Hungary transposed NIS2 via Act LXIX of 2024 on Cybersecurity, adopted by Parliament on 17 December 2024, promulgated on 20 December and in force from 1 January 2025. It replaced Act L of 2013 (public-sector information security) and Act XXIII of 2023 (cybersecurity certification and supervision); a January 2026 amendment revised the size test for in-scope private entities. Supervision is split: the Supervisory Authority for Regulatory Affairs (SZTFH — Szabályozott Tevékenységek Felügyeleti Hatósága) supervises private-sector entities, while public bodies and state-majority-owned companies fall under the Special Service for National Security (Nemzetbiztonsági Szakszolgálat, NBSZ). Audit-obliged entities operating before 1 January 2025 had to complete a first cybersecurity audit by 30 June 2026 — SZTFH reports 2,194 did — and audits repeat every two years.
SZTFH’s cybersecurity-supervision page, in Hungarian — the authority for private-sector entities under Act LXIX of 2024, which notify it within 30 days of coming into scope. Public bodies and state-majority-owned companies answer to the NBSZ instead.