NIS2 is already law in Portugal. Decree-Law No. 125/2025 (Decreto-Lei n.º 125/2025) transposed the European directive and approved the legal framework for cybersecurity, in force since 3 April 2026 and enforced by the National Cybersecurity Centre (Centro Nacional de Cibersegurança, CNCS). Based on the official texts as of 15 October 2026, this guide explains who is in scope, what the law requires and what to do next, which matters if your company has a subsidiary, customers or suppliers in Portugal. For a short definition, see the glossary entry on NIS2.
General information, not legal advice. This text does not determine whether your entity is in scope and does not replace a lawyer's opinion. Last checked: 15 October 2026.
What changed in Portugal, and from when
Directive (EU) 2022/2555 had to be transposed by 17 October 2024. Portugal did so with Decree-Law No. 125/2025 of 4 December, which approves the legal framework for cybersecurity, repeals Law No. 46/2018 (art. 9 of the decree-law) and entered into force 120 days after publication (art. 11 of the decree-law): 3 April 2026, counting from 4 December 2025. The other articles cited are those of the annexed framework.
The CNCS completed it with Regulation No. 756/2026, published on 22 June 2026 and in force the following day. It sets the rules of the CNCS electronic platform (MyCiber) and the minimum measures for each compliance level: basic, substantial and high.
Not everything applies yet. Article 10(2) of the decree-law defers by 24 months, from the publication of the regulation it refers to, the specific measures of article 27 (paragraphs 1 and 2), the supply chain, residual risk and the annual report (arts. 28 to 30), and some of the related fines. Since Regulation No. 756/2026 covers those matters, our reading points to 22 June 2028: confirm it with your legal adviser. Not deferred: the general duty to manage risk (art. 26), self-identification, management duties, the security officer, the point of contact and incident reporting.
Who is in scope: essential and important entities
The law applies to private entities of one of the types in Annexes I and II that are at least medium-sized companies and have the relevant establishment in Portugal (arts. 3 and 4); public administration has its own rules. Check it in four steps.
Step 1: sector and type of entity
Annex I includes energy, transport, banking, financial market infrastructure, health, drinking water and waste water, digital infrastructure, business-to-business ICT service management and space. Annex II includes postal services, waste, chemicals, food, manufacturing, digital providers and research. Managed service providers and managed security service providers are listed in Annex I. Check your type in the official text.
Step 2: size
A small company has fewer than 50 people and a turnover or balance sheet of up to 10 million euros; a medium-sized one has fewer than 250 people and a turnover of up to 50 million or a balance sheet of up to 43 million. So a company in a listed sector with fewer than 50 people and up to 10 million is, as a rule, small and out of scope. Recommendation 2003/361/EC, to which the decree-law refers, has rules on partner and linked enterprises that can change the count inside a group: ask for confirmation.
Step 3: exceptions regardless of size
The law applies regardless of size (art. 3(2) and (5)) to public electronic communications networks and services, trust services, top-level domain name registries, domain name registration and DNS, the sole provider of an essential service, entities whose disruption would affect public safety or health or create systemic risks, and critical entities under Directive (EU) 2022/2557.
Step 4: establishment and qualification
As a rule, what matters is having an establishment in Portugal. For managed service providers, managed security service providers, cloud, data centre, DNS and other digital service providers, the main establishment counts: where cybersecurity risk-management decisions are predominantly taken or, if that cannot be determined, where operations are carried out (art. 4).
| Essential entities | Important entities | |
|---|---|---|
| Who (art. 6) | Annex I types above the medium-enterprise thresholds; medium-sized public electronic communications providers; qualified trust services, top-level domains and DNS, of any size; critical entities or entities designated by the CNCS | The rest of Annexes I and II |
| Supervision | Regular inspections and audits (art. 54) | Ex post, when there are indications (art. 55) |
| Maximum fine (art. 61) | 10 million euros or 2% of worldwide turnover | 7 million or 1.4% |
The substantive obligations are the same. The CNCS decides the qualification, based on the self-identification form on MyCiber; the platform's help tool is for information only (Regulation, art. 4). The deadline is 30 days after starting activity for new entities and 60 days after the platform became available for existing ones (art. 8(1) of Decree-Law No. 125/2025, which says only "60 days"); the CNCS coordinator, quoted on the gov.pt portal, referred to 60 working days. The date the platform became available, on which the deadline depends, does not appear in the official texts we consulted, so confirm with the CNCS whether the deadline has passed. Anyone who may be in scope and has not yet self-identified should do so immediately: failing to comply with art. 8 is a serious administrative offence (art. 62).
Suppliers: NIS2 arrives by contract
The decree-law does not impose the framework on those outside its scope, but it requires in-scope entities to manage supply-chain security (with deferred effect, see above), taking into account the vulnerabilities of each direct supplier and its cybersecurity practices (arts. 27(1)(c) and 28). In practice, an in-scope customer can ask a very small supplier for questionnaires and evidence.
As a customer: inventory your critical suppliers; set incident notice periods in the contract that let you meet your own deadlines; ask for proportionate evidence such as policies, tests and, where they exist, certifications such as ISO 27001.
As a supplier: prepare a simple file: approved policies, multi-factor authentication, tested backups, an incident log, training and subcontractors. A managed IT service provider may itself be in scope if it is at least a medium-sized company; in that case the CNCS regulation refers the definition of significant incident to Implementing Regulation (EU) 2024/2690 (art. 20(3)).
The role of the CNCS and other authorities
The CNCS is the national cybersecurity authority (art. 19). It hosts CERT.PT, the national incident response team, adopts regulations, qualifies entities, receives notifications and supervises (arts. 20 and 22). There are separate authorities for trust services (Gabinete Nacional de Segurança), electronic communications and postal services (ANACOM) and the financial sector, where the framework applies without prejudice to DORA (arts. 3(9) and 15). For all other companies, the CNCS is the counterpart.
What the law requires, in plain words
Four blocks: governance, risk measures, incident reporting and fines.
Governance and management accountability
Management bodies approve the risk measures, oversee their implementation, comply with the authority's orders and ensure regular training (art. 25). Their members can be held liable for intentional or grossly negligent acts or omissions, and can only delegate these duties to one of their own members. Each entity also appoints a cybersecurity officer, who must be a member of the management body or report directly to it (art. 31), and a permanent point of contact, a person or team available 24 hours a day during the activation periods the authority announces (art. 32). Existing entities had to notify both to the CNCS within 20 working days after 3 April 2026 (arts. 31(4) and 32(4)).
Risk-management measures
The measures are technical, operational and organisational, proportionate to the risk, and cover at least the areas of article 27. The CNCS sets the minimum measures per compliance level from the sector's risk matrix, and the entity documents its residual risk (art. 29). These specific measures have deferred effect; the general duty to manage risk (art. 26) already applies.
| Areas of art. 27(1) | What it usually means for an SME |
|---|---|
| Incidents, continuity and backups | Procedure and log; immutable backup, tested restore and a business continuity plan |
| Supply chain, acquisition and vulnerabilities | Supplier inventory and clauses; patch management |
| Effectiveness, cyber hygiene and training | Audits, tests and metrics; training for management and staff |
| Cryptography, people, access and assets | Encryption; joiners and leavers, least privilege, inventory |
| Multi-factor authentication and secure communications | MFA on email, VPN and administration |
ISO/IEC 27001, with a scope that fully covers the systems concerned, or the QNRCS scheme can give a presumption of compliance with the cybersecurity measures, not with the other duties, if the certificate from an accredited body, with its statement of applicability, is submitted to the CNCS (Regulation, art. 27). It is voluntary.
Reporting significant incidents
An incident is significant if it causes, or may cause, severe operational disruption or financial loss to the entity, or considerable damage to third parties (art. 2). The Portuguese timeline differs from the directive's, and notifications are made on MyCiber.
| Stage | Deadline |
|---|---|
| Initial notification | Without undue delay and within 24 hours of concluding that a significant incident exists or may exist (art. 42) |
| Update | Where necessary, within 72 hours of the finding (art. 42) |
| End of significant impact | Within 24 hours of the end of the impact (art. 43) |
| Final report | Within 30 working days of notifying the end of the impact (art. 44) |
If the incident is resolved within two hours of detection, notifying the end of the impact is enough (art. 41). If it is still ongoing when the final-report deadline arrives, the CNCS can ask for weekly interim reports. If personal data is breached, the GDPR may require notifying the CNPD within 72 hours, and complying with this framework does not remove other notifications, such as to the Polícia Judiciária (art. 40(5)).
Fines and sanctions
Very serious offences, such as failing to appoint the officer and the point of contact, failing to report incidents or, once the deferral period ends, failing to apply the measures or submit the annual report, carry fines of up to 10 million euros or 2% of worldwide turnover for essential entities, and up to 7 million or 1.4% for important ones, whichever is higher (art. 61). Negligence is punishable, with the limits halved (art. 64). Except in cases of intent, proceedings require a prior warning to comply within a reasonable period (art. 66(5)).
For 12 months after entry into force (until 3 April 2027, by our count), an entity can submit a reasoned request to be exempted from fines because it does not yet have an internal adaptation procedure (art. 65); the exemption is not automatic.
Practical checklist for a small company
Suggested order, not a legal obligation.
- Scoping. Confirm with your legal adviser whether sector, size and establishment put you in scope.
- Self-identification. If the company may be in scope, fill in the MyCiber form and keep the receipt.
- Management, officer and point of contact. Give a member of management the responsibility, approve the risk approach, appoint the officer and the point of contact, and schedule training.
- Inventory. List assets, data, critical suppliers and internet-facing services.
- Baseline controls. Multi-factor authentication, updates, backups kept off the production network and a tested restore.
- Policies, incidents and suppliers. Approved policies, a procedure that says who decides an incident is significant, and a map of critical suppliers. Keep minutes, training records and test results.
What to ask your IT provider
Ask for the answers in writing.
- Are you in scope of NIS2? Have you already self-identified on MyCiber, and with what qualification?
- Who is your cybersecurity officer, and how do I reach them out of hours?
- How quickly will you tell me about an incident that affects me?
- What multi-factor authentication, backups and updates do you apply to my environment, and with what evidence?
- Which certifications do you hold, and with what scope?
- What happens to my data if we end the contract?
Portugal and Spain: what differs
As a rule, the framework of the member state of establishment applies, with exceptions (art. 4). In Spain, as of 15 October 2026, we found no transposition law published in the Boletín Oficial del Estado and no bill in the Congreso de los Diputados open data. A company active in both countries may face different obligations and timelines: a medium-sized Portuguese subsidiary in a listed sector can already be bound while its Spanish parent is not yet. Our guide to NIS2 for SMEs in Spain covers the Spanish side.
What Impulso Tecnológico does
As a managed service provider, Impulso Tecnológico is assessing its own position under NIS2 and will share with customers whatever applies to them.
Our cybersecurity service covers assessment, technical controls and training, including for companies with sites in Portugal. We do not give legal advice, decide whether an entity is in scope or issue certifications. Our guides to an IT security plan and an IT systems audit cover the technical steps.
Request a consultation if your company operates in Portugal and you want to review the technical controls you will be asked about.
Sources and date checked
Consulted on 15 October 2026. Portugal: Decree-Law No. 125/2025 (record); Regulation No. 756/2026; CNCS; MyCiber; gov.pt. European Union: Directive (EU) 2022/2555; Implementing Regulation (EU) 2024/2690. The official text always prevails.