Summary

  • ANACOM is preparing a cybersecurity regulation for electronic communications, while Portugal’s CNCS already operates the national baseline.
  • The law lets sector authorities add standards in coordination with the CNCS; comments on ANACOM’s procedure run until 12 November.

Portugal’s cybersecurity rulebook has two pens. The Centro Nacional de Cibersegurança (CNCS) writes the national baseline; ANACOM has a sectoral pen for electronic communications and postal services. It is now using that authority to prepare a rule for electronic communications. A single law, two regulatory desks, and plenty of room for the margins to matter.

The legal division is explicit. Decree-Law 125/2025 names the CNCS as national cybersecurity authority and ANACOM as the sectoral authority for communications and postal services. Article 14 lets sector authorities add standards to the National Cybersecurity Reference Framework, in coordination with the CNCS. The division gives the centre a common floor and the sector regulator a way to write for the equipment, networks and service obligations it actually supervises. The decree-law

The floor already exists. CNCS Regulation 756/2026, published in June, bundles rules for entity registration, incident reporting, the national reference framework, a risk matrix and minimum measures. Its own text says sector authorities may add complementary standards in coordination with the CNCS. ANACOM is not starting a second national system from scratch; it is filling in the communications chapter of one that is already running. The CNCS regulation

ANACOM approved the start of its sectoral procedure on 8 September. The consultation initially pointed to 22 October; the regulator later extended contributions to 12 November. The public record establishes the procedure and the new deadline. The final requirements remain to be written. ANACOM’s procedure · Extension notice · ANACOM announcement

There is a clock in the parent law, but it is easy to pin it to the wrong door. Article 10 gives certain listed duties effect 24 months after publication of regulations under specified articles. The CNCS’s June regulation supplies those national implementation rules. That statutory clock is tied to the named national regulations; ANACOM’s separate sector procedure is not automatically its starting gun.