INFORMATION AND TASKS RELATED TO THE IMPLEMENTATION OF THE EU CER DIRECTIVE IN HUNGARY
Legal Background of the Hungarian Critical Entities Regulations
On December 14, 2022, the European Union adopted Directive (EU) 2022/2557 of the European Parliament and of the Council on the resilience of critical entities and repealing Council Directive 2008/114/EC (“CER Directive”), which entered into force on January 16, 2023.
The CER Directive has set the objective of achieving a high level of resilience by requiring Member States to identify critical entities that will be subject to specific requirements and supervision and will be provided with particular support and guidance in the face of all relevant risks. Hungary has fulfilled its obligation to transpose the CER Directive by adopting Act LXXXIV of 2024 on the Resilience of Critical Entities (“Critical Entities Act”), Most provisions of the Critical Entities Act entered into force on January 1, 2025.
Annex 1 of the Critical Entities Act sets out the activities that qualify an organization as “critical”, which among others include the following:
| Sector | Subsector | Essential services |
| Healthcare | Patient care | Healthcare services |
| Services necessary for the operation of a health service | ||
| Public health | Domestic clinical and epidemiological microbiology laboratory service | |
| Laboratory services for public health security | ||
| EU reference laboratory service | ||
| Vaccine production and trade | ||
| Medicine supply | Pharmaceutical research and development | |
| Production of pharmaceutical basic products and pharmaceutical preparations | ||
| Wholesale of pharmaceutical goods | ||
| Supply of medical equipment | Manufacture and sale of medical devices considered critical and in vitro diagnostic medical devices | |
| Blood supply | Blood product supply and associated analyses | |
| Energy | Electric energy | Electricity trade |
| Operation of electricity distribution systems | ||
| Operation of electricity transmission systems | ||
| Production of electricity | ||
| Electricity market management | ||
| Electricity aggregation, demand response or energy storage services | ||
| Black start services (keeping the transmission system operator’s equipment ready for system restart) |
The Critical Entities Act defines a critical entity as “an essential service provider designated by the designating authority as essential for the social and economic stability of Hungary and for the maintenance of security, the environment, public health, defense capabilities and the national resilience system”.
- Hungarian CE Designating Authorities and the European Critical Entity
Pursuant to Section 2 (1) of Government Decree No. 474/2024 (XII. 31.) on the implementation of the execution of the Critical Entities Act (“Government Decree No. 474/2024”), the designated Hungarian authority responsible for the resilience of critical structures is the National Directorate General for Disaster Management of the Ministry of Interior (Hungarian acronym: “BM OKF”). In the energy sector, it is the Hungarian Energy and Public Utility Regulatory Authority (Hungarian acronym: “MEKH”); hereinafter together: the Designating Authority.
The Designated Authority will contact the registered chief executive officer / managing director of the entity with a questionnaire and request it to be returned via their electronic business gate (in Hungarian: Ügyfélkapu) in fifteen (15) days. Based on the replies, the Designating Authority will determine if the entity is a Critical Entity.
The CER Directive also provides for the possibility for the European Commission to consider an organization a critical entity of particular European significance (“European Critical Entity” or “ECE”), where it (a) has been identified as a critical entity pursuant to said Directive; (b) provides the same or similar essential services to or in six (6) or more EU Member States; (c) has been notified of this without undue delay.
If a company provides essential services to/in six (6) or more Member States, it shall inform the Designating Authority (as set out in Section 8 of Government Decree No. 474/2024). Based on this information, the Designating Authority shall make a referral to the Minister responsible for disaster prevention, who will contact the European Commission to launch the conciliation procedure.
- Obligations of Critical Entities
In the case of being designated as a Critical Entity, the entity shall, within ninety (90) days of the designation decision becoming effective, arrange for the designation of a Resilience Officer (either on a commission or an employment basis), whose details will have to be provided to BM OKF. This Officer is responsible for submitting the resilience plan of the organization by the set date by submitting the specific form electronically via the Hungarian “ePapír” system.
If an organization is designated as a critical entity by BM OKF, the organization will have the following main obligations:
- Resilience building;
- Safe and secure operation;
- Preparation and submission of a Resilience plan;
- Governance changes (establishing a separate senior critical entity resilience officer position);
- Regular Testing and Audits; and
- Incident Reporting.
