New obligations under the NIS2 Directive.

The NIS2 Directive is now in force in Portugal: learn about the new Cybersecurity Legal Framework.

Since April 3, 2026, Portugal has had a much more demanding legal framework for cybersecurity. Decree-Law No. 125/2025, which transposes the NIS 2 Directive, extends the scope of supervision to 17 critical sectors, including Energy, Health, Water, Digital Infrastructure and the Food Industry.

The new Cybersecurity Legal Framework in Portugal brings profound changes that directly affect management bodies.

What you need to know now:

Personal Responsibility: Management bodies are now personally responsible for compliance with cybersecurity measures, and are subject to mandatory training and sanctions for gross negligence.

The Risk of the “Invisible Entity”: Many organizations fall under the regime because of their sector of activity or criticality, even if they do not meet the usual size criteria.

Mandatory Next Steps:

Verification: Use the official simulator at myciber.gov.pt to confirm whether your entity falls within the scope.

Registration: If your entity is covered, registration must be carried out by the legal representative or an authorized agent using Chave Móvel Digital (Digital Mobile Key) or Cartão de Cidadão (Citizen Card).

Registration Deadlines: Entities already in operation have only 60 business days, counted from June 23, 2026, to complete their mandatory registration on the MyCiber platform.

Failure to comply with these obligations may result in severe fines and loss of business continuity.

To reduce risk and avoid commercial blockages, make sure you have the following minimum evidence in place:

• Incident response;
• Business continuity;
• Supply chain security;
• Vulnerability management;
• Access and asset control;
• Training and cyber hygiene;
• Effectiveness monitoring.