You Registered. Now What? Portugal's NIS2 Obligations After the Deadline

The registration deadline under Decreto-Lei n.º 125/2025 has dominated conversation in Portuguese security teams for three months, which is understandable - deadlines concentrate attention. It is also slightly unfortunate, because registration is the least demanding thing the regime asks for.

What begins now is a continuous obligation with three components that behave very differently from a filing: an incident reporting cadence measured in hours, a management accountability provision that attaches personally, and a supervisory relationship that can be exercised proactively for essential entities rather than only after something goes wrong.

If you registered in the last two weeks, this is the post to hand to whoever now owns the obligation.

NIS2 replaced the vague incident notification obligations of its predecessor with a specific, staged cadence. In outline: an early warning within 24 hours of becoming aware of a significant incident, a fuller notification within 72 hours including an initial assessment of severity and impact, and a final report within one month.

Three operational details determine whether an organisation can actually meet this.

First, the clock starts at awareness, not at containment. Teams that instinctively want to understand an incident before reporting it will miss the 24-hour window on incidents that take longer than a day to characterise, which is most of the serious ones.

Second, 'significant' is a judgement, and judgements need to be recorded. The decision that an incident was not significant is a decision a supervisor may later examine, and an organisation that cannot show when it made that call and on what basis is in a weaker position than one whose threshold decision is documented in real time.

Third, the three reports have to be consistent with each other. A 72-hour notification that contradicts the 24-hour early warning invites questions about which one was accurate, and a final report that quietly drops an earlier claim invites more.

NIS2's management body provisions are the part that changes behaviour in boardrooms once someone reads them properly. Management bodies must approve cybersecurity risk management measures, oversee their implementation, and can be held personally liable for failures. They are also required to undergo training.

The practical consequence is that board approval of security measures becomes an evidenced act rather than a minute-book formality. If a supervisor asks when the management body approved the current risk management measures, what it was shown, and what it decided, the answer needs to be more specific than a line in the minutes.

This is a reasonable thing to ask for and an awkward one to produce retrospectively. Organisations that get ahead of it record board security decisions the same way they record any other regulated decision: with the material that was presented, the date, and a record that cannot be quietly revised later.

If the harder problem is that your incident records, board approvals, and threshold decisions live in systems you would rather not hand to a supervisor unedited, that is fixable without changing how your team works. You can anchor your first set of records in a few minutes.