Portugal
Current Status: Implemented
Expected or actual implementation date or timeline
Decree-law no. 22/2025, was published in 19/03/2025 and entered into force on 24/03/2025, revoking chapters of Decree-law no. 20/2022 that revoked and substituted the former decree-law that implemented Directive 2008/114/EC.
If implemented, whether a transition period applies and, if so, its duration
The national strategy for the resilience of critical infrastructure and the national risk assessment should have been approved by 17 January 2026. Until approved, the procedures for the identification, designation, protection and enhancement of the resilience of national and European critical infrastructure established by Decree-Law No 20/2022 of 28 January remain in force, which is the current scenario.
In addition, Decree-law no. 22/2025 provided that critical entities for the sectors and subsectors set out in the annex to this decree-law, shall be designated by 17 July 2026.
Security plans drawn up by operators of critical infrastructure, approved prior to 24/03/2025, shall remain valid until the process of designating critical entities and approving the respective resilience plans has been completed.
Other important remarks/notes
Critical entities identified under Decree-law no. 22/2025 will under the scope of the local NIS2 Law, Decree-law no. 125/2025, which will enter into force on 03/04/2026, although also requiring regulation which is currently under public consultation, to collect suggestions, until 22/04/2026.
Key contact
© Eversheds Sutherland. All rights reserved. Eversheds Sutherland is a global provider of legal and other services operating through various separate and distinct legal entities. Eversheds Sutherland is the name and brand under which the members of Eversheds Sutherland Limited (Eversheds Sutherland (International) LLP and Eversheds Sutherland (US) LLP) and their respective controlled, managed and affiliated firms and the members of Eversheds Sutherland (Europe) Limited (each an "Eversheds Sutherland Entity" and together the "Eversheds Sutherland Entities") provide legal or other services to clients around the world. Eversheds Sutherland Entities are constituted and regulated in accordance with relevant local regulatory and legal requirements and operate in accordance with their locally registered names. The use of the name Eversheds Sutherland, is for description purposes only and does not imply that the Eversheds Sutherland Entities are in a partnership or are part of a global LLP. The responsibility for the provision of services to the client is defined in the terms of engagement between the instructed firm and the client.
Connect with us
