Hungary

Non-binding recommendation under Article 13(2)(i) of the MNB Act that applies from 1 April 2026 (AI sub-strategy due by 30 June 2026). It covers IT transformation, IT security, cloud services, third-party provider risk and responsible AI, and refers to the DORA Regulation (EU) 2022/2554 on ICT risk.

Non-binding recommendation setting MNB expectations for payment institutions on preventing and handling payment fraud, including unauthorised orders and deception. Most provisions apply from 1 January 2024, some from 1 September 2024 and others from 1 March 2025.

Establishes the Integrity Authority (s. 1) and sets its powers over EU-funded measures: investigations (s. 17), administrative audits of EU-funded procurement (s. 5(3)(a)), suspension of a procurement for up to two months (s. 21(1)) and referrals to OLAF and the EPPO (s. 24(1)). English text as in force on 1 January 2023.

Governs state supervision of basic employment-law obligations: the inspection procedure, undeclared work, disguised employment, unlawful temporary agency work, bans on continued employment and labour fines. As amended by Government Decree 24/2024 (II. 14.), the minimum labour fine is HUF 150,000, with upper limits of HUF 20 million for medium-sized enterprises and HUF 25 million for employers with more than 249 employees. The linked page is the decree's explanatory memorandum, not the decree text.

Gives proportionate, risk-based expectations for protecting information systems, addressed to entities subject to the laws in Section 39 of the MNB Act, and allows other solutions that meet the same risk-mitigation aim. It mainly outlines Government Decree 42/2015 (III. 12.) on the protection of financial institutions' information systems.

Sets the MNB's objectives and tasks. Article 4(9) gives it the supervision of the financial intermediation system, Article 39 lists the laws and entities it supervises (including the law on the market of crypto-assets), and Article 13(2)(i) is the basis for its recommendations. The MNB-hosted English translation is the version effective from 27 September 2026.

Hungary's national data protection act, which implements the GDPR and transposes the Law Enforcement Directive. An investigation under Section 52 is not an administrative proceeding and cannot lead to a fine; under Section 60 the authority may open proceedings to fine an unlawful controller, lasting up to 150 days (Section 60/A). Section 25/J requires breach notification to NAIH within 72 hours.