Portugal's 5G Security Review Was Finished on Time, the Government Insists, but Its Verdict on Suppliers Such as Huawei Is Classified

The government says the new security assessment of Portugal's 5G networks, which the law required by 30 September, was carried out on time. It will not say what the assessment concluded, or when its outcome will be known, because the work is classified.

"Yes, the assessment was carried out within the legal deadline," an official source in the office of the Minister of the Presidency, António Leitão Amaro, told Lusa on Thursday. Asked when the resulting decision would be made public, the same source said it "is classified in nature", citing article 18, paragraph 10 of the Regime Jurídico da Cibersegurança (the Cybersecurity Legal Regime).

The answer settles one question we raised on 28 September, when there was no public sign that the review had started, but leaves the main one open: whether the restrictions on "high-risk" suppliers such as Huawei have been renewed, changed or replaced.

Why there was a deadline

In May 2023 the Comissão de Avaliação de Segurança (Security Assessment Commission) found that equipment from certain suppliers posed a "high risk" to 5G networks and services. Its criteria included suppliers based outside the European Union, NATO or the OECD, in countries whose law lets the government control, interfere with or pressure their operations abroad. The decision named no company or country, but the supplier concerned was Huawei, which challenged it in the administrative courts.

Decreto-Lei n.º 125/2025 (Decree-Law 125/2025), of 4 December, which created the new cybersecurity regime, came into force 120 days after publication, on 3 April 2026. Its transitional rule, article 8, says decisions taken by the commission under the old regime "continue to produce effects for a period of 180 days" after that date, "during which a new security assessment must be carried out". On the basis of that assessment, the government member responsible for cybersecurity "may decide on the renewal, modification or replacement" of the old decisions.

Why it is secret

The renamed Comissão de Avaliação de Segurança do Ciberespaço (Cyberspace Security Assessment Commission) is chaired by the director-general of the Gabinete Nacional de Segurança (National Security Office) and includes the national cybersecurity centre, the regulator ANACOM, the intelligence services, the Polícia Judiciária and the competition authority, among others. Article 18 of the regime says documents and information produced in its work are classified at the "reserved" level at least, and may be classified higher or made a state secret.

The same article sets out what the minister can do on the commission's proposal: impose provisional restrictions, order equipment to stop being used, or exclude it. Any such decision must set reasonable deadlines for operators to comply, and the commission's proposal must weigh the risk against the losses to the supplier and the wider economic and social costs. The national cybersecurity centre, or the relevant sector authority, enforces compliance.

The cost to operators

The 2023 decision is still in court on two fronts. Huawei's challenge is pending, and in April MEO sued the State for 81.7 million euros, its estimate of the cost of replacing equipment, according to Lusa. MEO is not asking for the ban to be annulled, only for compensation.

The bill is large across Europe too. A GSMA Intelligence report published this summer put the direct cost of fully replacing high-risk vendors' equipment in EU mobile, fixed and transport networks at 30 to 40 billion euros. A 2024 study by EY, commissioned by Huawei, estimated that excluding the company from 5G in Portugal could cost the Portuguese economy more than 1 billion euros.

For mobile customers nothing changes for now. What remains unknown is whether the rules on who may supply Portugal's networks have been kept as they were, and that is not due to be made public.