NIS2: managerial responsibility and legal risks

Guest post by Dr. Eszter Német; lawyer specialising in cyber security law

What requirements must obligated organisations meet, and what might happen in the event of non-compliance?

NIS 2 makes the resilience of organisations’ digital operations a matter for senior management. In Hungary, Act LXIX of 2024, which came into force on 1 January 2025, provides the main framework. Regulated organisations must assess their risks, implement appropriate safeguards, manage and report significant incidents, and demonstrate that senior management oversees all of this. Failure to comply may result in fines, restoration costs, contractual damages and, where applicable, personal legal consequences for senior management.

Who is covered and what does the EU expect?

The Directive distinguishes between essential and important organisations. Among others, the energy, transport, healthcare, digital infrastructure, postal services, waste management and certain manufacturing sectors are affected. When assessing the scope of application in Hungary, the nature of the activity, the size of the undertaking, any specific designation and size-independent exemptions are all taken into account. The conclusion that ‘I am an SME, so I am exempt’ may be incorrect: medium-sized enterprises may also be subject to the requirements, and for certain service providers, size is not the decisive factor. In the financial sector, a separate EU regime, DORA, may also be relevant.

The EU standard under NIS 2 is proportionate, risk-based protection. Articles 20–23 of the Directive require management approval and oversight, incident management, business continuity, supply chain security, access control, training and the reporting of significant incidents. Within the EU framework, early warning is generally required within 24 hours, and incident reporting within 72 hours; the detailed rules must always be checked in conjunction with the specific organisation’s legal status under Hungarian law.

Daily tasks of the obligated organisation

Under Hungarian law, the organisation operates a comprehensive risk management framework; it inventories its systems, designates responsible persons, carries out risk assessments and security classification, determines the necessary measures, and issues and reviews the information security policy. Operational controls are also required: backup and recovery testing, access control, multi-factor authentication, logging, vulnerability management, supplier requirements and well-rehearsed incident response procedures. Registration with the regulatory authority, data reporting and – for the organisations concerned – a biennial audit must also be carried out. The audit is not a one-off ‘stamp of approval’: any non-conformities must be rectified.

Who bears the financial and personal consequences

The authority may require deficiencies to be rectified and may impose fines.

NIS 2 requires Member States to set a maximum fine of at least €10 million or 2 per cent of global annual turnover for critical organisations, and at least €7 million or 1.4 per cent for important organisations – these are EU thresholds, not automatic Hungarian fine amounts. The details of Hungarian administrative fines and proceedings are determined by domestic regulations. In addition, lost revenue, remedial measures, claims against those affected, breach of contract and, in the case of personal data, proceedings under the GDPR may also constitute a financial burden.

A manager is not exempt simply because they have outsourced IT. Hungarian law expressly places the responsibility for establishing the framework and complying with regulatory obligations on the manager; a separate fine may be imposed for a manager’s failure to fulfil their obligations, and this is mandatory in the event of a repeat infringement. In the event of a specific regulatory obligation remaining unfulfilled for a prolonged period, proceedings may even be initiated to temporarily suspend the head of the organisation. The manager’s civil liability depends on the specific damage, attributable fault and the legal relationships under company law; the organisation’s losses do not automatically become a debt against the manager’s private assets.

The risk under criminal law must also be taken seriously, but it is important to note that a breach of NIS 2 or the occurrence of an attack does not in itself constitute a criminal offence. Criminal liability can only arise if a specific act fulfils all the elements of a criminal offence, and the person’s intent or – where permitted by law – negligence can be proven. For example, the deliberate falsification of evidence relating to the incident, the production of a false official document, or other unlawful data processing activities may be the subject of a separate investigation. The correct managerial response is to preserve evidence, report the incident promptly, and carry out a documented, genuine recovery.

Two instructive cases

A Hungarian example is the DIGI data protection incident: the NAIH investigated the storage and data security shortcomings of the affected databases in a separate regulatory case, and following court proceedings, reached a decision in a re-examination in 2023. This is a GDPR case, not a NIS 2 sanction; it illustrates that, in addition to the attack itself, authorities may also hold organisations to account for their prior data processing decisions. An international example is the British Library’s 2023 ransomware incident: according to its own report, approximately 600 GB of data was stolen, system recovery took months, and essential services were also disrupted. This is not a case falling under NIS 2 either, but a real-life example of the operational, informational and reputational consequences.

In the Meta Platforms Ireland case, the Irish Data Protection Authority’s investigation, concluded in 2023, assessed the legal basis and safeguards for the transfer of Facebook user data from the EU/EEA to the United States.

The dispute between the EU data protection authorities was settled by the European Data Protection Board; the final Irish decision imposed a GDPR fine of €1.2 billion, ordered the suspension of data transfers and required the cessation of unlawful processing. This is not a cyber-attack and is not a NIS 2 fine: the example shows that the legal risk associated with the processing of personal data can, in itself, constitute a significant financial burden.

The first step for management today is a documented impact assessment, followed by the mapping of critical services and suppliers. This can be followed by a budget allocated to risks, the appointment of responsible persons, and a tested incident and recovery plan. What matters to both the regulator and customers is protection that actually works.