NIS2 in Hungary: who is covered by the Cybersecurity Act, and what must you do within 120 days?

The EU's NIS2 directive was transposed into Hungarian law by Act LXIX of 2024, in force since 1 January 2025. The regulation affects thousands of companies operating in Hungary, including foreign-owned manufacturers and service providers, yet many first confront it only when a customer demands audited compliance for a contract, or when a letter from the authority arrives.

Who is covered?

The Act applies to organisations in high-risk and particularly high-risk sectors, including energy, transport, healthcare, digital infrastructure, manufacturing and the food industry. Importantly, it is not only large enterprises: mid-sized companies with more than 50 employees or revenue above EUR 10 million are typically covered too.

Your company can be affected even as a "mere" supplier: NIS2 explicitly requires the management of supply chain cybersecurity risks, and customers increasingly make audited compliance a condition of contracting.

The main obligations

• Registration with the supervisory authority and appointing an information security officer
• Security classification and implementing the corresponding protective measures
• Contracting an auditor within 120 days of registration
• A mandatory cybersecurity audit, repeated every two years
• Incident reporting within statutory deadlines; early warning within 24 hours is mandatory
• Managing and documenting supply chain cybersecurity risks

The first audit deadline has already passed

Affected organisations that began operating before 1 January 2025 had to close their first cybersecurity audit by 30 June 2026. According to the supervisory authority SZTFH, most of the more than 2,500 affected organisations complied. Laggards, however, can expect a warning followed by a fine. If you missed the deadline, the goal now is the fastest possible remediation: an auditor contract signed and preparation started before the authority reaches you materially reduces the sanction risk.

What is at stake?

Under the Hungarian rules, the fine for non-compliance — whether a missed registration or a missed audit — can reach 2% of the previous business year's net revenue, capped at 150 million forints (approx. EUR 380,000). And, surprisingly to many, liability is personal too: an executive can be banned from management for up to 5 years for repeated non-compliance.

The six phases of preparation

1. Applicability and EIS identification. Sector and size quickly determine whether the Act applies to you, and which electronic information systems fall under it.
2. GAP analysis. Where does the organisation stand against the requirements of its security class, and how big is the gap?
3. Protective measures and policies. Controls implemented along a scheduled action plan: information security policy, incident response plan, supplier risk management.
4. Security awareness training. A large part of the requirements comes down to people; documented training is expected too.
5. Pre-audit. The dress rehearsal of the real audit: the same questions, without consequences, so the real audit brings no surprises.
6. Audit. With a registered auditor, repeated every two years.

Zenit's rapid cybersecurity assessment gives a comprehensive picture of your readiness within days, and our NIS2-certified experts guide you through the entire preparation, from classification to supporting your registration with the authority. Our references include critical infrastructure: we have carried out NIS2 preparation and audits at Hungarian power plants.