The regulator is under review. The four documents are still asked of you.

What the statement says, and what it leaves out

The statement has two parts: the authority's account of itself as an independent regulator created by statute, reporting to Parliament and in operation since 1 October 2021; and a list of results by supervised sector, among them gambling, tobacco, mining and geology, and cybersecurity. Under cybersecurity it cites the national audit framework and the first audit round, whose figures we covered in August. The statement also argues that certain functions derived from EU law must, in its reading, sit with a body independent of central government. We note that as a legal question and take no position on it. It closes by saying it will cooperate, within the law, with the minister designated for the legal review.

What it leaves out matters as much: no operative text, no deadline, no stated purpose. Those come from the press. According to reports by Index, Infostart and Economx, the resolution orders a review of the authority and instructs the justice minister to report, among other things, on how it could be wound up and its functions moved to bodies under government direction, by 30 September 2026. That date is from the press, not from the statement.

The obligation stays with the company

For a regulated company, NIS2 has three layers: the EU directive; the Hungarian cybersecurity act, which sets scope, security classification, mandatory protective measures, an audit every two years and incident reporting; and the supervisory authority that checks all of it. The resolution is about the third layer. It leaves the first two untouched.

In practice, registration, classification, protective measures and reporting remain the company's duty, whoever does the supervising. If the 30 September report recommends moving the functions and the government adopts that, your audit report and incident notifications will be read under a different letterhead. Their content does not change by one character. If the report recommends no change, even that does not happen.

For the supervised company, a reorganisation is a change of address. With a well-kept file, that is administration. Without one, it solves nothing; the gap stays where it is.

Four things a reorganisation does not rewrite

No matter who sends the auditor, they ask for the same four things. These four survive any review of the regulator, because they sit with you and can be produced at any time.

• An asset inventory. Which systems exist, where they run, who operates them, what data they hold, including every AI service your staff use, procured officially or not.
• A current audit report. The last audit's result, the findings, and the status of the actions assigned to them. The report alone ages fast; the maintained action list holds the value.
• An incident log. What happened, when, who noticed, what was done, when it was reported. The directive requires an early warning within 24 hours and a notification within 72 hours. Only recorded timestamps make that possible.
• An access register. Who had access to what, when, and who approved it. This is the item most often missing: everyone grants permissions, few record them.

What we think, including the part that cuts against us

Here are three places where our own argument is weak.

First: the resolution orders a review and asks for a report by 30 September. No decision has been taken. The authority may well continue unchanged; its own statement says it is cooperating with the review. Saying the supervisor is going away reads more into the resolution than is there. We do not know what the report will say, and we will not guess.

Second: this is an institutional, domestic political story, following a change of government. A vendor has no standing to say which Hungarian authorities should exist. One that takes a side on a regulator's fate in order to sell something loses credibility with precisely the regulated companies it hopes to work with. So this article is about one thing only: what sits with the company and stays the same under every outcome.

Third, and most important: NIS2 audit evidence is a matter of security governance and documentation discipline. A private AI infrastructure on European hardware does not produce the four documents above. We operate that kind of infrastructure. Implying that it delivers compliance would borrow the authority of a compliance story to sell an infrastructure product. We will not do that. Our platform becomes one line in your asset inventory, with a known location, a known operator and logs you hold yourself. Keeping the inventory, maintaining the action list and recording who has access remain the job of your security management system, even when the AI runs with us.

What honestly remains for us is narrow. A public AI subscription a colleague set up on a company card often never reaches the inventory, and its logs sit on another continent. A system behind your company login, at a named location, goes into the inventory and its logs stay with you. One line on the list, with data you can check. The rest is your work.

Where we stand

The future of the supervisory system is a matter for Parliament and the government. Our job is to make sure that whatever a company runs with us is a tidy line in its inventory. Our Private ChatGPT runs open-weight models on private European GPUs behind your company login. Prompts, documents, logs and embeddings stay on the platform, on EU infrastructure, with no US data processor in the path. The data does not leave the company. Depending on the edition you choose, it runs on our European hardware or on yours. What you build on ATAILA is yours: code, data, files, intellectual property, with an exit guarantee on the ownership page. If your governance needs an architecture audit or a security audit, we offer those as separate services, with or without the platform.

One question to take home this week: if a different letterhead appeared on your next supervisory letter tomorrow, only one thing in your file should change, the addressee. If more would change, the file is not ready today.

Guides: Private AI for business · Private ChatGPT · Private AI hosting · Private AI platform · Your own private AI · GDPR-compliant AI