On 6 January 2026, Hungary enacted an amendment to the Hungarian Cybersecurity Act, which transposes the EU NIS2 Directive, that further revises the scope of entities operating in critical sectors under the Act.

For entities previously falling under the Hungarian Cybersecurity Act due to staff headcounts, annual turnover and the annual balance sheet total of linked and partner enterprises, these changes may mean an exemption from the cybersecurity regime.

What is changing

Only entities having a staff headcount of at least 50 personnel or an annual turnover of EUR 10 million and an annual balance sheet total of EUR 10 million or more will fall under the Hungarian Cybersecurity Act. In these cases, the staff headcount, annual turnover and annual balance sheet total of linked and partner enterprises will not be relevant.

Previously, all entities exceeding the thresholds for medium-sized enterprises (i.e. meeting the criterial of the staff headcount, annual turnover and annual balance sheet total of linked and partner enterprises) fell under the Hungarian Cybersecurity Act.

What is not changing

Entities qualifying as medium-sized enterprises under the Hungarian SME Act (transposing the Commission Recommendation of 6 May 2003) will continue to fall under the Hungarian Cybersecurity Act. In this case, staff headcount, annual turnover and annual balance sheet total of linked and partner enterprises also remain relevant.

Next steps

This amendment entered into force on 6 January 2026.

Entities already registered with the Supervisory Authority for Regulatory Affairs (SZTFH) or are in the process of registering must re-assess whether they fall under local cybersecurity rules.

De-registering with the SZTFH is possible. In case of de-registration due to the change in the scope of the Hungarian Cybersecurity Act, any cybersecurity supervisory fee previously paid to the SZTFH is non-refundable. The SZTFH will inform the entity of the pro-rated amount of the cybersecurity supervisory fee payable for the current year in the deletion decision.

The full official text of this amendment is available here (available only in Hungarian).