Hungary: technology regulation at a glance

Framework: EU Regulation 2023/1114 (MiCA) transposed by Act VII of 2024 on Crypto-Asset Markets, plus national crypto-asset conversion validation regime under SARA Decree 10/2025; supervised by Magyar Nemzeti Bank (MNB), with the Supervisory Authority for Regulated Activities (SZTFH/SARA) overseeing validators.

Crypto is legal in Hungary and comprehensively regulated under MiCA, transposed via Act VII of 2024 with the MNB as the competent authority for CASP authorisation, ART/EMT issuers and market-abuse supervision. Hungary chose a short six-month MiCA transition (ending 1 July 2025) and layered a uniquely strict national overlay on top: from 27 December 2025, every crypto-to-fiat or crypto-to-crypto exchange must carry a 'validation certificate' from an SZTFH-licensed validator, with criminal penalties (up to 8 years' imprisonment) for unauthorised exchanges. The validator regime triggered several foreign exchanges to suspend Hungarian services.

Framework: EU AI Act (Regulation 2024/1689) as primary directly-applicable law; Hungary Act LXXV of 2025 as national implementation statute designating competent authorities and enforcement procedures; National AI Strategy 2025-2030

Hungary is fully subject to the EU AI Act (Regulation 2024/1689), which entered into force on 1 August 2024, applied prohibitions from 2 February 2025, and becomes fully applicable on 2 August 2026. Hungary enacted Act LXXV of 2025, which entered into force on 1 December 2025, establishing the domestic institutional framework for market surveillance, notification procedures, and enforcement. The Minister of Enterprise Development serves as the primary AI market surveillance authority, the National Accreditation Authority as notifying authority, and the Hungarian National Bank oversees AI in financial services.

Framework: GDPR (Regulation (EU) 2016/679) directly applicable; Act CXII of 2011 on the Right of Informational Self-Determination and the Freedom of Information (Infotv), as substantially amended in July 2018 to align with GDPR; supervisory authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, National Authority for Data Protection and Freedom of Information)

Hungary applies the GDPR as the primary data protection law, supplemented by Act CXII of 2011 (Infotv), which was overhauled on 26 July 2018 to introduce national procedural rules, derogations, and coverage of areas outside GDPR scope (law enforcement, national security, national defence). The NAIH is the fully independent supervisory authority with the complete set of investigative, corrective, and sanctioning powers under GDPR Article 58. NAIH enforcement activity rose sharply in 2025, with investigation procedures up 37% and inspection proceedings up 52% year-on-year.

Framework: Payment Services and Electronic Money Act (PSPA, implementing EU PSD2/EMD2); supervised and licensed by Magyar Nemzeti Bank (MNB); mandatory Instant Payment System (AFR) since March 2020

Hungary operates a mature, EU-harmonised licensing regime for payment services under the Magyar Nemzeti Bank (MNB), which issues licences for Payment Institutions (PIs) and Electronic Money Institutions (EMIs) under the Payment Services and Electronic Money Act transposing PSD2 and EMD2. The MNB maintains a public register of authorised entities, EEA passporting applies in both directions, and the MNB operates a regulatory sandbox (Innovation Hub). Hungary's mandatory instant payment system (AFR) has been live since March 2020 requiring all banks to provide 24/7 real-time transfers; BNPL will fall under the Consumer Credit Act from November 2026 via CCD2 transposition.

Framework: Act XC of 2023 on the Entry and Residence of Third-Country Nationals; White Card administered by the National Directorate-General for Aliens Policing (NDGAP) / Office of Immigration and Nationality (OIF); amended by Decree 88/2025 (effective July 15, 2025)

Hungary offers a dedicated residence permit for digital nomads, the 'White Card', introduced in 2022 for non-EU/EEA third-country nationals who work remotely for foreign companies. The permit is valid for one year and may be renewed once, for a maximum continuous stay of two years. Decree 88/2025 tightened procedural requirements from July 15, 2025, including mandatory pre-registration of a Hungarian residential address at the time of application.

Framework: EU Digital Services Act (Regulation (EU) 2022/2065) applied directly; national implementation via DSA Executive Act (Act XCIX of 2023); Digital Services Coordinator: National Media and Infocommunications Authority (NMHH); supplemented by Act XLIX of 2024 (child protection/online pornography) and Act LXXVIII of 2024 (Suppression of Internet Aggression, in force 1 January 2025)

Hungary applies the EU Digital Services Act as its primary online platform and content-moderation framework, with the NMHH designated as the sole Digital Services Coordinator since January 2023 and the DSA fully in force for all intermediaries since February 2024. Parliament supplemented EU rules with national laws on child protection online (Act XLIX/2024) and criminalisation of online incitement to violence (Act LXXVIII/2024). Freedom House rates Hungary 'Partly Free' on internet freedom, noting concerns about government influence over the media landscape and use of the Sovereignty Protection Office to investigate independent online outlets.

Framework: Act LXIX of 2024 on Cybersecurity in Hungary (in force 1 January 2025), transposing EU NIS2 Directive (2022/2555); implemented by Government Decree 418/2024 (XII.23.); supervised by SZTFH (private sector) and NBSZ/national CERT (public sector)

Hungary enacted Act LXIX of 2024 on Cybersecurity, which entered into force on 1 January 2025 and replaced the earlier partial transposition (Act XXIII of 2023), consolidating public and private sector cybersecurity obligations into a single comprehensive statute aligned with NIS2. The law establishes mandatory security classifications, cybersecurity audits, and tiered incident-reporting duties for essential and important entities in high-risk and risky sectors. Dual supervisory authorities operate: SZTFH oversees commercial/private entities and market surveillance, while NBSZ serves as the national CERT and supervises public-sector bodies.

Framework: Act V of 2013 (Hungarian Civil Code, Polgári Törvénykönyv) governs KFT (Kft.) formation; Act V of 2006 governs company registration procedure; FDI national-security screening under Act LVII of 2018; administered by Company Registry Courts (Cégbíróság) via birosag.hu

Hungary permits 100% foreign ownership of companies with no equity caps for general commercial activities. The most common vehicle is the Kft (limited liability company), requiring HUF 3,000,000 (~€7,500) minimum capital; registration is fully electronic through the court system and typically takes 1-3 business days once documents are filed by a licensed Hungarian attorney. Foreign investors acquiring stakes in strategic sectors (defence, energy, telecoms) face mandatory national-security FDI screening, but the blocking rate is below 3%.