Risk management measures
Policies, incident handling, business continuity, supply chain security, access control and cryptography: the measures in Article 21.
Portugal DL 125/2025 · In force since 3 April 2026
Is your companyNIS2 compliant?
Find out in 8 minutes. Answer 29 questions across 6 security domains and receive a personalised AI-generated compliance report.
€10MMaximum fine
~8 minAssessment time
29Questions
6Security domains
What the law says
NIS2 is already lawin Portugal.
Decreto-Lei 125/2025 of 4 December 2025 approved Portugal’s Regime Jurídico da Cibersegurança, transposing Directive (EU) 2022/2555 (NIS2). It has been in force since 3 April 2026 and applies to essential and important entities across 18 sectors.
Incident reporting deadlines
An early warning within 24 hours and a full notification within 72 hours of a significant incident, to the national CSIRT.
Management accountability
Management bodies must approve the risk measures and receive cybersecurity training. This duty cannot be delegated outside management.
Registration and supervision
Entities in scope are registered and supervised, with essential and important entities subject to different levels of oversight.
The cost of non-compliance
The fines are high.The liability is personal.
Maximum fine for essential entities. Whichever amount is higher applies.
Even outside the stricter regime, the financial exposure is material.
Liability can fall on individual managers, by act or omission, and cannot be delegated outside management.
There is an adaptation period: fines are expected to apply fully from April 2027, with complete implementation of technical and organisational measures due by April 2028. That is enough time to close gaps, if you know what they are.
What you get
Know where you stand,in 8 minutes.
Twenty-nine concrete questions about what you already do, not what you should be doing. At the end you get a score for each of the six Article 21 domains, the gaps we found with the legal reference behind each one, and what to do next.
This assessment is informational and does not constitute legal advice. Always confirm applicable requirements against the official text of Decreto-Lei 125/2025 and CNCS guidance.