Portugal NIS2 Implementation: Decree-Law 125/2025, MyCiber registration and reporting rules

Portugal has transposed NIS2, and the work now sits in a platform: entities must self-identify on the CNCS's MyCiber portal, accept a qualification decision, name a cybersecurity officer and then meet a tiered set of minimum measures within 24 months. Decree-Law 125/2025 of 4 December 2025 approves the Regime Jurídico da Cibersegurança (RJC), and Regulamento n.º 756/2026, published by the Centro Nacional de Cibersegurança (CNCS) on 22 June 2026, puts it into operation. This guide covers what is specific to Portugal: who is in scope, the registration and qualification sequence, the three compliance levels, the reporting steps and the sanctions. It does not repeat the Directive itself, which our NIS2 Directive Guide explains, or the EU-wide status in the NIS2 Transposition Tracker. It is written for security, risk and compliance leads with operations or customers in Portugal. Status line: checked on 14 November 2026 against Regulamento n.º 756/2026 in the Diário da República and published summaries of Decree-Law 125/2025; deadlines below may move as the CNCS issues technical instructions.

Key takeaways

• Qualification is a decision, not a self-assessment: entities self-identify on MyCiber, the competent authority sends a draft qualification, the entity has 10 working days to comment, and a final decision fixes its category and compliance level.
• Public administration is firmly in scope: central, regional and local public bodies and higher education institutions are covered as relevant public entities in Groups A and B, with their own minimum measures.
• Three compliance levels drive the work: basic, substantial and high, set by a risk matrix in Annex II of the Regulamento; the CNCS reference framework (QNRCS) is the control baseline.
• Names on file: essential and important entities must register a cybersecurity officer and a permanent contact point on MyCiber, with deadlines that run from the qualification notice.
• The clock to comply is 24 months: after qualification, entities have 24 months to put the minimum measures in place, while incident notification and registration duties apply already.

The legal texts and their status

Portugal's NIS1 law was Law 46/2018. NIS2 arrived later than the October 2024 deadline, and Portugal was among the 19 Member States that received a Commission reasoned opinion on 7 May 2025. The current framework has two layers.

Article 35(3) of the Regulamento adds a practical rule: while technical instructions are pending, entities must already send the authority any information that can be determined under existing criteria. Waiting for every instruction is not a defence.

Scope: who is covered

The RJC follows the Directive's sector and size model, with Annex I sectors (energy, transport, banking, financial market infrastructure, health, water and waste water, digital infrastructure, ICT service management and space) and Annex II sectors (postal and courier, waste management, chemicals, food, manufacturing, digital providers and research). Portugal's distinctive choices are on the public side.

• Relevant public entities: central, regional and local public administration, excluding bodies with exclusive competences in national defence, public security and intelligence. Summaries also list the Ombudsman, the Economic and Social Council and the technical and administrative services of the Presidency, Parliament and the courts.
• Higher education: higher education institutions are named in scope, which goes further than the Directive's research sector.
• Ranking where categories overlap: the most demanding category applies, in the order essential, important, relevant public entity Group A, relevant public entity Group B.
• Scale: the CNCS coordinator told Lusa in June 2026 that about 6,000 entities are expected under the new regime, against about 450 under the previous one.

For groups operating in several Member States, compare the national scope rules side by side before assuming one registration covers all; the NIS2 Transposition Tracker lists each national law.

Authorities and the MyCiber platform

MyCiber became available on 23 June 2026. It handles self-identification, qualification notices, officer and contact point designation, annual reports and incident notifications. Access is by the legal representative using the Cartão de Cidadão or Chave Móvel Digital, and the entity can see who accessed its account and what was done. Treat MyCiber access as a privileged business account: decide who holds it, record delegations and review them each quarter.

Registration and qualification sequence

1. Self-identify: submit tax number, sector, workforce, turnover and contacts on the electronic form. The CNCS coordinator described a window of 60 working days from the platform launch for existing entities; some summaries state 60 days. New entities have 30 days (some summaries say 30 working days) from starting activity. An entity that missed the window should register now and document why.
2. Draft qualification: the competent authority notifies a draft decision; the entity has 10 working days to comment (Regulamento Art. 9(2)). Check the category, the compliance level and the listed services before accepting it.
3. Final qualification: the decision fixes the category and the measures that apply. If the entity is found out of scope, its provisional registration is extinguished within at most 90 days (Art. 9(7)).
4. Designate people: register the cybersecurity officer (Art. 14) and the permanent contact point (Art. 15), with the deadline running from the qualification notice; summaries give 20 working days.
5. Asset list: important and relevant public entities update the asset list by the last working day of January (Art. 32(3)(c)); PwC reports a first deadline of 31 January 2027 or six months after the final qualification, whichever comes first.
6. Implement and report: put the minimum measures in place within 24 months and file annual reports as the RJC requires; PwC reports that essential entities file every year and important entities on request.

Compliance levels, QNRCS and minimum measures

The Regulamento sets three levels (Art. 28(3)): basic, substantial and high, assigned through the Annex II risk matrix, which weighs the entity's nature, its importance to the economy and society and the potential impact of an incident. Higher levels include the measures of lower levels (Art. 30(2)), and where an entity falls under more than one level the most demanding applies (Art. 30(4)).

The RJC risk management system must cover risk analysis, incident handling, continuity, supply chain security and the use of encryption and multi-factor or continuous authentication. Supply chain duties include assessing direct suppliers' vulnerabilities and secure development practices, identifying external dependencies whose failure would hit critical operations and writing security requirements into contracts.

Incident notification

Significant incidents go through MyCiber in three steps (Regulamento Art. 20(1)), with timings set by Articles 42 to 44 of the RJC as summarised by law firms:

Two operational points from the Regulamento matter. Automatic deadline alerts on the platform are a courtesy: Article 22(4) states that a missing alert does not excuse late reporting. And if the entity cannot use the platform, Article 20(4) allows exceptional notification by email or phone, so keep those CNCS contacts in the offline incident pack. Where personal data is involved, the GDPR 72-hour notification to the CNPD runs in parallel; the Cyber Incident Reporting Requirements Map lines up the clocks.

Management duties and sanctions

• Accountability: management bodies approve risk management measures, supervise their implementation and ensure cybersecurity training. These duties generally cannot be delegated outside the body.
• Personal liability: members may be liable for intentional or grossly negligent infringements, so decisions should be documented.
• Fines for essential entities: according to law firm summaries of the RJC (Cuatrecasas, VdA), up to EUR 10 million or 2% of worldwide annual turnover of the previous financial year, whichever is higher.
• Fines for important entities: on the same summaries, up to EUR 7 million or 1.4% of worldwide annual turnover of the previous financial year, whichever is higher.
• Other measures: ancillary sanctions and compulsory financial penalties are available, and negligence is also punishable.

Where identity fits

Several Portuguese duties land on identity teams. The RJC names multi-factor or continuous authentication in the risk management system, and MyCiber itself relies on strong citizen identity. The asset list and supply chain duties also reach the service accounts, API keys and integration tokens that suppliers and managed service providers hold in your environment: they are the dependencies most likely to turn a supplier incident into yours. Inventory them with owners and rotation dates alongside the asset list. See the Non-Human Identity (NHI) Guide.

Implementation sequence

1. Confirm status: check that the entity has self-identified on MyCiber, and that the legal representative's access is held and delegated under control.
2. Challenge the draft: use the 10 working days to correct sector, service and size data; a wrong level costs 24 months of misdirected work.
3. Appoint and register: officer and permanent contact point, with deputies and an out-of-hours test.
4. Gap assess: map current controls to the QNRCS and the Annex III or IV list for the assigned level; record residual risk.
5. Rehearse reporting: run a tabletop that produces a 24-hour notification, an end-of-impact notice and a 30-working-day report, including the offline fallback.
6. Fix suppliers: add RJC security clauses to critical supplier and managed service contracts and list external dependencies.
7. Brief the board: record the training and approval of measures; review progress each quarter until the 24-month point.

Measurement and framework mapping

• Coverage: percentage of applicable Annex III or IV measures implemented, tracked monthly toward the 24-month date.
• Reporting speed: median time from detection to initial notification in exercises and real incidents, against 24 hours.
• Contact readiness: pass rate of out-of-hours tests of the permanent contact point.
• Supplier coverage: share of critical suppliers with RJC security clauses in signed contracts.
• Asset currency: days since the asset list was last updated on MyCiber.

The ISO 27001 to NIS2 and DORA Mapping Guide extends this mapping at Directive level.

Common failure patterns

• Waiting for technical instructions: Article 35(3) requires information that can already be determined to be sent now.
• Accepting the draft qualification unread: the 10 working day comment window is the only cheap moment to fix the level.
• One person holds MyCiber: access tied to a single legal representative's citizen credentials stalls reporting when that person is away.
• Relying on platform alerts: Article 22(4) makes clear that missed alerts are no excuse.
• Treating public bodies as private: Group A and B entities have their own Annex IV measures.
• Forgetting the CNPD: an RJC notification does not discharge the GDPR duty.

Practitioner checklist

• Self-identification on MyCiber confirmed, with evidence of the submission date.
• Draft qualification reviewed and comments filed within 10 working days.
• Cybersecurity officer and permanent contact point registered, with deputies.
• MyCiber access delegated to at least two people and reviewed quarterly.
• Gap assessment against the QNRCS and the assigned Annex III or IV level.
• 24-hour, end-of-impact and 30-working-day reporting templates tested, with offline fallback.
• Asset list in place and a January update scheduled.
• Supplier contracts updated and external dependencies listed, including supplier-held credentials.
• Board training and approval of measures recorded.

Standards and references

• Diário da República: Decreto-Lei n.º 125/2025, Regime Jurídico da Cibersegurança
• Diário da República: Regulamento n.º 756/2026, execution of the Regime Jurídico da Cibersegurança
• VdA: NIS 2 Directive transposed in Portugal, Decree-Law No. 125/2025
• Cuatrecasas: New Legal Regime on Cybersecurity
• Morais Leitão: New legal framework for cybersecurity
• PwC Portugal: Transposição da Diretiva NIS2
• Garrigues: Novo regulamento de cibersegurança e plataforma MyCiber
• ECO: Entidades têm 60 dias úteis para se registarem na plataforma MyCiber

Related NHI Mgmt Group resources: NIS2 Directive Guide · NIS2 Transposition Tracker · NIS2 Readiness Checklist · Cyber Incident Reporting Requirements Map · Non-Human Identity (NHI) Guide. This guide summarises Portugal's Regime Jurídico da Cibersegurança as it stood on 14 November 2026 and is not legal advice.