Quick answer: NIS2 is the EU cybersecurity directive. Portugal transposed it through Decree-Law No. 125/2025, published on 4 December 2025 and in force since 3 April 2026. It covers thousands of organisations in sectors such as energy, health, transport, water, digital services, manufacturing and food distribution, which must register with the National Cybersecurity Centre (CNCS), apply minimum security measures and report incidents. Even businesses that are not covered will feel the impact, because covered clients will require security from their suppliers.

This article is for information only and is not legal advice. Implementing rules are published by the CNCS: always check current deadlines on the official website.

What is NIS2?

It is the second version of the EU directive on network and information security. It replaces the previous rules and greatly expands the number of sectors and companies covered, with stricter obligations and greater accountability for management.

Is my business covered?

The law distinguishes essential entities and important entities, with proportionate obligations. Covered sectors include:

  • energy, transport, banking and financial markets, health, water and sanitation;
  • digital infrastructure and ICT service management;
  • postal services, waste management, chemicals, manufacturing, food production and distribution;
  • digital service providers, research, higher education and public administration.

Under the general rule of the EU directive, medium and large companies in these sectors are covered (from 50 employees or over 10 million euros in turnover). Some smaller entities may also be included because of the importance of what they do.

Main obligations

  1. Registration on the CNCS platform within 60 days of the platform becoming available.
  2. Risk management and minimum security measures in line with the National Cybersecurity Reference Framework.
  3. Reporting significant incidents within short deadlines. The EU directive provides for an early warning within 24 hours, a notification within 72 hours and a final report within one month.
  4. Supply chain security: adapting contracts with critical suppliers and providers.
  5. Management accountability: the board must approve and oversee cybersecurity measures.

The law provides a transition period: risk management, reporting and supervision obligations apply 24 months after the CNCS publishes its supplementary rules.

What if my business is small?

Even if you are not covered, one of your clients probably is. NIS2 entities must ensure their suppliers are secure, so they will ask for more: security questionnaires, contract clauses, two-factor authentication, backups and incident response plans. Being prepared can be a commercial advantage.

How to start: 6 practical steps

  1. Check whether you are covered, directly or indirectly as a supplier.
  2. Make an inventory of equipment, systems, data and technology suppliers.
  3. Assess risks and current security gaps.
  4. Apply the essentials: two-factor authentication, off-network backups, updates and access management.
  5. Prepare an incident response plan: who decides, who reports and within what deadlines.
  6. Train management and staff. The CNCS has offered free training sessions on the new framework.