Portugal NIS2: Decree-Law 125/2025 and the CNCS regulation, the key deadlines
Portugal's NIS2 law has applied since early April 2026 and the CNCS regulation since June. What is due now, and why the security measures follow in 2028.
Portugal transposes NIS2 with Decree-Law 125/2025, published on 4 December 2025, which approves a new legal regime for cybersecurity. It entered into force 120 days after publication, in early April 2026. On 22 June 2026 the national cybersecurity centre, the CNCS, published Regulation 756/2026, which sets out how the regime is applied, from the registration platform to incident notifications and the minimum security measures. It entered into force the day after publication.
What applies now
- Self-identification: entities identify themselves on the CNCS electronic platform. Entities already active when the decree entered into force have 60 days from the platform becoming available; new entities have 30 days from the start of their activity.
- Cybersecurity officer: essential and important entities designate a cybersecurity officer who sits in or reports directly to management, and notify the authority within 20 working days. For entities already active, the regulation counts this from the notification of their qualification.
- Permanent contact point: at least one contact point, available 24 hours a day, seven days a week during activation periods.
- Incident reporting: an initial notification within 24 hours of establishing a significant incident; an update within 72 hours where needed; a notification within 24 hours after the significant impact ends; a final report within 30 working days of that notification.
What follows in 2028
The cybersecurity measures, supply chain security, residual risk management, the annual report and the measures for public bodies take effect 24 months after the implementing regulation is published. With Regulation 756/2026 published on 22 June 2026, that points to June 2028. The regulation sets the measures by conformity level, based on the National Cybersecurity Reference Framework (QNRCS) and a risk matrix. Certification against the QNRCS scheme or ISO/IEC 27001, where its scope fully covers the services concerned, can attest compliance.
Fines reach EUR 10 million or 2% of worldwide annual turnover for an essential entity, and EUR 7 million or 1.4% for an important entity, whichever is higher.
For the state of NIS2 laws across the EU, see NIS2 in October 2026.
What to do now
Check that you have identified yourself on the CNCS platform, appointed and notified your cybersecurity officer and set up the 24-hour reporting chain. Then use the time to 2028 to build the measures for your conformity level.
Dazr Compliance turns the NIS2 measures into recurring tasks with owners and evidence, includes ISO 27001, and its incident register counts down the 24-hour and 72-hour notification milestones. The interface is available in Portuguese.
Sources
- Diário da República: Decreto-Lei n.º 125/2025, 4 December 2025 (PDF)
- Diário da República: Regulamento n.º 756/2026, 22 June 2026 (PDF)
For information only, not legal advice. Last updated 9 November 2026.
Also available in: Português