Hungary's NIS2 cyber security rollout adds mandatory training and sees most firms meet audit deadline

The QFD Group has launched new training programmes designed to satisfy Hungary’s NIS2 cyber‑security requirements. The courses include a 20‑hour annual programme for Information Security Responsibility (IBF) staff, delivered in five four‑hour online modules, and an eight‑hour introductory course for company executives followed by at least four hours of yearly refresher training. Organisations that named their IBF staff before 1 January 2026 must complete the first training by 31 December 2026.

The Hungarian regulator, the Szabályozott Tevékenységek Felügyeleti Hatósága (SZTFH), reported that out of 2,520 entities subject to the NIS2 audit, 2,132 completed the first audit by the 30 June deadline. The majority of audited firms met the standards, with 170 receiving the highest “negligible risk” rating. However, a notable number failed to register or complete the audit and could face warnings or fines of up to 150 million HUF. Recent changes to the auditor registration system have removed previous preferential rules, widening market access for audit providers.