Hungary audited 2,220 entities and published what it found

Why only Hungary has this number

Every one of the 27 supervises. Almost none of them measures. Supervision under NIS2 is mostly reactive — a report lands, a complaint arrives, an inspection follows — and the output is a case file, not a dataset. Hungary built its regime the other way round. Act LXIX of 2024 requires organisations above the size threshold in a high-risk or risky activity, together with electronic communications, trust and DNS providers, top-level domain registries and domain registrars, to undergo a cybersecurity audit every two years, carried out by an auditor on the register the SZTFH holds under decree 7/2024. (VI. 24.). The auditor has seven days after closing an audit to file the report with the authority.

That design has a side effect nobody else in the Union enjoys. Once a cycle closes, the supervisor is holding a few thousand comparable assessments of the same control set, scored on the same index. The first cycle closed on 30 June 2026. On 19 October the authority published what it found.

The headline, and the sentence that qualifies it

By 30 September 2026, 2,220 organisations had filed an audit report. Close to 90 per cent of them met the statutory requirements. The authority says this is well above what the profession expected.

Read the mechanism in that sentence before the percentage. The audit produces a single number, the szervezet ellenálló-képességi index or SZEKI, and 70 is the line. Ninety per cent cleared 70. That is a pass rate against a threshold, not a statement that nine organisations in ten are well defended, and the authority does not claim otherwise.

There is a second ten per cent in this story, published two months earlier, and the two are easy to collide. In August the authority reported that about 10 per cent of the organisations audited by 30 June had earned the top rating, met with negligible risk. In October it reported that 10 per cent fell below 70. Same figure, opposite ends of the distribution. If you quote one of them in a board paper, say which.

Most of the audits were run at the lightest class

The Hungarian measures are not a single list. Appendix 2 of decree 7/2024 sets nineteen categories, and which of them you owe depends on the security class you assign your electronic information systems. The class is therefore the single most consequential decision an entity makes before it is audited, and the first cycle shows how the 27 states of mind on that question actually resolved.

• alap, the basic class: 1,804 organisations, 81.1 per cent of the audits, average SZEKI 77
• jelentős, significant: 321 organisations, average SZEKI 79
• magas, high: 52 organisations, average SZEKI 85

Note which way that runs. The organisations holding themselves to the hardest requirements scored highest, not lowest. The authority offers two reasons, and both are worth taking seriously. One is arithmetic: four audits in five were conducted at alap, so the overall average is largely the alap average. The other is history. Organisations already audited for information security under some other legal, contractual or compliance obligation both classified their systems higher and met the measures at a higher level, because they had been doing it for years.

The uncomfortable reading of the same table is that the 81.1 per cent at alap averaged 77 — seven points above a pass mark of 70. The cohort with the least prior exposure chose the lightest requirements and still landed closest to the line.

The number that is actually operational: who has not been audited

A pass rate tells you about the organisations that turned up. The authority also published the share of registered entities in each sector that have been audited at all, and that table is where the supervisory risk sits.

• Drinking water and wastewater: 100 per cent. Space-based services: 100 per cent
• Digital infrastructure 92 per cent, transport 90 per cent, energy 87 per cent, chemicals 87 per cent, research 84 per cent
• Health 81 per cent, outsourced ICT services 81 per cent, electronic communications services 80 per cent, digital providers 75 per cent
• Food 70 per cent, postal and courier services 68 per cent, manufacturing 67 per cent, waste management 59 per cent

Two in five registered waste-management entities, and one in three registered manufacturers, have not been audited. The deadline for the first audit was 30 June 2026. These are not organisations that scored badly; they are organisations with no score, nearly four months past the date.

Manufacturing is where the two readings meet. It carries 44 per cent of all audits conducted, the largest block by a distance, and 61 per cent of the organisations rated not compliant are also registered in it. Treat that 61 per cent carefully: the authority states plainly that an organisation can be registered in more than one sector, so the sector figures overlap and this is a count of failed organisations that appear in manufacturing, not a share of manufacturing itself. The honest summary is that manufacturing is both the largest audited population and the one most entangled with the failures, on a register that counts some entities twice.

What the cycle settled about capacity

One prediction from the start of the process can now be retired. The objection to a compulsory third-party audit, in Hungary as everywhere it is proposed, was that there would not be enough qualified auditors to absorb the demand, and that the bottleneck would turn a security obligation into a queue. The authority reports that the available auditor capacity proved adequate, and that the number of auditors on its register has grown over recent months. Decree 6/2026. (VI. 8.) removed some of the additional conditions on becoming one.

That matters beyond Hungary, because the mandatory-audit question is live in several Member States that have so far settled for self-assessment. The first full cycle of the only compulsory regime in the Union ran without the capacity failure its critics forecast.

What a Hungarian entity should take from this

If you are registered and audited, your SZEKI is now a number your supervisor holds alongside 2,219 others, and it is comparable. The next cycle falls two years after your first audit, and the measures you were scored against do not change between cycles — the class you assigned yourself does the work. If you took alap and came in near 77, you have a documented position just above the line, and the authority can see the distribution you sit in.

If you are registered and have not been audited, the exposure is not reputational. The implementing government decree allows the authority to move from a warning to a fine of up to 150 million forint, and the July notice makes clear it is not waiting passively: entities that failed even to register are being called in on the basis of public-register data. The set of audit-obligated organisations keeps growing for exactly that reason.

And if you operate in Hungary but have never worked out whether the obligation reaches you, the published completion rates are a reasonable proxy for where the authority will look next. Sectors at 59 and 67 per cent are the ones with visible gaps on the supervisor's own dashboard.