Guide ·

NIS2 and SMEs in Portugal: what changes with Decree-Law 125/2025

The European NIS2 directive is now law in Portugal. It was transposed by Decree-Law No. 125/2025 of 4 December, which created the Legal Regime for Cybersecurity and came into force on 3 April 2026. If you run an SME, it's worth understanding whether this affects you — and what to do next.

What NIS2 is, in plain terms

NIS2 is a set of European rules to raise the cybersecurity level of organisations that provide services important to society and the economy. The goal is to make systems more resilient to attacks and to require organisations to manage risk, report serious incidents, and hold decision-makers accountable.

In Portugal, the national cybersecurity authority is the CNCS — National Cybersecurity Centre, which supervises compliance with the regime. In June 2026, the CNCS published Regulation No. 756/2026, which sets out how the decree-law applies in practice, including how entities self-identify through an online form.

Is my company covered?

The regime distinguishes essential entities from important entities, depending on sector and size. It is aimed mainly at organisations in sectors such as energy, transport, health, water, digital infrastructure, public administration and various critical services — not at the majority of micro and small businesses.

But two points catch many SMEs by surprise:

  • Supply chain. Even if your company is not directly covered, if you supply an entity that is, that entity will require security guarantees from you. In practice, NIS2 flows down the chain.
  • Self-identification. Covered entities must register on the CNCS electronic platform and appoint a cybersecurity officer and a point of contact — the State does not come knocking; the duty to check lies with the organisation itself.

If you're unsure about your status, the safest move is an assessment — better to confirm than to assume it doesn't apply.

What NIS2 now requires

Broadly, covered entities must:

  • Manage risk with proportionate technical and organisational measures (access control, backups, system patching, training, etc.).
  • Report significant incidents to the authorities within tight deadlines.
  • Hold senior management accountable: NIS2 makes management bodies directly responsible for overseeing cybersecurity — it is no longer just an IT-department matter.

Practical first steps

  1. Understand your status: confirm whether you are an essential entity, an important entity, or a supplier to one.
  2. Assess your current state: what is exposed, what is outdated, where the most critical gaps are.
  3. Prioritise and fix: a simple plan, from most to least urgent.
  4. Register and document: meet registration duties and keep evidence of the decisions taken.

How Kourian helps

We start with a clear, no-alarmism assessment: what your company has exposed, what needs attention, and in what order. Then we deliver a prioritised plan and support you through it.

Want to know whether NIS2 applies to your company? Talk to us — a short, no-commitment conversation.

Note: this article is informational and does not replace legal advice. For the exact legal framing, consult Decree-Law No. 125/2025 and the CNCS.

Let's talk about your project.

An audit, an AI agent or just a question: start by telling us what you need.

Talk to us