, with higher fines and stricter oversight for essential entities than important entities.Directive (EU) 2022/2555 – NIS2 | Lex Mundi NIS2 Hungary | NIS Solutions Hungary explanation
Compliance Challenges
Complexity of Scope and Entity Classification
- Difficulty determining in‑scope status and category
- Many organizations struggle to interpret whether they qualify as essential or important entities, especially in sectors indirectly connected to critical infrastructure or digital services.Eversheds NIS2 Hungary | Chambers Cybersecurity 2025 – Hungary
- Commentary on Hungary’s “two‑stage” transposition notes that the overlap of Act XXIII of 2023 and Act LXIX of 2024 generated uncertainty for operators during the transition period.CEE Legal Matters – Cybersecurity saga | CMS summary of Cybersecurity Act
Registration and Deadline Management
- Meeting registration deadlines and data requirements
- The 30 June 2024 registration deadline imposed significant pressure, particularly on mid‑sized entities still clarifying their status and gathering required data.DLA Piper – registration deadline | OpenKRITIS NIS2 Hungary
- Reports indicate that entities faced challenges in using the national registration portals and aligning internal records to SZTFH’s expectations, especially multi‑entity groups.NIS Solutions Hungary explanation | nisd2.eu Hungary page
Integrating Risk Management and Governance
- Upgrading governance and accountability structures
- Many organizations needed to redefine board‑level responsibilities, risk committees, and reporting lines to comply with NIS2‑style management accountability requirements.Directive (EU) 2022/2555 – NIS2 | Lex Mundi NIS2 Hungary
- Legal analyses highlight uncertainty around personal liability, training requirements, and alignment with existing corporate governance frameworks and GDPR accountability duties.Chambers Cybersecurity 2025 – Hungary | CMS summary of Cybersecurity Act
Incident Response and Reporting
- Operationalizing multi‑stage reporting
- Organizations face challenges in detecting, classifying, and escalating incidents quickly enough to meet the 24/72‑hour reporting windows, especially where legacy monitoring is weak.Directive (EU) 2022/2555 – NIS2 | Eversheds NIS2 Hungary
- Practice guides note confusion around thresholds for “significant” incidents, coordination with data‑protection breach reporting, and harmonizing internal playbooks.Chambers Cybersecurity 2025 – Hungary | Lex Mundi NIS2 Hungary
Resource and Audit Burden
- Costs of audits and compliance programs
- The introduction of mandatory cybersecurity audits, certification and supervisory fees under Act XXIII of 2023 and carried into Act LXIX of 2024 creates significant cost and resource burdens, particularly for “important entities.”nisd2.eu Hungary page | CEE Legal Matters – Cybersecurity saga
- Commentators note shortage of qualified auditors and consultants, leading to increased prices and scheduling bottlenecks for compliance projects.NIS Solutions Hungary explanation | CMS summary of Cybersecurity Act
Implementation Best Practices
1. Structured Gap Assessment Against NIS2 and Act LXIX of 2024
- Benchmark against NIS2 core requirements and Hungarian specifics
- Organizations should conduct a systematic gap analysis mapping current controls to NIS2 Article 21 requirements and Hungary’s implementing provisions in Act LXIX and Government Decree 418/2024.Directive (EU) 2022/2555 – NIS2 | CMS summary of Cybersecurity Act | Lex Mundi NIS2 Hungary
- External guides (e.g. global NIS2 implementation trackers and Hungarian practice guides) recommend prioritizing measures with the highest risk reduction and compliance impact, such as incident detection, business continuity, and access management.Chambers Cybersecurity 2025 – Hungary | NIS Solutions NIS2 Hungary 2026
2. Governance and Role Definition
- Create a clear NIS2 governance model
- Best practice is to assign a senior executive or committee responsible for NIS2 compliance, with formal board reporting and oversight, reflecting NIS2’s management‑body accountability.[Directive (EU) 2022/2555 – NIS2](https
Recent developments
- — Eversheds Sutherland reports that Hungary has introduced further refinements to its NIS2 transposition regime as of January 2026, clarifying size thresholds and narrowing the scope for certain private‑sector entities, which may reduce the number of in-scope organizations and allow some to de‑register from supervision.[5] (source)
- — Legiscope’s 2026 NIS2 Enforcement Tracker notes that Hungary is among the 23 EU Member States that have fully transposed NIS2 and has already imposed a first confirmed fine of €78,000 under its new cybersecurity regime, signaling that enforcement and audits are now operational and penalties real for non-compliance.[8] (source)
- — CMS Hungary highlights that as of 6 January 2026, an amendment to the Hungarian Cybersecurity Act (implementing NIS2) revises the scope of entities in critical sectors, meaning some businesses may now fall outside the regime and can de‑register from the Supervisory Authority for Regulatory Affairs (SZTFH).[7] (source)
- — CMS reports that Government Decree 418/2024, adopted on 23 December 2024, sets detailed rules for implementing Hungary’s Cybersecurity Act, including registration, supervisory procedures, and audit timelines, shaping how NIS2 obligations are applied in practice to essential and important entities.[3] (source)
- — Hungarian Chamber of Commerce and Industry (MKIK) and the Supervisory Authority of Regulated Activities (SZTFH) proposed extending the deadline for mandatory NIS2 cybersecurity audits from 31 December 2025 to 30 June 2026, while keeping the obligation to contract with an officially registered auditor by 31 August 2025, reflecting industry concerns over capacity and readiness.[9] (source)
- — Eversheds Sutherland notes that Hungary’s comprehensive NIS2 transposition via Act LXIX of 2024 became operational on 1 January 2025, with implementing decrees adopted in January 2025 on cybersecurity audits and annual supervisory fees, triggering immediate compliance obligations and cost impacts for in-scope entities.[5] (source)
- — CMS details that under the Cybersecurity Act and NIS2 transposition, entities already registered with SARA as of 31 December 2024 must submit information on EU member states where they provide services by 15 February 2025 and comply with new registration, auditor contracting, and audit deadlines, significantly tightening regulatory oversight.[3] (source)
- — NIS2-Directive.com summarizes that Act LXIX of 2024 on the Cybersecurity of Hungary, which entered into force on 1 January 2025, is the primary legislative instrument implementing NIS2, replacing earlier cybersecurity laws and creating an integrated national framework that expands scope and strengthens requirements for network and information systems security.[2] (source)
- — CMS explains that on 20 December 2024, Hungary adopted Act LXIX of 2024 on Cybersecurity in Hungary, repealing the partial NIS2 transposition Act XXIII of 2023 and consolidating public and private sector cybersecurity obligations into a single statute, representing a major structural change in the country’s cybersecurity regulation.[3] (source)
- — The European Commission issued a reasoned opinion to Hungary and 18 other Member States in late 2024 for failing to notify full NIS2 transposition by the 17 October 2024 deadline, increasing pressure on the Hungarian government and indirectly driving accelerated adoption of the comprehensive Cybersecurity Act later that year.[6] (source)
Related regulations
- NYDFS Cybersecurity Regulation — New York, Active, effective 2025-11-01
- Law on Cybersecurity of Vietnam — Vietnam, Active
- Austria NIS2 Act — Austria, Upcoming
- Luxembourg NIS2 Transposition — Luxembourg, Active
- EU Cyber Resilience Act (CRA) — European Union, Phased, effective 2027-12-11
- EU Cyber Resilience Act - Vulnerability and Incident Reporting (11 Sep 2026) — European Union, Active, effective 2026-09-11
- Netherlands NIS2 Transposition (Cyberbeveiligingswet) — Netherlands, Active, effective 2026-08-15
- Belgium NIS2 Transposition — Belgium, Active, effective 2024-10-18
Put it into practice
- Generate the policy: NIS2 policy generator (generatepolicy.com)
- Buy the policy pack: NIS2 Compliance Policy (cyberpolicy.shop)
- Build it yourself: DORA + NIS2 EU Compliance Workbook (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates