TBNPortugal
NIS2 and the risk of cybersecurity in the purchase and sale of companies
Publication: ECO
Author: Ramiro Matos
Source published: 09/11/2026, 09:30:26 UTC
Briefing created: 09/11/2026, 09:52:28 UTC
Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 09/11/2026, 09:41:24 UTC.
Briefings
A NIS2 regulation significantly increases cybersecurity risks in corporate acquisitions by imposing personal liability for breaches and imposing substantial fines up to 10 million euros or 2% of annual business volume. The evidence highlights that financial stability does not guarantee security, citing the 2022 Vodafone attack which affected four million customers despite no initial data compromise. Due diligence must verify regulatory compliance, identify critical dependencies, and separate operational failures from legal obligations. Key dates include the December 2025 decree and June 2026 regulation, with effects potentially extending up to 24 months post-regulation.
Key points
- The NIS2 regime imposes personal liability for cybersecurity breaches, allowing administrative and judicial authorities to hold management and directors personally responsible for actions or omissions causing grave fault.
- Due diligence in M&A must verify regulatory compliance and identify critical dependencies, as financial stability does not guarantee security and incidents can expose critical business dependencies.
Context
The regulation strengthens cybersecurity obligations for entities, with fines potentially reaching 10 million euros or 2% of annual business volume. The evidence indicates that NIS2 applies to essential entities and requires specific due diligence before M&A commitments, distinguishing between operational failures and legal obligations.
Limitations
Evidence covers specific regulatory requirements and consequences but lacks data on implementation timelines, specific case studies beyond Vodafone, or quantitative impact on acquisition costs beyond fines.
Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 09/11/2026, 09:52:28 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.
View archived briefing on IPFS
bafybeid6qeixpbgiu226l3bm6y35v3wo7nosub4vgxahvx44ynfyu4mvpi