NIS2 Portugal: Regime Jurídico da Cibersegurança (Decree-Law 125/2025)
Discover how Portugal has transposed the NIS2 Directive through the new Regime Jurídico da Cibersegurança (RJC), approved by Decree-Law 125/2025, what it means for essential, important and relevant public entities, and how the National Cybersecurity Centre (CNCS) will supervise compliance from 2026 onwards.
Introduction: NIS2 Directive & the Portuguese context
Portugal previously had a fragmented cybersecurity framework, with obligations scattered across sectoral laws and soft-law guidance from the National Cybersecurity Centre (CNCS). The original NIS Directive (NIS1) was only partially reflected in national legislation, covering a limited set of operators of essential services.
The new Regime Jurídico da Cibersegurança (RJC), approved by Decree-Law 125/2025, changes this landscape completely. It transposes Directive (EU) 2022/2555 (NIS2) into Portuguese law and creates one of the most demanding cybersecurity regimes in the EU, with broad scope, strict obligations and reinforced powers for CNCS and sectoral authorities.
NIS2 implementation in Portugal
After several delays and draft bills, Portugal has finally transposed NIS2 through Decree-Law 125/2025 of 4 December, which approves the Regime Jurídico da Cibersegurança (RJC) and explicitly implements Directive (EU) 2022/2555 into national law.
The decree-law was published in the Diário da República on 4 December 2025 and enters into force 120 days after publication, on 3 April 2026. Some provisions will only produce full effects up to 24 months after entry into force, giving entities a limited implementation window.
The RJC is built on previous political steps, including Law 59/2025 of 22 October 2025, which authorised the Government to transpose NIS2 and design the new cybersecurity regime for Portugal.
Status
NIS2 is now formally transposed in Portugal. Decree-Law 125/2025 has been published and will apply from 3 April 2026, following a long period of legislative work and EU infringement pressure for late transposition.
Legal structure
The RJC is a horizontal cybersecurity law that: defines essential and important entities, introduces a special category of relevant public entities (Groups A and B), sets security and incident-reporting obligations, and establishes supervisory and sanctioning powers for CNCS and sectoral authorities.
Supervisory model
Portugal combines a central authority (CNCS) with sectoral cybersecurity authorities such as ANACOM for electronic communications and postal services, coordinated within a national cybersecurity governance framework.
NIS2 Portugal: what you need to know about compliance
The Portuguese RJC mirrors the NIS2 architecture of essential entities and important entities, and adds a third group of relevant public entities. Estimates suggest that several thousand organisations (potentially up to 9,000) will fall within scope once the regime is fully operational.
Who is in scope?
- Essential entities: medium and large organisations in NIS2 Annex I sectors (energy, transport, health, drinking water, digital infrastructure, public administration, etc.).
- Important entities: medium and large organisations in Annex II sectors (postal and courier services, waste management, food, manufacturing of critical products, research, etc.).
- Relevant public entities: selected public bodies split into Group A (most critical) and Group B, including central government and key public-service providers.
- Size-independent entities: providers such as DNS service operators, TLD registries, trust-service providers and major cloud/data-centre operators, regardless of company size.
Core obligations
- Implement cybersecurity risk-management measures aligned with NIS2 Article 21 and national minimum security measures defined by CNCS.
- Maintain policies, procedures and asset inventories covering networks, systems, data and critical services.
- Detect, handle and report significant incidents and certain cyber threats following a 24h / 72h / 30-day reporting ladder via an electronic platform.
- Manage supply-chain cybersecurity risk, including contractual security and incident-notification obligations for critical suppliers.
- Ensure management bodies approve cybersecurity strategies, oversee implementation and receive regular training.
Classification & onboarding
CNCS will operate a national electronic platform through which entities identify themselves, submit required information and are classified as essential, important or relevant public entities. The RJC provides for staged implementation, with deadlines running from the date the regime starts producing effects for each category.
NIS2 timeline & key dates (Portugal)
Sector-specific notes for Portugal
- Energy: electricity, gas and other critical energy operators are treated as essential entities with strict incident-reporting and resilience obligations.
- Digital infrastructure & telecom: electronic communications networks, data centres, cloud providers and key internet infrastructure are a central focus, with ANACOM playing a major supervisory role for communications and postal services.
- Public administration: central government bodies and other relevant public entities (Groups A and B) are explicitly covered to protect critical public services and state digital infrastructure.
- Finance & payments: banks and financial market infrastructures are in scope under both NIS2 and sectoral EU rules, requiring coordinated compliance strategies.
- Health & critical services: hospitals and critical healthcare providers will need to significantly upgrade cybersecurity governance, technical controls and incident readiness.
Penalties for non-compliance
The RJC introduces a strong enforcement regime aligned with NIS2 ceilings, giving CNCS and sectoral authorities the power to impose significant fines and corrective measures on non-compliant entities and, in some cases, to hold management personally accountable.
- For essential entities, fines can reach up to the higher of €10 million or 2% of total worldwide annual turnover for the most serious breaches.
- For important entities, fines can reach up to the higher of €7 million or 1.4% of worldwide annual turnover.
- Additional administrative fines may apply for procedural breaches, such as incomplete or late reporting and failure to cooperate with supervision.
- Corrective measures can include mandatory remediation plans, enhanced supervision and, in serious cases, temporary restrictions on certain activities.
- Management bodies may face specific consequences where they fail to fulfil governance and oversight duties regarding cybersecurity.
How to prepare for NIS2 in Portugal
- Check if you are in scope: map your organisation against NIS2 Annex I & II sectors and typical size thresholds; consider whether you may be classified as an essential, important or relevant public entity under the RJC.
- Follow CNCS guidance: monitor CNCS communications, the NIS2 roadmap and future technical regulations on the national cybersecurity reference framework and minimum security measures.
- Run a NIS2/RJC gap assessment: compare your current controls against NIS2 Article 21 and the upcoming Portuguese minimum security measures, focusing on governance, technical measures, documentation and reporting.
- Prepare for registration and classification: identify critical services, systems, dependencies and key contacts so you can respond quickly when the electronic platform and classification process go live.
- Strengthen incident detection & reporting: design monitoring, escalation and communication processes that can support 24h / 72h / 30-day reporting and integrate with GDPR and sectoral rules.
- Manage supply-chain risk: review contracts with key ICT and service providers, adding explicit cybersecurity, audit and incident-notification clauses.
- Align with recognised frameworks: build or refine your ISMS using ISO/IEC 27001, NIST CSF or similar to structure your NIS2/RJC compliance programme.
- Engage leadership: brief the board and senior management on their new responsibilities and ensure cybersecurity is embedded in overall risk and business strategy.