Cybersecurity law in Hungary: NIS2 compliance (2026)

The Commission sent a formal reasoned opinion to Hungary (among 19 Member States) for failing to notify complete NIS2 transposition measures, despite Hungary having enacted Act LXIX of 2024. Hungary has two months to respond or face referral to the Court of Justice of the EU.

Hungary adopted a new five-year cybersecurity strategy required by Article 7 of NIS2, tasking the Cybersecurity Commissioner and relevant ministers with developing a National Cybersecurity Action Plan and integrating cybersecurity across public administration, critical infrastructure, digital services, and supply chains.

Hungary's comprehensive Cybersecurity Act took effect, repealing the 2013 Information Security Act and the 2023 partial transposition law and merging public-sector and private-sector cybersecurity obligations into a single statute. The Regulated Activities Supervisory Authority (SzTFH) became the primary supervisory body; mandatory cybersecurity audits must be completed by 30 June 2026.

All organisations falling within Hungary's initial NIS2 scope were required to register with the competent authority by this date, representing the first active compliance milestone under the early NIS2 framework before the comprehensive 2024 Act replaced it.

Hungary became one of the earliest EU Member States to begin NIS2 implementation, enacting a law on Cybersecurity Certification and Cybersecurity Supervision; it covered registration, supervision, and certification but was later found to be an incomplete transposition, necessitating the broader 2024 Act.

Hungary unified three separate cyber bodies, GovCERT-Hungary (incident handling), the National Electronic Information Security Authority (NEISA), and the Cyber Defence Management Authority (CDMA), into a single National Cyber Security Centre, which became Hungary's national CSIRT and the competent authority under the subsequent NIS Directive.

Hungary's foundational cybersecurity statute imposed binding obligations on state and municipal bodies, critical infrastructure operators, and their IT suppliers to classify information systems into security classes and implement commensurate controls, establishing the first comprehensive public-sector cybersecurity regime in Hungary.

Hungary became one of the first Central and Eastern European states to adopt a national cybersecurity strategy, defining protecting critical information infrastructure as a national security priority, assigning institutional responsibilities, and providing the policy mandate for the 2013 Information Security Act and subsequent NCSC creation.

Hungary enacted its critical infrastructure protection law, establishing the legal framework for identifying and designating critical systems and facilities across energy, transport, water, and telecommunications sectors, creating the statutory foundation for sector-specific cybersecurity and resilience obligations.

After Hungary signed the Council of Europe Convention on Cybercrime (23 November 2001, in Budapest) and ratified it on 4 December 2003, the treaty took effect, aligning Hungarian criminal law with international cybercrime standards; domesticated by Act LXXIX of 2004 and later reinforced by the Criminal Code (Act C of 2012).