Comparison of the transposition of NIS II by Portugal with that planned in Spain
In July 2025, the Portuguese government resumed the process of transposing Directive (EU) 2022/2555 (NIS2) by presenting Bill no 7/XVII/1 Below we compare this transposition with the Spanish bill, examining the areas of application that are subject and exempt in each case, as well as the planned penalty system.
Portugal's previous bill (Bill no 50/XVI/1) expired with the dissolution of the Assembly of the Republic on March 11. Portugal currently remains in breach of the October 2024 transposition deadline, which led to the European Commission opening infringement proceedings in November that year.
Compared with the Spanish bill (Preliminary Bill for the Law on Coordination and Governance of Cybersecurity ), one of the main differences relates to the scope of application:
Both proposals adopt the same methodology and criteria for classifying entities covered as essential entities. The classification of entities as important entities also adopts the same classification criteria, and Spain also includes municipalities with more than 20,000 inhabitants and entities in its institutional public sector. Portugal has chosen to include an article dedicated exclusively to public entities that are not classified as essential or important entities, and classifies them as relevant public entities along with dividing them into two groups for the purposes of applying specific regimes as determined in the proposal and other regulations issued by the National Cybersecurity Center.
Some differences in the penalty regime may also be expected:
Broadly speaking, the proposals are quite similar in terms of the obligations envisaged for entities falling within their scope, and both proposals reflect a clear commitment to improving cyber resilience, with featured elements and nuances that underscore the priorities and institutional models of each member state.
Contacts
