Why should the entity\u2019s position be assessed before registration?<\/p>\n
Portugal\u2019s Cybersecurity Legal Framework, approved by Decree-Law No. 125\/2025 of 4 December, transposed the NIS 2 Directive into Portuguese law and broadened the range of entities subject to cybersecurity obligations.<\/p>\n
The obligation to identify and register on MyCiber applies to entities falling within Article 3 of that framework, which may be classified as:<\/p>\n
Whether the framework applies should not be determined solely by reference to the entity\u2019s principal activity or economic activity code. It requires an analysis of the activities actually carried out, the size of the organisation and the general and specific criteria laid down by law.<\/p>\n
This assessment should precede registration, as the information submitted will be examined by the Portuguese National Cybersecurity Centre or, where applicable, the competent national sectoral authority, in order to determine whether the entity falls within the scope of the framework and how it should be classified.<\/p>\n
In the procedures we are currently advising on, it has been necessary to go beyond the entity\u2019s corporate purpose and economic activity code, identify the different activities carried out and, where applicable, examine the group\u2019s corporate structure in order to determine the relevant size of the entity.<\/p>\n
No. The simulator may assist with a preliminary assessment of the scope of the framework, but its result is merely indicative, depends on the information entered and is not subject to formal assessment by the Portuguese National Cybersecurity Centre.<\/p>\n
Furthermore, the simulator does not cover the criteria laid down in Article 3(2)(b), (c), (d) and (e), or Article 3(5), of Decree-Law No. 125\/2025. Nor does use of the simulator release entities falling within the scope of the framework from the registration obligation.<\/p>\n
In our work with clients, the simulator\u2019s result is used as a supporting element and assessed against the activities carried out, the size of the organisation and the legal criteria not taken into account by the tool.<\/p>\n
The simulator may therefore provide a useful starting point, but it is no substitute for a legal assessment of the entity\u2019s position.<\/p>\n
Before completing the registration, the information concerning the activities carried out, the size of the entity and the sector or sectors in which it operates should be checked for consistency.<\/p>\n
This assessment is particularly important where the entity:<\/p>\n
These are the situations most frequently encountered by the Cybersecurity Department at Belzuz Abogados, S.L.P.<\/a> <\/strong>in the legal advice it provides to clients. Depending on the circumstances, preparing the registration has required information concerning the activities carried out, the corporate structure, the number of employees and the relevant financial data to be brought together, so that the information submitted accurately reflects the organisation\u2019s circumstances.<\/p>\n It is also necessary to verify who has authority to represent the entity on MyCiber and which documents are required to evidence that authority.<\/p>\n Preparing the registration should therefore not be limited to completing the fields on the platform. The information submitted must be consistent and properly substantiated and must enable the competent authority to assess the entity\u2019s position correctly.<\/p>\n Entities that were already operating before the Cybersecurity Legal Framework entered into force must register within 60 working days of the platform being made available.<\/p>\n Entities that began operating after the framework entered into force have 30 working days in which to comply with this obligation.<\/p>\n The applicable deadline should be confirmed considering the entity\u2019s specific circumstances. The need to register within the relevant period does not remove the requirement to assess the entity\u2019s position beforehand.<\/p>\n Yes. The registration may be completed by the entity\u2019s legal representative or by an individual, whether internal or external to the organisation, who has been granted the necessary authority for that purpose.<\/p>\n A lawyer may therefore complete the MyCiber registration in the name and on behalf of the entity, provided that the lawyer has the necessary authority to represent it.<\/p>\n Belzuz Abogados, S.L.P.<\/a><\/strong> has been providing clients with comprehensive support throughout this process: we assess the entity\u2019s position, validate the required information with the client, prepare the necessary powers of representation and, where instructed to do so, complete the registration on the entity\u2019s behalf.<\/p>\n No. Registration initiates the classification procedure.<\/p>\n Based on the information submitted, the Portuguese National Cybersecurity Centre or, where applicable, the competent national sectoral authority will assess whether the entity falls within the scope of the Cybersecurity Legal Framework and which category applies.<\/p>\n The entity will be notified of a draft classification decision stating:<\/p>\n The entity may submit representations as part of the interested-party hearing procedure within 10 working days of the notification being sent. Once the procedure has been completed, a final classification decision will be issued.<\/p>\n The draft decision should be reviewed considering the factual and legal grounds on which it is based.<\/p>\n It is important to verify whether the competent authority has correctly considered:<\/p>\n If the proposed classification does not reflect the entity\u2019s circumstances, or if the information considered requires correction or clarification, the entity should consider exercising its right to be heard within the period granted.<\/p>\n In the procedures we advise on, the information supporting the registration is validated and documented from the outset, so that it can be properly substantiated during the classification procedure.<\/p>\n Legal advice does not therefore end once the registration has been submitted. It should extend to reviewing the draft decision and, where appropriate, preparing the entity\u2019s representations.<\/p>\n The entity should not wait until the procedure has been completed before beginning to prepare for the obligations that may arise from its classification.<\/p>\n Within 20 working days of notification of the final classification, the entity must communicate through MyCiber:<\/p>\n These roles should be defined before the deadline expires, with the designated individuals clearly identified and their coordination with the organisation\u2019s internal risk management and incident response procedures properly established.<\/p>\n For our clients, these decisions are prepared during the classification procedure by defining the relevant roles, the authority required and their interaction with each organisation\u2019s internal structures.<\/p>\n Essential entities, important entities and relevant public entities must submit their list of assets by 31 January 2027 or within six months of notification of the final classification, whichever deadline falls first.<\/p>\n Compliance with this obligation requires the identification of the assets relevant to the entity\u2019s networks and information systems. This work should not be postponed until the final classification is issued: it requires the prior involvement of the relevant teams and the identification and validation of the information to be reported.<\/p>\n Entities that fall within the scope of the framework and have been registered and classified must use the restricted area of MyCiber to notify incidents having a significant impact.<\/p>\n The initial notification must be submitted within 24 hours of the entity becoming aware of the incident. Any subsequent notifications and reports relating to the same incident must also be submitted through the platform.<\/p>\n Meeting this deadline requires the entity to have determined in advance:<\/p>\nWhat is the deadline for registration?<\/h2>\n
Can a lawyer complete the registration on behalf of the entity?<\/h2>\n
Does registration automatically determine the entity\u2019s classification?<\/h2>\n
\n
Why should the draft classification decision be reviewed?<\/h2>\n
\n
Which obligations should be prepared for while the classification procedure is under way?<\/h2>\n
\n
When must the list of assets be submitted?<\/h2>\n
Are the incident notification procedures ready?<\/h2>\n
\n