A hálózat csapdájában

An easy-to-understand guide for small business owners, free from legal and IT jargon

If you’ve been reading the news about cybersecurity recently, you’ve no doubt come across some strange acronyms: NIS2, GDPR, DORA, CRA. These are all European Union regulations, and at first glance it may seem as though they only apply to banks, electricity suppliers and large multinationals.

The good news: most of these regulations do not, in fact, apply directly to your business.

The not-so-good news: they will still affect you, through your clients, your insurer and your purchases. In this article, I’ll explain what you need to be aware of and what you should do now.

1. What already applies directly to you

Data protection (GDPR): this applies to everyone

You’re probably familiar with this regulation; it’s been in force since 2018. If your company processes any personal data – such as customers’ names, telephone numbers, email addresses or employees’ details – then it applies to your company too. Regardless of its size.

From a cyber security perspective, two things are important here:

You must protect the data. It doesn’t have to be perfect, but reasonable precautions are necessary: passwords, backups, and up-to-date systems.

If something goes wrong, you must act quickly. If, for example, a laptop containing your customer list is stolen, or a virus encrypts your computers, such a data protection incident must be reported to the National Authority for Data Protection and Freedom of Information (NAIH) within 72 hours.

Seventy-two hours is a short time. If you do not know in advance who to contact in such a situation, you could easily miss the deadline.

The use of artificial intelligence

Since February 2025, the EU’s Artificial Intelligence Regulation has stipulated that anyone using an AI tool in their work (such as ChatGPT, Copilot or an AI-based customer service programme) must ensure that their colleagues understand what the tool does and what they need to be aware of.

In practice, this is not complicated. All that is needed is a short, easy-to-understand internal rule setting out what data may be entered into these programmes and what may not. For example, not customer names, quotations or personal data. This could be accompanied by a brief discussion with colleagues. This is also a cybersecurity issue, because once data has been entered into such a programme, it is no longer under your control.

NIS2: if you have more than 50 employees

NIS2 is the EU’s main cybersecurity regulation, which was introduced in Hungary by the Cybersecurity Act, in force since 1 January 2025.

This regulation is strict: it requires registration, regular external audits and internal security policies, with supervision carried out by the Supervisory Authority for Regulated Activities (SZTFH).

Small businesses are generally not covered by this. However, you must still take note if:

the company employs at least 50 people, or its turnover and balance sheet total both exceed 10 million euros, and

it operates in a sector listed by law. Examples include energy, transport, healthcare, food production and distribution, certain manufacturing sectors, waste management, courier services and digital services.

Please note: if your company is part of a group of companies or shares an owner with other companies, the number of employees and turnover must often be aggregated. Consequently, even a company with 20 employees on paper may fall under the rule.

The deadlines for compliance have already passed, and the regulator has been checking since autumn 2025 to see who has failed to register. If you are unsure whether this applies to your company, ask your accountant or a specialist as soon as possible.

2. What affects you through your customers

This is the most important part.

Larger companies falling under NIS2, as well as banks and insurance companies (which are subject to the regulation known as DORA), are not only responsible for their own security, but also for the security of their suppliers. If a hacker gains access to a large company’s system via a smaller supplier, the large company is also liable.

That is why large companies pass these requirements on to their suppliers. In practice, it looks like this:

One day, an email arrives from their largest client: “Please complete the attached supplier security questionnaire.” Thirty questions: do you have two-factor authentication, how do you back up your data, when were the machines last updated, do you have an incident response plan? And in the next contract, a new clause appears: if a security incident occurs, the client must be notified within 24 hours.

If you supply, subcontract or provide services to larger companies (for example, manufacturing components, doing bookkeeping, maintenance, providing IT services, cleaning or transport), expect to receive this letter. Those who can prepare for this will gain a competitive advantage. Those who cannot may lose the order.

3. What matters when making purchases

The EU expects security not only from companies, but also from products.

Since August 2025, wireless devices sold in the EU (Wi-Fi routers, cameras, smart devices) must meet basic security requirements.

For example, not every device can have the same factory-set password.

From December 2027, under the Cyber Resilience Act (CRA), manufacturers will be required to provide security updates for almost all software and digital devices for several years, and must also inform the purchaser of this period.

At the same time, the product liability rules are also being updated, and these must be incorporated into Hungarian law by the end of 2026. Under these rules, software is also considered a product, and if the manufacturer fails to issue security updates and this results in damage, they may be held liable.

What does this mean for you as a consumer? When buying a new device or programme, ask: “How long will I receive security updates?” Avoid very cheap cameras and routers that are unbranded or of unknown origin. As we saw in the previous article, a device that no longer receives updates is an open door for hackers.

If you develop, manufacture or distribute software or electronic devices, then the CRA applies directly to you, regardless of the size of your company. The first obligations, such as reporting critical security vulnerabilities, have been in force since September 2026. In this case, be sure to seek professional help.

4. What may still change

The EU recognises that numerous regulations entail a significant administrative burden, which is why it proposed simplifications in late 2025 and early 2026. The key elements are:

A single EU reporting point where incidents could be reported in one place, rather than having to report to multiple authorities separately;

Data protection incidents would only need to be reported to the authority in more serious cases, and 96 hours would be allowed for this, instead of the current 72 hours.

Important: these are, for the time being, merely proposals, not yet binding rules. And whilst the simplification would reduce paperwork, it would not reduce the obligation to protect data.

5. Where is the world heading? Five changes to look out for

• Contracts will increasingly include security provisions. The questionnaire and the 24-hour notification requirement will soon become part of everyday life.
• Cybersecurity is the responsibility of senior management. In large companies, the law holds managers accountable, and this approach trickles down through the organisation. It is not enough simply to say, ‘the IT specialist will sort this out’.
• You must react quickly. Every regulation sets deadlines measured in hours. You need to know in advance who does what in the event of a problem.
• More and more basic security measures are now mandatory. Two-factor authentication, backups, updates: what was previously recommended will now be a requirement.
• Insurance companies are also tightening their rules. It is becoming increasingly difficult to take out cyber insurance without basic security measures in place, and if something goes wrong, the insurer will check what you have done to prevent it.

What should you do now? A ten-point to-do list

1. Check whether NIS2 applies to you. Ask your accountant or a specialist, particularly if you have more than 50 employees or if your company is part of a group of companies.
2. Enable two-factor authentication for your email, banking and cloud service accounts. This requires a code or approval sent to your phone in addition to your password. This is one of the most effective and cheapest forms of protection.
3. Update your computers. If they are still running Windows 10, plan to upgrade.
4. Make a backup, keeping at least one copy offline, and test that you can actually restore from it.
5. Make a list of your computers, devices and software. This includes your router, camera and printer.
6. Have a one-page contingency plan: who to call if there’s a problem (IT specialist, insurer, NAIH), and who makes the decisions.
7. Establish a simple rule for the use of AI devices and discuss it with your colleagues.
8. Hold a short training session on phishing emails. Most attacks start with a single wrong click.
9. When making a purchase, ask about updates and avoid devices from unknown sources.
10. Be prepared for customer questionnaires. With the help of an expert, draw up the answers once, and then you’ll only need to update them.

EU regulations may seem daunting at first, but the essence is simple: they all require the same few basic safeguards. Anyone who keeps their devices in good working order, uses two-factor authentication and knows what to do in the event of a problem already meets most of the requirements. You don’t need to be an IT specialist to do this; all you need is a reliable professional and a few hours of attention. This costs far less than a lost order or a ransomware attack.

If you have any questions regarding your company’s IT security, please do not hesitate to consult a specialist: prevention is always cheaper than repairing the damage.