Hungary NIS2 Implementation Guide: Act LXIX of 2024, SZTFH and Audits

Hungary is one of the few EU countries where NIS2 compliance is tested by a mandatory, regulator-supervised cybersecurity audit, and the first audit deadline for most companies has already passed. Act LXIX of 2024 on the Cybersecurity of Hungary (2024. évi LXIX. törvény Magyarország kiberbiztonságáról) has applied since 1 January 2025. It replaced the earlier Act XXIII of 2023 on cybersecurity certification and supervision, which had only partly transposed the Directive, and folded in the public-sector rules of Act L of 2013. Government Decree 418/2024 (XII. 23.) carries the detail: incident reporting, fines and the designation of authorities. This guide covers scope, the split between the Supervisory Authority for Regulatory Affairs (SZTFH) and the national cybersecurity authority, registration, the audit cycle, incident reporting, fines and what the measures mean for service accounts, API keys and AI agents. It is for CISOs, compliance leads and auditors with Hungarian entities. The Directive is covered in the NIS2 Directive Guide and cross-country status in the NIS2 Transposition Tracker.

Sources and status, checked 14 November 2026: scope, authorities, registration, the audit cycle, the supervision fee and transitional rules come from the consolidated Act on the National Legislation Database (njt.hu); reporting deadlines and fines from the consolidated Decree 418/2024 on the same site; audit results from SZTFH's own report of 19 October 2026. Three points rely on a single secondary source and are attributed in the text: the repeal of Act XXIII of 2023 and the 2025 and 2027 audit dates (CMS Hungary), and the scope amendment applying from 6 January 2026 (Baker McKenzie). Consolidated Hungarian law changes often, so confirm the current text on njt.hu before relying on any figure. This page is not legal advice.

Key takeaways

• Two supervisors, by entity type: SZTFH supervises the medium and large companies in the NIS2 sectors (Annexes 2 and 3 of the Act) and registries, DNS and trust providers of any size; the national cybersecurity authority, which Decree 418/2024 designates as the Special Service for National Security (NBSZ), supervises public administration, large state-owned companies and designated entities.
• The audit is the centre of gravity: regulated companies must contract a registered auditor within 120 days of registration and pass a cybersecurity audit within two years, then every two years; companies operating before 2025 had to complete their first audit by 31 December 2025.
• Reporting runs 24 hours, 72 hours, one month: Decree 418/2024 sets a first report within 24 hours of awareness, an event report within 72 hours and a final report within one month, sent to the national incident handling centre at NBSZ.
• Fines follow the Directive ceilings: up to the forint equivalent of EUR 10 million or 2% of global turnover for essential entities, EUR 7 million or 1.4% for important ones, plus up to HUF 15 million personally for the head of the organisation.
• Machine identities sit in the audited scope: the security classification and protective measures cover the information systems as a whole, so service accounts, API keys and agent identities in those systems are part of what the auditor examines.

Legal framework and timeline

Related SZTFH decrees named by CMS Hungary cover the register of supervised entities (23/2023), the register of auditors (7/2024), and a separate decree on security classification requirements and protective measures (MK Decree 7/2024). SZTFH also uses the English name Supervisory Authority for Regulatory Affairs (SARA).

Scope: who is covered and who supervises

Section 1(1) of the Act lists six categories. Section 23 then splits supervision between two authorities, which is the first thing to settle because registration, audit and fines all follow from it.

• Essential (alapvető): under section 1(4), Annex 1 bodies (except councils of municipalities with 20,000 or fewer residents), large state-influenced companies, critical entities, Annex 2 entities that are medium-sized or larger, and qualified trust service providers, TLD registries and DNS providers regardless of size.
• Important (fontos): under section 1(5), smaller municipalities' councils, identified entities and Annex 2 and 3 entities not classed as essential.
• DORA carve-out: section 1(1)(c) excludes organisations already covered by Regulation (EU) 2022/2554, so most financial entities follow DORA. See the DORA and NIS2 Overlap Mapping Guide.
• 2026 scope change: according to Baker McKenzie, an amendment applying from 6 January 2026 removes companies that are large only because of partner or linked enterprises and do not meet the medium-size thresholds on their own. Under the general rule, private organisations are in scope if they are medium-sized under the SME Act, or employ at least 50 people or have turnover and balance sheet above EUR 10 million. Organisations no longer covered should contact SZTFH to deregister, because the amendment does not set a clear procedure.

Registration and first-year obligations

Section 8(4) of the Act sets a staged start for organisations reporting to the national authority; section 8(5) requires SZTFH-supervised entities to register within 30 days. The stages are a good project plan for any newly in-scope entity.

1. 30 days: report organisation data and the details of the information security officer.
2. 90 days: survey the electronic information systems in use.
3. 120 days: data classification where relevant; for SZTFH-supervised entities, also the deadline to sign a contract with a registered auditor (section 16(2)(a)).
4. 180 days: submit the information security policy and complete the security classification of existing systems.
5. Two years: first cybersecurity audit completed (section 16(2)(b)), then at least every two years or when the authority orders one (section 16(1)).

Entities already registered and classified under the old Act did not have to repeat registration or classification (section 89(1) and (3)), and auditors on SZTFH's register at 31 December 2024 stayed on it (section 89(4)).

Supervision fee

Section 7 sets an annual cybersecurity supervision fee (kiberbiztonsági felügyeleti díj) of up to 0.015% of the previous year's net revenue, capped at HUF 10 million per entity and HUF 50 million per corporate group. Budget for it alongside audit fees.

The cybersecurity audit

The audit is what distinguishes Hungary's model. A registered auditor examines whether the organisation's systems meet the protective measures for their security class, and the report goes to SZTFH. Systems are classified as basic (alap), significant (jelentős) or high (magas), and the required measures scale with the class.

SZTFH's first results, published 19 October 2026 with data to 30 September 2026, give a realistic benchmark:

SZTFH reports that nearly 90% of organisations met the legal requirements in their first audit and about 10% scored below the threshold of 70. Manufacturing produced 44% of audits but 61% of the results below 70, and SZTFH named food, waste management and healthcare as sectors needing more development, based on audit completion rates. It also notes that some audits were still in progress after the deadline and that the list of obligated organisations is still growing.

Preparing for the audit

• Choose the auditor early: only firms on SZTFH's auditor register count, and demand peaks before deadlines.
• Classify defensibly: a system placed in a lower class than its data and impact justify is an audit finding in itself; record the reasoning.
• Evidence operation, not documents: auditors test whether measures work, so keep logs, review records and test results for the period.
• Close gaps before the next cycle: treat findings as a tracked remediation plan with owners, because the next audit is at most two years away.

Incident reporting

The Act requires essential entities to report incidents without delay and important entities to report incidents causing serious disruption or financial harm (section 66). Decree 418/2024 sets the clock and designates NBSZ as the national incident handling centre (section 65(1)).

For significant or large-scale incidents, the centre must also be told by telephone without delay (section 78(2)). Near misses and operational incidents handled automatically without service degradation need not be reported, but repeated ones must (section 77(3)). The centre aims to respond within 24 hours of the first report (section 79(1)), and reports organisations that fail their reporting duties to the competent authority (section 87(1)).

Fines and management accountability

Under section 30 of the Act, the authority can fine an essential or important entity that fails to comply after enforcement measures, ban activities that directly endanger security, and for essential entities ask the company court to temporarily bar the head of the organisation from executive duties. Decree 418/2024 sets the amounts.

SZTFH fines the entities it supervises and NBSZ fines the rest. The euro conversion uses the Magyar Nemzeti Bank rate on the day of the decision. Fines are payable within eight days of becoming final, can be repeated for the same facts two months after the decision, and do not relieve the organisation of the duty to fix the problem (section 44). The personal exposure of the head is why boards should see audit results directly; see the NIS2 Management Liability Executive Briefing.

What it means for AI agents and non-human identities

• Inventory inside the classified systems: the 90-day system survey and the security classification should list every service account, API key, OAuth application, certificate and AI agent that operates in each system, with an owner. Auditors will expect access control measures to cover them.
• Classify by what the identity can reach: a machine identity with write access to a high class system inherits that system's sensitivity; scope it and protect its secret accordingly. See the NHI Authentication Guide.
• Log for the 24-hour report: the first report and the 72-hour impact assessment are much easier when machine identity use is logged and attributable. See Detection Engineering for Non-Human Identities Guide.
• Agents get their own identity: give each AI agent a scoped identity rather than a shared service account, so actions can be traced in an incident report. See AI Agent Identity vs Service Account.
• Audit evidence for machines: keep rotation records, access reviews and secret scanning results for the audit period. See Audit Readiness for AI Agents and NHIs.
• Supplier credentials: credentials and OAuth grants held by suppliers into your systems belong in the inventory; NIS2 supply chain duties apply. See the NIS2 Supply Chain Security Guide.

Framework mapping

Common failure patterns

• Assuming the old Act still governs: references to Act XXIII of 2023 in policies and contracts should be updated to Act LXIX of 2024 and Decree 418/2024.
• Misreading group size after the 2026 amendment: some companies that registered only because of group size may now be out of scope, while medium-sized companies with group status remain in; check, and deregister through SZTFH if appropriate.
• Late auditor contracts: the 120-day contract deadline is separate from the audit date, and auditor capacity is finite.
• Under-classifying systems: placing systems in the basic class to reduce measures invites audit findings.
• Missing the telephone step: significant incidents need a phone notice to the centre in addition to the 24-hour report.
• Leaving machine identities out of the system survey: service accounts and API keys that are not inventoried cannot be shown to meet access control measures.

Practitioner checklist

• Confirm the section 1(1) category and therefore whether SZTFH or NBSZ supervises you.
• Re-check scope against the amendment applying from 6 January 2026.
• Confirm registration data and the information security officer on the authority's register.
• Keep the system survey and security classification current, including machine identities and agents.
• Hold a contract with a registered auditor and plan the next biennial audit.
• Track audit findings to closure with named owners.
• Run a reporting drill against the 24-hour, 72-hour and one-month clocks, including the phone notice.
• Brief the head of the organisation on personal fine exposure and audit results.

Standards and references

• Nemzeti Jogszabálytár: Act LXIX of 2024 on the Cybersecurity of Hungary
• Nemzeti Jogszabálytár: Government Decree 418/2024 (XII. 23.) implementing the Cybersecurity Act
• SZTFH: Detailed results on cybersecurity audit reports
• SZTFH: Supervisory Authority for Regulatory Affairs
• CMS Hungary: Hungary introduces new comprehensive laws for NIS2 transposition
• Baker McKenzie: Hungary, amendments to the Cybersecurity Act

Related NHI Mgmt Group resources: NIS2 Directive Guide, NIS2 Transposition Tracker, Czechia NIS2 Implementation, NIS2 Readiness Checklist. This guide summarises Hungary's NIS2 implementing law and is not legal advice.