“The Hungarian NIS2 audit is done.” What headquarters still needs to ask

A group general counsel receives an update from Budapest: “The NIS2 audit is done.” Reassuring as it sounds, it does not answer the questions that matter: what exactly was audited, what did the auditor find, what did management undertake to do, and who will bear the cost?

NIS2, the European Union’s cybersecurity directive, reaches well beyond power plants and telecoms: it obliges thousands of ordinary companies, from manufacturers to IT service firms, to meet common security standards under each member state’s own national law. Hungary has gone further than most member states so far, requiring covered companies to demonstrate their cybersecurity in a mandatory external audit by 30 June 2026.

Not every Hungarian subsidiary can send such a message. Some registered with the regulator but missed the deadline; others never appeared in the group’s compliance tracker, because fewer than 50 local employees was once mistaken for an exemption. The three files call for different responses: a findings review, a recovery plan, or a scope assessment. In each case, though, the legal duty rests with the Hungarian entity, while the systems, evidence and budget often sit elsewhere in Europe.

No one-stop shop: a subsidiary can be late while headquarters is still preparing

The NIS2 Directive created a common floor rather than one timetable. Unlike the GDPR, it offers no general one-stop shop: with a narrow exception for certain digital providers, each company answers to the regulator of the country where it is established. On 8 July 2026, eight days after Hungary’s deadline, the European Commission said France, Ireland, Spain and the Netherlands had not yet turned the directive fully into national law. A Hungarian subsidiary can therefore already be in breach while the group’s home country is still writing its law.

What Hungary adds to NIS2

The audit is only the most visible Hungarian addition. The Cybersecurity Act and its decrees add a layer that most member states do not impose:

• Registration and all dealings with the authority run through a dedicated government e-portal.
• Every in-scope system must be classified as basic, significant or high.
• A named information security officer is mandatory, with 20 hours of certified training a year.
• Executive responsibility is personal; in persistent cases at essential entities, the law allows initiating a manager’s disqualification.
• Cybersecurity clauses are mandatory in supplier contracts, making this a procurement task too.
• Outsourced incident response must come from a registered provider pool, with the statutory duties in the contract.
• The audit recurs every two years, and the auditor reports directly to the regulator, in Hungarian.

IT, HR, procurement, finance and the local managing director each hold a piece of this list; it cannot be closed from a single desk.

What the 30 June numbers say

Hungary’s Supervisory Authority for Regulatory Affairs, known by its Hungarian acronym SZTFH, reported 2,132 timely completions among 2,520 registered audit-obliged organisations, about 85%, and said it was identifying non-registrants from official records. The 30 June deadline bound companies already operating before 2025; a newer company calculates from its own start, with 30 days to register, 120 days to contract an auditor and two years for the first audit. A legacy company that files late is simply late.

The never-assessed subsidiary is easy to miss because local headcount is not a safe scope test. Hungarian law combines actual activities with size and financial criteria, covers some providers regardless of size, and can pull in partner and linked-enterprise data under the Hungarian SME Act. The authority also screens the company register, so a dormant activity code can place an entity on its radar; codes that no longer reflect reality are worth deleting.

Intra-group services are where the surprises come from. Many Hungarian subsidiaries act as the group’s shared service or IT centre, and the law does not ask whether the customer is an affiliate or a third party: an IT service provided within the group can be a covered activity in its own right, and some ICT provider categories apply regardless of size.

“Audit complete” is not a clean bill of health

An audit report is a regulatory record, and the work continues after it. NIS2 itself does not mandate recurring external audits; Hungary requires them every two years; for the ordinary private-sector companies this article concerns, it is the rule, with narrow exceptions.

The auditor checks every system classification and tests controls in at least half the systems, with larger samples for higher classes; missing evidence or test access is rated non-compliant even where the control itself works. The auditor sends the Hungarian-language report to SZTFH within seven days; evidence is kept for five years, and failed systems return to the next sample.

The framework will look familiar: Decree 7/2024 contains the binding catalogue, which the National Cyber Security Center says draws on NIST SP 800-53 Rev. 5, and the audit method is based on SP 800-53A Rev. 5. A group NIST, ISO/IEC 27001 or TISAX programme speeds up the mapping, but it does not replace the Hungarian classification or evidence; above all, it does not exempt the company from the mandatory audit.

Completion says little about outcome. Of 1,511 processed reports, about one in nine earned the highest rating, “compliant with negligible risk”. The rest are not necessarily failures: SZTFH said that the great majority of organisations whose reports had been processed met the requirements, but it did not publish the breakdown of ratings. The real questions are what the report found, who owns each finding, what funding is attached and what will prove closure.

The Hungarian company carries the duty. Headquarters controls the answer

A subsidiary may have no local data centre, no security operations centre and no authority to change the group ERP. That calls for closer attention from headquarters: SZTFH confirms the audit may remain mandatory even where the parent supplies all the IT.

The dividing line is control rather than physical location. If the entity controls a system or a layer of one, such as local configuration or access, that element may require classification and audit of its own; a platform merely consumed as a group service is not itself audited, but the entity’s policies, contracts and oversight of that service are, and local leadership stays responsible.

Even within that perimeter, the proof often sits exactly where the duty is not: identity settings in London, access reviews in Amsterdam, cloud assurance in Paris. Where evidence cannot be produced or tested, the requirement is rated non-compliant, so contracts should secure evidence access, testing, escalation, remediation and exit. Closure may still take a platform change, an intercompany amendment or group budget.

Incidents expose the same gap. A reportable incident starts a Hungarian clock under the incident rules: an initial filing within 24 hours of awareness, a fuller notification within 72 hours, generally a final report within a month, and an immediate telephone report for significant cases. Slow group escalation can consume the first window on its own.

The auditor’s invoice is only the first cost

For the main audit-obliged categories, missing the audit deadline can cost from HUF 1 million up to 2% of prior-year net revenue, capped at HUF 150 million, roughly EUR 413,000; never registering starts at 0.5% with the same floor and ceiling. The audit fee itself is capped by formula at HUF 140 million, roughly EUR 385,000, and an annual supervisory fee of up to HUF 10 million per entity comes on top.

One deadline deserves board attention. Under the training regulation, the chief executive, typically the Hungarian subsidiary’s managing director, appointed before 31 December 2025, generally needs eight hours of cybersecurity training by 31 December 2026, then four annually; a security officer needs 20 hours across at least three subjects. Absent an exemption, only the prescribed certificate counts as evidence.

Eight answers headquarters should require within 10 working days

For every potentially covered Hungarian entity, headquarters should hold eight dated answers:

1. Why is the entity in or out of scope, and which activity, ownership and financial data support the conclusion?
2. Which deadline applied, and do registration and auditor records match the entity’s history?
3. What did the audit cover and conclude, and when did the report reach SZTFH?
4. Which findings remain open, who owns them, what funding is approved and what will prove closure?
5. Which group teams and providers control the systems or evidence needed to close the findings?
6. Can verified facts reach the Hungarian decision-maker in time for the 24-hour and 72-hour filings?
7. Are the supervisory fee, next audit date, statutory appointments and training certificates documented?
8. Does local management understand that the responsibility is personal, and does procurement know which clauses every new contract must carry?

The three files are different problems with the same last step: connecting the Hungarian legal file to those who control the systems, contracts, evidence and budget. Ten working days is a management yardstick, not a statutory deadline. If the answers cannot be assembled in that time, the most important finding will not appear in any audit report: the ownership gap between the Hungarian entity and the group. Until then, the subsidiary should not be marked green.

There is a better way to read that finding. Hungary has simply arrived first where every member state is heading: supervision that asks for evidence rather than reassurance. A group that treats the Hungarian file as a local nuisance will meet the same findings country by country. A group that treats it as the first full-scale test of its European programme will already be answering from evidence, in Hungary and everywhere after it.

Status note, 13 August 2026: the essay was written on that date, and the figures, deadlines and statements cited reflect it; check them before citing.