NIS 2 — Portugal
NIS 2 IN PORTUGAL
Anteprojeto de Lei de Transposição da Diretiva NIS 2 — the national act transposing Directive (EU) 2022/2555 in Portugal. Supervised by Centro Nacional de Cibersegurança (CNCS).
DRAFT PUBLISHED
Key facts
In force
Not yet in force
Primary supervisor
Max fine — essential entities
Up to EUR 10 million or 2% of global annual turnover, whichever is higher
Max fine — important entities
Up to EUR 7 million or 1.4% of global annual turnover, whichever is higher
Registration deadline
Covered entities will register with the CNCS through its NIS 2 portal — see CNCS for current figures and the final commencement schedule.
Scope and national nuance
Portugal's CNCS is the national supervisor and CSIRT, transposing NIS 2 through a draft law that updates the existing Cybersecurity Legal Regime (Lei 46/2018). Sector regulators ANACOM and Banco de Portugal retain sector enforcement.
Sector supervisors
| Sector | Authority | Acronym |
|---|---|---|
| Electronic communications | Autoridade Nacional de Comunicações | ANACOM |
| Financial services | Banco de Portugal | BdP |
What is specific to Portugal
- Portugal's existing Cybersecurity Legal Regime (Lei 46/2018) already established the CNCS and a baseline obligation set — the NIS 2 transposition expands rather than restarts this framework.
- CNCS combines policy supervision and CSIRT functions in one body, similar to Belgium and Czechia — covered entities have a single national interface.
- Portugal's national cybersecurity strategy explicitly emphasises capacity building for SMEs; CNCS publishes sector-specific guidance and self-assessment tools alongside the formal supervisory framework.
- As of mid-2026 the draft law is still progressing; covered entities should treat CNCS guidance as the operational baseline and monitor Diário da República for the final text.
DSI Advisory — NIS 2 Programme
Move from reading the law to evidencing compliance
Start with the free NIS 2 Scorecard to score your organisation across the twelve Article 21 security domains and receive a paragraph-cited PDF report. Then book a structured NIS 2 scope and gap assessment tailored to CNCS’s supervisory expectations.