NIS2 obligations in Hungary

Competent authority & CSIRT Legal ref: Art. 1, 38. (new Act), Art 27. Government Decree 418/2024

• Authority for the Supervision of Regulated Activities (SARA). ecs-org.eu · 28 Oct 2026 · secondary source
• Ministry of Justice. ecs-org.eu · 28 Oct 2026 · secondary source
• Additional responsibilities listed under Chapter VII of the Government Decree 418/2024 ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Art. 1 (new Act), Annex 1, 2 (old Act)

• Sectors and subsectors in addition to NIS2: ecs-org.eu · 28 Oct 2026 · secondary source
• Public transport subsector (added to transportation sector). ecs-org.eu · 28 Oct 2026 · secondary source
• Manufacture of cement, lime and plaster subsector (added to the manufacturing sector). ecs-org.eu · 28 Oct 2026 · secondary source
• Electronic communications services (added as a sector). ecs-org.eu · 28 Oct 2026 · secondary source
• Water and wastewater (combined as the water utility services sector). ecs-org.eu · 28 Oct 2026 · secondary source
• (Banking and financial market infrastructures are out of scope and covered by DORA). ecs-org.eu · 28 Oct 2026 · secondary source
• The new Act requires entities to classify their data assets, according the data classification, calssify the electronic information systems into three security levels: basic, significant, or high. This classification is based on the risks to data integrity, system availability, and data confidentiality, with stricter security measures applied to higher-risk systems. ecs-org.eu · 28 Oct 2026 · secondary source
• Act LXIX of 2024 (adopted 20/12/2024; entered into force 01/01/2025) repealed Act XXIII of 2023. Link: Government Decree 418/2024 ecs-org.eu · 28 Oct 2026 · secondary source

Referenced documents: Government Decree 418/2024

Registration Legal ref: Art. 19, 20 (new Act)

• Main requested details (more information in Art. 20): ecs-org.eu · 28 Oct 2026 · secondary source
• Contact details (electronic details, public IP address or public IP address ranges, address of main office and of other establishments). ecs-org.eu · 28 Oct 2026 · secondary source
• Sector and subsector classification, as well as the type of entity. ecs-org.eu · 28 Oct 2026 · secondary source
• List of EU countries where the entity provides services. ecs-org.eu · 28 Oct 2026 · secondary source
• Name, brief description, and classification of the security class of the organisation’s electronic information systems. ecs-org.eu · 28 Oct 2026 · secondary source
• The new Act requires entities to register with the competent authorities by 31 January 2025. Organisations who already registered are not required to reregister but to provide additional information. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Chapter I, Section 27 (old Act),Chapter II, Section 7 (old Act), Art. 1, Art. 66 (new Act), Art. 30 Government Decree 418/2024

• Incident reporting requirements vary by sector, with reporting obligations to the National Defence Cyber Incident Management Centre and sectoral Cyber Incident Management Centres differing for each entity covered by the law. ecs-org.eu · 28 Oct 2026 · secondary source
• Article 1 of the new Act lists the subgroups of entities. Incident constitutes as: a security incident occurred or imminent in the electronic information system where it causes serious disruption or damage to the operation or provision of services by the supervised entity, or causes significant material or non-material damage to other natural or legal persons. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art. 21 Government Decree 418/2024

• Up to 10,000,000 EUR or 2% of the total worldwide annual turnover (essential entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Up to 7,000,000 EUR or 1.4% of the total worldwide annual turnover (important entities). ecs-org.eu · 28 Oct 2026 · secondary source
• Corresponds to NIS2. ecs-org.eu · 28 Oct 2026 · secondary source
• The competent authority may also impose a fine up to 15,000,00 HUF (failure to comply with statutory obligation by heads of entities). ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: Chapter I, Section 7 (old Act), Art. 16 (new Act)

• Reference to EU standards under the NIS2 Directive. ecs-org.eu · 28 Oct 2026 · secondary source
• Entities must conduct an impact assessment and asset mapping of their systems, establish a risk management framework, and carry out vulnerability testing, regular evaluations, and continuous monitoring. ecs-org.eu · 28 Oct 2026 · secondary source
• Service providers and organisations operating in high-risk and risk sectors are required to sign an agreement with an external auditor company (certified by authorities) within 120 days of registration to conduct a cybersecurity audit, and have a cybersecurity audit carried out for the first time within two years of its registration. The auditor company will check entities’ IS operational practices in every second year. ecs-org.eu · 28 Oct 2026 · secondary source
• Hungary enforces classification-based risk assessments for essential and important entities under a dual legal framework. Assessments must cover IT/OT systems, supply chain, and continuity risks, with updates at least every two years or after major changes. Audits begin in 2025 under SZTFH supervision. ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: Primary Law · Implementing Act

What changed recently

1. 19 Oct 2024
   National NIS2 law enters into force (per tracker) ecs-org.eu needs verification