NIS2 in Portugal: the framework in force since April and the June regulation

Decree-Law 125/2025 of 4 December transposes the NIS2 directive and creates Portugal's new Cybersecurity Legal Framework. It came into force 120 days after publication, on 3 April 2026. The national authority is the National Cybersecurity Centre (CNCS), alongside the sector authorities.

The 22 June regulation

CNCS Regulation 756/2026 was published on 22 June and came into force the following day. It sets out:

• the online platform where entities identify themselves and are classified;
• the National Cybersecurity Reference Framework and a risk matrix;
• three compliance levels, basic, substantial and high, each with minimum measures;
• the rules for incident notification, the annual report, the cybersecurity officer and the permanent point of contact.

What comes later

Article 10 of the decree-law defers several obligations, including those in articles 28 to 30 and 33, until 24 months after the regulation is published. Counting from June 2026, that runs to mid-2028. Classification by the CNCS and preparing the measures take time, and clients in scope are already asking their suppliers for assurances.

Fines

For very serious offences, essential entities face fines of up to 10 million euros or 2% of worldwide annual turnover, and important entities up to 7 million euros or 1.4%. The higher amount applies.

And suppliers?

There is no NIS2 certification for suppliers. Entities in scope have to manage supply-chain risk and do so by contract: security questionnaires, new clauses and requests for evidence. Anyone supplying systems or services to an entity in scope should have answers ready on access, backups, incidents and updates.

On the systems we operate, we gather that evidence as part of day-to-day operations: multi-factor authentication, tested backups, access and incident logs. If you have received a NIS2 questionnaire from a client, or want to know whether your company is in scope, talk to us.