NIS2by country

NIS2 in Portugal

Decreto-Lei n.º 125/2025, de 4 de dezembro, que aprova o Regime Jurídico da Cibersegurança

Law in force since

Law
DL 125/2025 (RJC)
Authority
National Cybersecurity Centre (CNCS)
Classes
entidade essencial (essential), entidade importante (important)
Register
CNCS electronic platform (MyCiber)
ISO 27001
Presumption of conformity

Check your company for Portugal

Get the NIS2 dates for Portugal

  • 2 dates as a calendar file.
  • An alert when the rules change.

This site stores your email and emails you when the NIS2 rules in Portugal change. Unsubscribe at any time.

The law

The decree-law took effect on 2026-04-03, 120 days after its publication on 2025-12-04. Regulation 756/2026 of the CNCS adds the rules for registration, certification and the platform. It took effect on 2026-06-23.

Name
Decreto-Lei n.º 125/2025, de 4 de dezembro, que aprova o Regime Jurídico da CibersegurançaDecree-Law 125/2025, approving the Cybersecurity Legal Regime
Published
2025-12-04
In force
2026-04-03
Text
Read the DL 125/2025 (RJC)

Who is in scope

Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.

The Portuguese law keeps the Directive's size and class rules.

Also note

  • Public administration bodies are in scope. They are "entidades públicas relevantes" in Group A or Group B.
  • Fines for Group A public bodies reach EUR 4,000,000. For Group B they reach EUR 350,000.
  • Providers of public communications networks, trust services, TLD, domain registration and DNS are in scope at any size.

Registration

Register on the CNCS platform within 30 days after you start the activity. Entities already active register within 60 days after the platform opens. Report a change of data within 30 working days. The platform rules are in Regulation 756/2026, in force since 2026-06-23.

Portal
CNCS electronic platform (MyCiber)
Rule
Deadline counts from the day you come into scope
Later entrants
30 days after the rules first apply to you
You need
Log in through the legal representative with a Cartão de Cidadão or a Chave Móvel Digital.

Incident reporting

  1. 24 hEarly warning
  2. 72 hIncident notification
  3. 30 working daysFinal reportafter the end-of-impact notification

Send the reports to CNCS, through the electronic platform.

The initial notice is due within 24 hours of the finding that a significant incident exists. An update follows within 72 hours. A separate notice is due within 24 hours after the significant impact ends. An incident solved within 2 hours needs only the end-of-impact notice.

Measures and proof

Essential
The CNCS or a qualified body can audit essential entities: regular, targeted and ad hoc audits, plus on-site inspections. Essential entities file a signed annual report by the last working day of January.
Important
The CNCS supervises important entities after the fact. Important entities draw up and keep the annual report. The decree-law sets no filing date for them.

The dates, in order

  1. Decree-law published
  2. Decree-law in forceDerived from a rule in the law
  3. Regulation 756/2026 in forceDerived from a rule in the law
  4. Fine waiver request window endsDerived from a rule in the law Next
  5. Risk-measure and annual-report rules (art. 27(1)-(2), 28-30, 33) take effectDerived from a rule in the law

Duties of management

The management body approves the cybersecurity risk measures and supervises them. Its members can be liable for acts or omissions with intent or gross negligence. The entity also names a cybersecurity officer.

Fines

The ceiling is the higher of a fixed amount and a share of the annual turnover of the entity itself.

Fine ceilings, Art. 61(2) DL 125/2025. The higher amount applies. Each "At EUR" figure is the ceiling at that entity turnover.
Class Ceiling At EUR 20mAt EUR 500mAt EUR 2bn
Essential EUR 10m or 2% EUR 10mEUR 10mEUR 40m
Important EUR 7m or 1.4% EUR 7mEUR 7mEUR 28m

The percentage applies to the turnover "da entidade essencial em causa" (the entity itself). The minimum fine is EUR 2,000 for essential and EUR 1,250 for important entities. Serious breaches in art. 62 carry up to EUR 5,000,000 or 1% (essential) and EUR 3,500,000 or 0.7% (important). Natural persons face EUR 350 to EUR 200,000. A reasoned request can waive fines for 12 months after entry into force, until 2027-04-03.