OT Governance Radar

NIS2 obligations in Portugal

transposed Last verified 28 Oct 2026 · secondary source

StatusTransposed
Adopted4 Dec 2025
In forceNot yet published / needs verification
National lawDecree-Law No. 125/2025
Registration portalNot yet published / needs verification
CommissionReasoned opinion, 7 May 2025

Competent authority & CSIRT Legal ref: Art. 55

  • Competent authority and national CSIRT: National Cybersecurity Centre (CNCS), including CERT.PT ecs-org.eu · 28 Oct 2026 · secondary source
  • National authority for managing large-scale cybersecurity crises and incidents: Secretary-General of the Internal Security System. ecs-org.eu · 28 Oct 2026 · secondary source
  • National sectoral cybersecurity authorities and special national cybersecurity authorities (sector specific) . ecs-org.eu · 28 Oct 2026 · secondary source

Who's in scope (national deviations) Legal ref: Article 3, Annex 1, Annex 2

  • The sectoral scope generally corresponds to NIS2 (public administration partially excluded). ecs-org.eu · 28 Oct 2026 · secondary source
  • The scope covers essential, important and public entities. ecs-org.eu · 28 Oct 2026 · secondary source

Registration Legal ref: Art. 35

  • Important, essential and relevant public entities are obliged to register on the designated electronic platform providing: ecs-org.eu · 28 Oct 2026 · secondary source
  • Name of the organisation. ecs-org.eu · 28 Oct 2026 · secondary source
  • Tax identification number. ecs-org.eu · 28 Oct 2026 · secondary source
  • Address and up-to-date contact details. ecs-org.eu · 28 Oct 2026 · secondary source
  • IP address. ecs-org.eu · 28 Oct 2026 · secondary source
  • Sector and subsector classification. ecs-org.eu · 28 Oct 2026 · secondary source
  • List of member states where the entity provides services, if applicable. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 3(4), Art. 27): Member States draw up a list of essential and important entities; entities provide name, contact details, IP ranges, sector and Member States served. EUR-Lex

Incident reporting Legal ref: Art. 40, 41, 42, 43, 44

  • For each incident subject to mandatory notification, the relevant essential, important and public entities shall submit to the competent authority: ecs-org.eu · 28 Oct 2026 · secondary source
  • Initial notification within 24 hours. ecs-org.eu · 28 Oct 2026 · secondary source
  • Where appropriate, update to the initial notification within 72 hours of verifying the significant incident. ecs-org.eu · 28 Oct 2026 · secondary source
  • Notification indicating the end of the incident within 24 hours. ecs-org.eu · 28 Oct 2026 · secondary source
  • Final report no later than 30 working days from the date of notification of the end of the significant impact of the incident. ecs-org.eu · 28 Oct 2026 · secondary source
  • Interim report (if the incident is still ongoing) on a weekly basis until the final report is submitted. ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 23): early warning within 24 hours, incident notification within 72 hours, final report within one month (progress report if still ongoing). EUR-Lex

Management liability & training

Not yet published / needs verification We have not found a published, sourced national rule for this yet.

NIS2 baseline (Art. 20): management bodies must approve and oversee cybersecurity risk-management measures, can be held liable for infringements, and must follow training. EUR-Lex

Penalties Legal ref: Art. 61, 62, 63, 64, 65

  • Very serious offences: ecs-org.eu · 28 Oct 2026 · secondary source
  • From 2,000 to 10,000,000 EUR or up to 2% of annual worldwide turnover (essential entities, legal persons). ecs-org.eu · 28 Oct 2026 · secondary source
  • From 350 to 200,000 EUR (essential entities, natural persons). ecs-org.eu · 28 Oct 2026 · secondary source
  • From 1,250 to 7,000,000 EUR or up to 1.4% of annual worldwide turnover (important entities, legal persons). ecs-org.eu · 28 Oct 2026 · secondary source
  • From 350 to 200,000 EUR (important entities, natural persons). ecs-org.eu · 28 Oct 2026 · secondary source
  • From 16,000 to 4,000,000 EUR (public entities, legal persons, group A). ecs-org.eu · 28 Oct 2026 · secondary source
  • From 500 to 16,000 EUR (public entities, natural persons, group A). ecs-org.eu · 28 Oct 2026 · secondary source
  • From 8,000 to 350,000 EUR (public entities, legal persons, group B). ecs-org.eu · 28 Oct 2026 · secondary source
  • From 500 to 16,000 EUR (public entities, natural persons, group B). ecs-org.eu · 28 Oct 2026 · secondary source
  • Serious offences: ecs-org.eu · 28 Oct 2026 · secondary source
  • From 1,250 to 5,000,000 EUR or up to 1% of annual worldwide turnover (essential entities, legal persons). ecs-org.eu · 28 Oct 2026 · secondary source
  • From 250 to 125,000 EUR (essential entities, natural persons). ecs-org.eu · 28 Oct 2026 · secondary source
  • From 875 to 3,500,000 EUR or up to 0.7% of annual worldwide turnover (important entities, legal persons). ecs-org.eu · 28 Oct 2026 · secondary source
  • From 250 to 125,000 EUR (important entities, natural persons). ecs-org.eu · 28 Oct 2026 · secondary source
  • From 10,000 to 2,500,000 EUR (public entities, legal persons, group A). ecs-org.eu · 28 Oct 2026 · secondary source
  • From 375 to 10,000 EUR (public entities, natural persons, group A). ecs-org.eu · 28 Oct 2026 · secondary source
  • From 5,000 to 225,000 EUR (public entities, legal persons, group B). ecs-org.eu · 28 Oct 2026 · secondary source
  • From 375 to 10,000 EUR (public entities, natural persons, group B). ecs-org.eu · 28 Oct 2026 · secondary source
  • Minor offences: ecs-org.eu · 28 Oct 2026 · secondary source
  • From 875 to 45,000 EUR (legal persons). ecs-org.eu · 28 Oct 2026 · secondary source
  • From 250 to 3,750 EUR (natural persons). ecs-org.eu · 28 Oct 2026 · secondary source

NIS2 baseline (Art. 34): maximum fines of at least EUR 10m or 2% of worldwide turnover (essential) and EUR 7m or 1.4% (important), whichever is higher. EUR-Lex

Security measures, standards & deadlines Legal ref: Article 14, 26, 29, 34

  • National Reference Framework for Cybersecurity. ecs-org.eu · 28 Oct 2026 · secondary source
  • Portuguese Normative Document – Technical Specification (DNP TS) 4577-1, Digital Maturity – Digital Seal ecs-org.eu · 28 Oct 2026 · secondary source
  • Reference to European and international Standards. ecs-org.eu · 28 Oct 2026 · secondary source

Supervisory guidance

Not yet published / needs verification No regulator guidance links recorded yet. Official text: Final Text

What changed recently

No dated changes recorded.

Sections marked secondary source come from the ECSO NIS2 Transposition Tracker (updated 10 Sep 2026), which simplifies law extracts; source-checked items were read on the regulator's or official gazette's site. Data: data/nis2/. Not legal advice — always check the official text.