Catarina Mascarenhas and José Maria Alves Pereira Analyse Decree-Law on Critical Entities

The new Decree-Law No. 22/2025, which establishes the resilience framework for critical entities in Portugal, goes beyond cybersecurity and imposes comprehensive, integrated risk management obligations. In an article published by IT Security, Catarina Mascarenhas, of counsel at Abreu Advogados, and José Maria Alves Pereira, associated partner, explain how these new requirements will affect organisations.

The main practical innovation of this Decree-Law lies in its scope. Companies will face “a set of obligations imposed on the critical entity as a whole — as an organisation, in terms of human resources and mode of operation — based on a risk management approach,” explains Catarina Mascarenhas.

The Abreu Advogados consultant also highlights that critical entities will need to adopt integrated and cross-cutting risk management, with resilience plans that address both physical and digital threats, comply with stringent obligations, and are subject to audits and notifications within tight deadlines.

José Maria Alves Pereira clarifies that companies will only know whether they are classified as critical entities after a formal identification process, to be completed by 17 July 2026. This classification will be based on cumulative criteria such as the provision of essential services, national operation, and the potential for significant impact from an incident. He adds that non-compliance is not an option: “critical entities may be subject to warnings,” outlining the breached provisions and the corrective measures to be implemented, the lawyer explains.

The article concludes that, despite the regulatory challenge, compliance with this legislation may represent a competitive advantage and a mark of reliability in the eyes of clients, partners, and regulators.

Read the full article here (available only in Portuguese).