Boldizsár Szentgáli-Tóth, ELTE Centre for Social Sciences, Institute for Legal Studies, Budapest, Hungary
When the new Hungarian Government backed by Tisza party took office in May 2026 with a two-thirds parliamentary majority, it inherited not only a difficult budget but also a digital policy landscape shaped by sixteen years of Fidesz rule. Public institutions had learned to use technology for control rather than service, while the regulation of platforms, data and artificial intelligence had largely been reduced to the minimum required by the European Union.
This blogpost turns to the new government’s broader digital agenda. Its autumn legislative programme gives the first concrete picture of its priorities. Five proposals are scheduled for submission to parliament in October and November 2026, with adoption targeted for December: an amendment to the Electronic Communications Act setting clearer limits and stronger safeguards for law enforcement access to communications metadata; a new, independent National Cybersecurity Agency and a review of compliance with the EU’s NIS2 Directive; a Digital Innovation Agency to support research, universities and start-ups; a reform of the management of national data assets, with Chief Data Officers in public bodies and a National Data Asset Council; a package on mitigating the harm of digital devices to children, including age verification, restrictions on addictive platform features and obligations for device manufacturers.
This is an ambitious list. Seen from the perspective of fundamental rights and the European standards on online content regulation, however, it also has notable gaps. This post looks at three areas where the stakes are especially high: elections and online disinformation, child protection in the digital sphere, and the use of artificial intelligence by the state itself. It then turns briefly to the institutional questions raised by the remaining proposals.
The April 2026 campaign was the first Hungarian election in which generative artificial intelligence played a central role. Researchers writing for the European Digital Media Observatory documented how the then governing party used artificial intelligence-generated content at an unprecedented scale: deepfake videos portraying Péter Magyar as a puppet of Volodymyr Zelenskyy and Ursula von der Leyen, synthetic images of the “horrors of war”, and a fabricated Tisza party programme with absurd promises. According to survey data cited in the analysis, 73 percent of respondents had encountered such content on social media, and more than half of those who had seen deepfake videos were unsure whether they were authentic.
The existing rules did little to stop this. Platforms removed some political advertisements, but they were relaunched almost immediately and sometimes stayed online for hours. Hungary had no legal requirement to label AI-generated political content, and the transparency obligations of the EU AI Act for deepfakes were not yet applicable. Other observers reached similar conclusions about the absence of effective enforcement.
The outcome of the election shows that disinformation does not automatically decide votes. But the next campaign will be fought under a different set of rules. The AI Act’s transparency obligations under Article 50 began to apply in August 2026. Under the EU’s digital omnibus, which has since entered into force, providers of generative systems already on the market before that date have until 2 December 2026 to mark AI-generated content technically. Hungary’s new government should use the time before the next election to clarify how these obligations will be enforced nationally, which authority is responsible, and how political parties themselves will be held to account when they produce manipulative synthetic content.
The government’s autumn legislative programme indicates that it intends to go further. A separate bill, expected in November, would regulate the creation and publication of manipulative or offensive AI-generated content and attach sanctions to it in criminal and misdemeanour law. The intention is understandable, but the choice of criminal law raises the stakes. Any new offence will have to be drafted narrowly enough to meet the requirements of foreseeability and proportionality discussed below, so that it captures deceptive deepfakes without discouraging satire, parody or political criticism.
There is also a lesson in what not to do. For two years, the fight against “foreign interference” served as the justification for the Sovereignty Protection Office, which in practice targeted NGOs and independent journalists. Parliament abolished the office on 30 June 2026, a move welcomed by press freedom organisations.
The episode illustrates that there is no shared legal definition of “disinformation” in the V4 countries, and vague concepts invite selective enforcement. The ECtHR has set clear limits here. In Ahmet Yıldırım v. Turkey (2012) and OOO Flavus and Others v. Russia (2020), it held that measures restricting access to online content must rest on a precise and foreseeable legal basis, be proportionate, and be subject to effective judicial review, and that wholesale blocking of entire websites or platforms is rarely justifiable. Measures against disinformation must therefore target manipulative practices and opaque funding, not critical voices, and they must be overseen by independent bodies rather than political appointees. This is a lesson for the whole V4 region, not only for Hungary.
The planned package on the harmful effects of digital devices, scheduled for parliamentary debate in November, responds to a real concern shared across Europe. Addictive design features, algorithmic feeds and exposure to harmful content affect children’s wellbeing, and the EU’s Digital Services Act already requires very large platforms to assess and mitigate such risks. According to press reports, the government’s plans would bar children under 13 from high-risk platforms, limit access for those under 16, and leave the method of age verification to a government decree, with the EU digital identity wallet among the options. The KDNP, now in opposition, submitted its own bill in September, which would likewise set a minimum age of 13 for digital platforms and require parental consent for users between 13 and 16.
In Hungary, however, “child protection” carries a specific history. In 2021, the previous government used the label to adopt a law restricting the portrayal of homosexuality and gender diversity to minors. On 21 April 2026, the Court of Justice of the EU ruled in Commission v Hungary (C-769/22) that this law breaches EU law and the values on which the Union is founded. Following calls from Human Rights Watch and a coalition of Hungarian NGOs, the government submitted a bill in September to remove these provisions, and parliament adopted it on 13 October 2026 by 139 votes to 51. The same law, however, introduces new and broadly worded protections against content that is unsuitable for a child’s age or development, and refers explicitly to child protection risks in the digital environment. How these concepts will be applied online will be an early test of whether the lessons of 2021 have been learned.
The new package will be judged against this background. Three principles should guide it.
First, age verification must not become identity verification. Requiring users to prove their age should not mean that every adult has to hand over identity documents to platforms, or that the state can link online activity to real identities. Privacy preserving solutions that confirm only that a user is above a certain age, without revealing who they are, are the only acceptable approach. Anonymity online is also a condition for the exercise of freedom of expression, and mandatory identification would have consequences well beyond child protection.
Second, the rules should target design, not content. Restrictions on infinite scroll, autoplay or manipulative notifications address the business models that harm children. Vague content restrictions, by contrast, risk being used against legitimate information, as the 2021 law demonstrated. Under Article 10 of the European Convention on Human Rights (ECHR), any content restriction must be precise enough for users and platforms to foresee its application.
Third, national rules must fit the EU framework. The Digital Services Act harmonises many platform obligations, and national measures that duplicate or contradict it may be unenforceable. A transparent public consultation, with the participation of child rights organisations, digital rights groups, academic experts and the national Digital Services Coordinator, would help avoid both legal and practical pitfalls.
The third area is perhaps the least visible but the most directly connected to the government’s promise of transparency: the use of artificial intelligence by public authorities themselves.
Hungary adopted its law implementing the AI Act, Act LXXV of 2025, in the final months of the Fidesz government. Together with Government Decree 344/2025, it designated the National Accreditation Authority as the notifying authority and the minister then responsible for enterprise development as the market surveillance authority. The statute also created a Hungarian Artificial Intelligence Council, to coordinate national artificial intelligence policy. After the change of government, these functions moved to the new Ministry of Science and Technology. Under its rules of organisation, adopted in September 2026, a state secretary for digitalisation oversees the AI notifying and market surveillance authority and is responsible for implementing the AI Act, assisted by a deputy state secretary for AI. This brings some clarity, but it also means that the body supervising AI systems remains within the ministry responsible for promoting AI development, a tension that had already been pointed out under the previous arrangement.
Meanwhile, artificial intelligence is already shaping decisions that affect citizens. The National Tax and Customs Administration has stated publicly that its 2026 tax audits are built on risk analysis and AI-supported selection. Its machine learning models draw on invoice, cash register and transaction data, and the AI working group behind them was set up by a 2022 government decision. The police are developing the Szitakötő camera network, which according to HVG includes facial recognition capabilities. Yet there is no public list of AI systems used by Hungarian authorities, no published impact assessment, and no specific rule requiring that people be told when an algorithm contributed to a decision about them.
This is a constitutional problem, not only an administrative one. The Fundamental Law of Hungary guarantees the right to have one’s affairs handled impartially and fairly by authorities (Article XXIV), and the EU Charter of Fundamental Rights protects the right to good administration and to an effective remedy (Articles 41 and 47). A decision that cannot be explained cannot be meaningfully challenged. The CJEU’s SCHUFA judgment (C-634/21, 2023) has already shown that automated scoring which plays a determining role in a decision falls under the GDPR’s rules on automated decision-making.
The EU level will not fill this gap soon. Under the digital omnibus agreement, the AI Act’s obligations for stand-alone high-risk systems, including the registration of public sector deployments in the EU database, have been postponed to 2 December 2027. And even when they apply, they will cover only systems classified as high risk, while many systems used in law enforcement and migration will be registered in a non-public section.
The governance of AI policy itself has also been opaque. According to a review by the Hungarian anti-corruption watchdog K-Monitor, the Hungarian AI Council published only a short closing statement after its inaugural meeting in December 2025, its March 2026 meeting was documented in a single social media post, and its rules of procedure have not been made public.
K-Monitor has also put forward six legislative proposals for what it calls a “transparent AI state”. From the perspective of constitutional law and the European standards discussed above, they offer a sound starting point:
None of these proposals requires an expensive new institution. Similar instruments already work elsewhere: the Netherlands runs a national algorithm register, the United Kingdom has made its Algorithmic Transparency Recording Standard mandatory for central government, and Canada requires a published algorithmic impact assessment before an automated decision system goes live.
The remaining items on the autumn agenda are less controversial at first sight, but they will shape the digital state for years.
The planned National Cybersecurity Agency responds to a genuine need. The EU’s NIS2 Directive raises the bar for the protection of essential services, and Hungary has suffered serious incidents affecting public bodies in recent years. The key question is independence. Cybersecurity agencies often sit close to intelligence services, and in a country with Hungary’s surveillance history, the new agency’s mandate should be strictly defensive, its relationship with national security services clearly regulated, and its incident reporting published in aggregated form. Security and transparency are not opposites: publishing which public systems were breached, and how the breach was handled, is what builds trust.
The reform of national data assets builds on an institutional system created by the previous government, including the National Data Assets Agency. Appointing Chief Data Officers and creating a National Data Asset Council could improve how public bodies share and use data. But data sharing between authorities is also exactly what makes profiling and automated risk scoring possible. The Dutch experience with the SyRI system, struck down by a court in 2020 as incompatible with Article 8 of ECHR for lack of transparency and proportionality, shows what happens when data linkage outpaces safeguards. The new law should therefore include purpose limitation, involvement of the data protection authority, and public documentation of any automated analysis built on shared data.
Finally, the Digital Innovation Agency is meant to support research, universities and start-ups. Public innovation funding has been a recurring source of concern in Hungary, with opaque grant decisions and connections between beneficiaries and political actors. The agency’s grants, contracts and evaluation criteria should be published as open data from day one, so that the digital reset does not reproduce the patterns of the past.
Hungary is not alone in rethinking its digital rules. Our Slovak colleagues have recently analysed on this blog Slovakia’s new digital guardrails and the implementation gap and new challenges in Slovakia’s internet content regulation. Poland, after its own change of government, has grappled with the legacy of spyware use and the reform of its media and data institutions. The common thread across the V4 is that EU frameworks such as the DSA and the AI Act, together with the case law of the CJEU and the ECtHR, set a floor, while the decisive questions of independence, transparency and enforcement are answered at national level. Hungary’s new majority has unusual room for manoeuvre. It can use it to become a positive reference point in the region, and to contribute to the common, rights-based approach to illegal content and disinformation.
The coming months will show whether the new government’s digital agenda extends to accountability as well as to innovation and security. Several of the bills discussed here are due to reach parliament in November, and their details will matter more than their titles.
The amendment of the Electronic Communications Act will reveal whether the government is prepared to make access to communications metadata subject to prior independent approval, to notify those affected and to publish annual transparency reports, or whether the reform will remain a set of procedural adjustments. The digital child protection package will show whether age assurance can be designed in a privacy preserving way, and whether the rules will focus on addictive design rather than on vaguely defined content. The planned bill on manipulative AI-generated content, together with the national enforcement of the AI Act’s transparency obligations, will test whether deepfakes can be tackled without discouraging legitimate political speech, and whether a clearly identified and independent authority will be in charge before the next election cycle.
Equally important is how the state treats its own use of technology. The reform of national data assets offers a natural opportunity to create a public register of algorithmic systems used by public authorities, and the new ministerial structure for AI supervision will need safeguards that keep oversight separate from promotion. Finally, the way these bills are prepared matters in itself. Genuine public consultation, a practice largely abandoned in the past decade, would allow civil society, academic experts and the authorities concerned to identify problems before the laws are adopted rather than after.
The new government was elected on a promise to make the state more transparent and to restore public trust. In the digital sphere, a useful measure of that promise may be less the number of new agencies it creates than the extent to which citizens are able to understand how technology is used in the decisions that affect them.
