Portugal · PT

← Back to tracker

Status

Transposed

In force from

2026-04-03

Implementing law

Decreto-Lei n.º 125/2025, de 4 de dezembro — Regime Jurídico da Cibersegurança

EU infringement procedure

Reasoned opinion

Competent authority

Centro Nacional de Cibersegurança (CNCS) Competent authority NIS2 page →

National CSIRT

CERT.PT (within CNCS) CSIRT website →

Notable national choices

• Published 4 December 2025 but enters into force only 120 days later — i.e. 3 April 2026.
• Some risk-management, incident-reporting and supervision provisions take effect only 24 months after CNCS publishes supplementary regulations.
• Transposed via Decree-Law (government regulation) rather than parliamentary Lei.

Sources

• https://www.vda.pt/en/publications/newsletters-and-flashes/nis-2-directive-transposed-in-portugal-decree-law-no-1252025-published/28172/
• https://www.cncs.gov.pt/pt/diretiva-nis-2/

Last verified: 2026-05-27