Hungary

✅ NIS2 transposed and in force.

NIS2 transposition

• National law: Act LXIX of 2024 on Hungary’s Cybersecurity (Magyar Közlöny No. 130 of 2024-12-20)
• Status / entry into force: In force 2025-01-01 (repealed Act XXIII of 2023)

Competent authority & CSIRT

• Competent authority: Szabályozott Tevékenységek Felügyeleti Hatósága (SZTFH)
• CSIRT / incident response: National CSIRT
• Registration: Per SZTFH; implementing Government Decree 418/2024

Incident reporting

Follows the NIS2 cascade: early warning within 24h, notification within 72h, final report within one month, submitted to the national CSIRT / competent authority. Assume national-language submission unless the authority states otherwise.

Penalties & board liability

• Essential entities: up to €10M or 2% of worldwide turnover (directive minimum, adopted here).
• Important entities: up to €7M or 1.4% of worldwide turnover.
• Management-body accountability applies per NIS2 Art. 20; national enforcement mechanisms vary.

CER Directive

Critical-entities resilience is transposed in parallel (often via the same or a connected authority). Member States had to identify critical entities by 2026-07-17. ⚠️ VERIFY national CER instrument.

Notes

Uses an additional layer of ‘security classes’ (basic, significant, high) on top of essential/important. First audit deadline moved to 2026-06-30.

Sources

• https://sztfh.hu
• NIS2 Directive (EU) 2022/2555: https://eur-lex.europa.eu/eli/dir/2022/2555/oj
• Commission transposition tracker: https://digital-strategy.ec.europa.eu/en/policies/nis-transposition