Where we work · Hungary
ISO and GRC certification consulting in Hungary
Achieve ISO and GRC certification in Hungary with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 22 standards, one team
- Accredited certification route
- Frankfurt office team
- Effivity and Academy included
Sectors that ask for certification in Hungary
Clients include
ISO and GRC certification in Hungary at a glance
Hungarian demand for ISO and GRC certification rests on an export-oriented manufacturing base, a regulated financial sector and a recent cybersecurity statute. Act LXIX of 2024 on the Cybersecurity of Hungary applies from 1 January 2025 and has regard to the EU cybersecurity directive; the national cybersecurity authority and SZTFH supervise it. NAIH supervises the GDPR under Act CXII of 2011, the Magyar Nemzeti Bank oversees DORA for financial entities, Nébih supervises the food chain and NNGYK handles medical devices. Act LVII of 2015 on energy efficiency exempts obliged enterprises from mandatory energy audits when they hold an accredited EN ISO 50001 certificate. Certificates come from certification bodies accredited by NAH, the National Accreditation Authority, never from Sterling. HIPA lists automotive, electronics, ICT, battery, MedTech, life sciences, food and logistics among its sectors. Sterling serves Hungarian clients from its Frankfurt office, with Effivity and Sterling Academy included in the engagement.
ISO and GRC standards Sterling delivers in Hungary
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Hungary (10)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| General Data Protection Regulation (GDPR) and the Hungarian Act on informational self-determination (Infotv.) Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, the National Authority for Data Protection and Freedom of Information) — an autonomous state administration body that, in NAIH's words, may not be instructed in its functions and operates independently of other organs and of undue influence | The Hungarian legislator amended the Act substantially instead of repealing it, to implement the GDPR and the law enforcement directive. The Act supplements the directly applicable GDPR and continues to apply to data processing under Hungarian jurisdiction, and it gives NAIH the supervisory tasks and powers that the GDPR assigns to a supervisory authority. | |
| NAIH approval procedures for codes of conduct, monitoring bodies and certification criteria NAIH | The Act lists the authorisation procedures that NAIH runs: approval of draft codes of conduct, authorisation of code monitoring bodies, approval of certification criteria, authorisation of contractual clauses and approval of binding corporate rules. The same Act has NAIH publish the kinds of processing that need a data protection impact assessment. | |
| Internal abuse-reporting systems The Act is applied by the employers and bodies it covers; it does not name NAIH as its supervisor | An employer with at least 50 persons must set up an internal abuse-reporting system, and some categories of employer must do so whatever their size. Those channels hold personal data about reporters and the persons reported. | |
| The national cybersecurity authority designated by Government decree, whose powers the National Cybersecurity Institute (Nemzeti Kiberbiztonsági Intézet) page describes, and SZTFH (Szabályozott Tevékenységek Felügyeleti Hatósága, the Supervisory Authority of Regulated Activities) for the medium-sized and larger organisations and the named providers Public administration bodies, majority state-influenced companies, medium-sized and larger organisations in the sectors of the Act's annexes, and certain providers of any size (electronic communications, trust services, DNS, top-level domain and domain registration services) — Hungary's NIS2 implementation | Act LXIX of 2024 on the Cybersecurity of Hungary (Magyarország kiberbiztonságáról szóló 2024. évi LXIX. törvény), with Government Decree 418/2024 (XII. 23.) for its implementation. The Act's preamble has regard to the EU directive on a high common level of cybersecurity, the Act applies from 1 January 2025, it splits covered organisations into essential and important entities, and its duties include classifying electronic information systems into security classes, applying protection measures, registration, a supervisory fee and a cybersecurity audit by an auditor entered in SZTFH's register (SZTFH Decree 7/2024 (VI. 24.) on the register; SZTFH Decree 1/2025 (I. 31.) on the audit procedure). The Act and SZTFH's page do not name ISO/IEC 27001. | |
| Magyar Nemzeti Bank (MNB, the central bank of Hungary), which publishes the supervisory recommendations and DORA reporting information for the financial sector Financial entities (banks, insurers, investment firms, payment institutions and others in DORA's scope) | Regulation (EU) 2022/2554 (DORA), which applies from 17 January 2025 and covers ICT risk management, ICT-related incident handling, resilience testing and ICT third-party risk. MNB says that, because of it, made technical amendments to its recommendations on the protection of IT systems (issued in 2019) and on community and public cloud services (issued in 2020). The statement does not name ISO/IEC 27001. | |
| Nébih (Nemzeti Élelmiszerlánc-biztonsági Hivatal, the National Food Chain Safety Office) Food businesses | Regulation (EC) No 852/2004 requires food business operators to maintain a permanent procedure or procedures based on the HACCP principles. Nébih describes itself as supervising compliance with food chain safety rules nationwide and acting against food fraud. Neither source makes a third-party certificate compulsory. | HACCP |
| Nemzeti Népegészségügyi és Gyógyszerészeti Központ (NNGYK, the National Public Health and Pharmaceutical Centre), Medical Devices Department Medical device manufacturers, importers and distributors | Regulations (EU) 2017/745 (MDR) and (EU) 2017/746 (IVDR), implemented in Hungary by the Department, which describes market surveillance, registration of manufacturers and persons responsible for placing devices on the market (including the National Medical Device Register), authorisation of clinical investigations and vigilance. Its page does not name ISO 13485. | |
| MEKH (Magyar Energetikai és Közmű-szabályozási Hivatal, the Hungarian Energy and Public Utility Regulatory Office), the Office named in the Act Large energy users (energy audits and energy management systems) | Act LVII of 2015 on energy efficiency. An enterprise obliged to carry out energy audits (those whose average annual energy consumption exceeds the Act's threshold) is exempt from the mandatory audit if it operates an energy management system certified to EN ISO 50001 by an accredited certification body, and it sends the valid certificate to the Office. | ISO 50001 |
| EU framework; the Hungarian supervisory arrangements are for the competent Hungarian authorities to confirm Providers and deployers of AI systems | Regulation (EU) 2024/1689 (Artificial Intelligence Act), which lays down harmonised rules on artificial intelligence with duties that depend on role and risk. | ISO/IEC 42001 |
| Not a licensing regulator: the Act applies through criminal proceedings Legal persons exposed to corruption-offence liability | Act CIV of 2001 on criminal measures applicable to legal persons. It allows measures against a legal person where a corruption offence is committed in its activities and its leader intentionally failed in the management or control duty that could have prevented it, or negligently did not know of it and took no preventive step. The Act does not name ISO 37001. |
Accreditation and recognition
- NAH (Nemzeti Akkreditáló Hatóság, the National Accreditation Authority): National accreditation body.
- MSZT (Magyar Szabványügyi Testület, the Hungarian Standards Institution): National standards body (standards role only).
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Public procurement under Act CXLIII of 2015 and Government Decree 321/2015 (X. 30.) (Contracting authorities (ajánlatkérők) under the Act): Each contracting authority sets its own conditions. The Act lets it ask for test reports or certificates from conformity assessment bodies accredited under Regulation (EC) No 765/2008 and requires it to accept equivalent ones. The Decree lets it ask how any quality assurance and environmental management standards required in the procedure are met, and where it asks for certification to environmental management systems it points to EMAS, other recognised systems and standards of accredited bodies, and requires it to accept equivalent certificates from other EU Member States.
Economic zones
- Hungarian automotive manufacturing base: automotive, components and tooling
- Electronics and ICT: electronics, ICT, digital services
- Battery and industrial products: battery manufacturing, industrial products
- MedTech and life sciences: medical technology, pharmaceuticals, life sciences
- Food industry and logistics: food production, logistics
Sterling in Hungary
Sterling delivers in Hungary from its Frankfurt office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions Hungary clients ask
Are certification audits in Hungary conducted in Hungarian or English?
Either can work, and the certification body settles the audit language with you when you apply. Hungarian is the official language and English is commonly used in business, so many audits switch between the two. Tell the body early which language your records and controlled documents are in, and follow any rule in a customer contract or a regulator's procedure.
Is the Hungarian NIS2 law in force?
Yes. Act LXIX of 2024 on the Cybersecurity of Hungary applies from 1 January 2025, and its preamble has regard to the EU cybersecurity directive that NIS2 replaced. Supervision sits with the national cybersecurity authority and SZTFH. Whether your organisation is covered, and as an essential or important entity, is for those authorities or your counsel to confirm.
Which authority supervises the GDPR in Hungary?
NAIH, the National Authority for Data Protection and Freedom of Information. Act CXII of 2011 supplements the GDPR and gives NAIH the supervisory tasks the Regulation assigns to a supervisory authority; NAIH describes itself as autonomous and independent of other organs. For how a particular processing activity is treated, put the question to NAIH or to your counsel.
Which body accredits certification bodies in Hungary?
NAH, the National Accreditation Authority based in Budapest. The European co-operation for Accreditation directory shows NAH as a signatory of its multilateral agreement, with management system certification in scope. Accreditation is granted scope by scope, so request the certification body's accreditation certificate and check that your standard and industry are listed before you commit.
Does Hungarian law reward a certified energy management system?
For enterprises obliged to carry out energy audits, yes: Act LVII of 2015 lets an accredited EN ISO 50001 certificate stand in for the mandatory audit, with the certificate lodged with MEKH. The duty turns on average annual energy consumption against the Act's threshold, so MEKH or your adviser should confirm whether you are in scope.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- General Data Protection Regulation (GDPR) and the Hungarian Act on informational self-determination (Infotv.) — net.jogtar.hu; naih.hu; eur-lex.europa.eu (accessed 18 Oct 2026)
- NAIH approval procedures for codes of conduct, monitoring bodies and certification criteria — net.jogtar.hu; naih.hu (accessed 18 Oct 2026)
- Internal abuse-reporting systems — net.jogtar.hu (accessed 18 Oct 2026)
- Act LXIX of 2024 on the Cybersecurity of Hungary (Magyarország kiberbiztonságáról szóló 2024. évi LXIX. törvény), with Government Decree 418/2024 (XII. 23.) for its implementation. The Act's preamble has regard to the EU directive on a high common level of cybersecurity, the Act applies from 1 January 2025, it splits covered organisations into essential and important entities, and its duties include classifying electronic information systems into security classes, applying protection measures, registration, a supervisory fee and a cybersecurity audit by an auditor entered in SZTFH's register (SZTFH Decree 7/2024 (VI. 24.) on the register; SZTFH Decree 1/2025 (I. 31.) on the audit procedure). The Act and SZTFH's page do not name ISO/IEC 27001. — net.jogtar.hu; sztfh.hu; nki.gov.hu; eur-lex.europa.eu (accessed 18 Oct 2026)
- Regulation (EU) 2022/2554 (DORA), which applies from 17 January 2025 and covers ICT risk management, ICT-related incident handling, resilience testing and ICT third-party risk. MNB says that, because of it, made technical amendments to its recommendations on the protection of IT systems (issued in 2019) and on community and public cloud services (issued in 2020). The statement does not name ISO/IEC 27001. — mnb.hu; eur-lex.europa.eu (accessed 18 Oct 2026)
- Regulation (EC) No 852/2004 requires food business operators to maintain a permanent procedure or procedures based on the HACCP principles. Nébih describes itself as supervising compliance with food chain safety rules nationwide and acting against food fraud. Neither source makes a third-party certificate compulsory. — portal.nebih.gov.hu; eur-lex.europa.eu (accessed 18 Oct 2026)
- Regulations (EU) 2017/745 (MDR) and (EU) 2017/746 (IVDR), implemented in Hungary by the Department, which describes market surveillance, registration of manufacturers and persons responsible for placing devices on the market (including the National Medical Device Register), authorisation of clinical investigations and vigilance. Its page does not name ISO 13485. — ogyei.gov.hu (accessed 18 Oct 2026)
- Act LVII of 2015 on energy efficiency. An enterprise obliged to carry out energy audits (those whose average annual energy consumption exceeds the Act's threshold) is exempt from the mandatory audit if it operates an energy management system certified to EN ISO 50001 by an accredited certification body, and it sends the valid certificate to the Office. — net.jogtar.hu (accessed 18 Oct 2026)
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), which lays down harmonised rules on artificial intelligence with duties that depend on role and risk. — eur-lex.europa.eu (accessed 18 Oct 2026)
- Act CIV of 2001 on criminal measures applicable to legal persons. It allows measures against a legal person where a corruption offence is committed in its activities and its leader intentionally failed in the management or control duty that could have prevented it, or negligently did not know of it and took no preventive step. The Act does not name ISO 37001. — net.jogtar.hu (accessed 18 Oct 2026)
- NAH (Nemzeti Akkreditáló Hatóság, the National Accreditation Authority) — nah.gov.hu; european-accreditation.org; ilac.org (accessed 18 Oct 2026)
- MSZT (Magyar Szabványügyi Testület, the Hungarian Standards Institution) — mszt.hu (accessed 18 Oct 2026)
- Public procurement under Act CXLIII of 2015 and Government Decree 321/2015 (X. 30.) — net.jogtar.hu (accessed 18 Oct 2026)
- Hungarian automotive manufacturing base — hipa.hu (accessed 18 Oct 2026)
- Electronics and ICT — hipa.hu (accessed 18 Oct 2026)
- Battery and industrial products — hipa.hu (accessed 18 Oct 2026)
- MedTech and life sciences — hipa.hu (accessed 18 Oct 2026)
- Food industry and logistics — hipa.hu (accessed 18 Oct 2026)
Talk to a consultant
Plan your certification with the Frankfurt team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
germany@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice