The NIS2 Directive, adopted by the European Union, is gradually taking effect across member states starting in 2024.
In Hungary, several thousand businesses will soon be required to comply with stricter cybersecurity standards.
But what exactly is NIS2, who does it apply to, and why is it crucial for Hungarian companies to start preparing now?

What Is NIS2?

The NIS2 (Network and Information Security Directive 2) is an EU-wide regulation designed to strengthen the security of networks and information systems.
It replaces the previous NIS directive and introduces tighter cybersecurity requirements to better protect organizations and critical infrastructure across Europe.

Who Does NIS2 Apply to in Hungary?

The regulation covers a wide range of organizations, including:

• Critical infrastructure operators (energy, transportation, healthcare, water management)
• Digital service providers (data centers, online marketplaces, cloud service providers)
• Medium and large enterprises whose size and operations pose potential cyber risks

This means NIS2 does not only apply to multinational corporations — it will also affect a significant portion of Hungarian SMEs.

What Are the Main NIS2 Requirements?

Under the directive, companies are required to:

• Develop a cybersecurity policy and designate a responsible officer
• Implement technical protection measures (backups, network security, access control)
• Prepare an incident response plan and report cyberattacks promptly
• Undergo a mandatory cybersecurity audit conducted by accredited experts

Why Prepare Early?

• Legal obligation: Non-compliance may lead to significant fines and sanctions
• Competitive advantage: Strong security increases client and partner trust
• Risk reduction: Lowers the likelihood of data loss, system downtime, and reputational damage

Frequently Asked Questions 

When does NIS2 come into effect?
The directive is being implemented from 2024, with mandatory audits expected in 2025–2026.

Does it apply to smaller companies too?
Yes — most medium-sized enterprises and numerous digital service providers fall under its scope.

What happens if a company fails to comply?
Non-compliance can result in severe financial penalties and even operational restrictions.

Summary and Next Steps

The NIS2 directive presents new challenges for both European and Hungarian businesses, but with timely preparation, companies can not only avoid penalties — they can also gain a long-term competitive edge.

Now is the time to evaluate your organization’s cybersecurity posture and ensure compliance before deadlines approach.