The quiet part of the regime
The registration deadline under Decreto-Lei n.º 125/2025 has dominated conversation in Portuguese security teams for three months, which is understandable - deadlines concentrate attention. It is also slightly unfortunate, because registration is the least demanding thing the regime asks for.
What begins now is a continuous obligation with three components that behave very differently from a filing: an incident reporting cadence measured in hours, a management accountability provision that attaches personally, and a supervisory relationship that can be exercised proactively for essential entities rather than only after something goes wrong.
If you registered in the last two weeks, this is the post to hand to whoever now owns the obligation.
The reporting clock
NIS2 replaced the vague incident notification obligations of its predecessor with a specific, staged cadence. In outline: an early warning within 24 hours of becoming aware of a significant incident, a fuller notification within 72 hours including an initial assessment of severity and impact, and a final report within one month.
Three operational details determine whether an organisation can actually meet this.
First, the clock starts at awareness, not at containment. Teams that instinctively want to understand an incident before reporting it will miss the 24-hour window on incidents that take longer than a day to characterise, which is most of the serious ones.
Second, 'significant' is a judgement, and judgements need to be recorded. The decision that an incident was not significant is a decision a supervisor may later examine, and an organisation that cannot show when it made that call and on what basis is in a weaker position than one whose threshold decision is documented in real time.
Third, the three reports have to be consistent with each other. A 72-hour notification that contradicts the 24-hour early warning invites questions about which one was accurate, and a final report that quietly drops an earlier claim invites more.
