Portugal's Ban on High-Risk 5G Suppliers Such as Huawei Could Lapse on Wednesday, With No Sign of the Review the Law Demands

The decision that keeps "high-risk" suppliers such as Huawei out of Portugal's 5G networks could lose its legal footing on Wednesday, 30 September, and there is no public sign that the new security assessment the law requires has been finished, or even started. ECO set out the timetable on Monday after trying for a month to get an answer from the authorities.

A ban with an expiry date

In May 2023 the Security Assessment Commission (Comissão de Avaliação de Segurança), a body that brings together several public entities with security responsibilities, ruled that Portuguese operators could not use certain technology suppliers, in particular those not headquartered in a country of the European Union, the OECD or NATO. Part of the decision is classified. Huawei challenged it in court, and that case has had no public developments since.

In December 2025 the government created a new legal regime for cybersecurity, Decree-Law n.º 125/2025, of 4 December, transposing a European directive. It gave the commission a new legal basis and a new name, the Cyberspace Security Assessment Commission. It also added a transitional rule: decisions taken under the old regime "continue to produce effects for a period of 180 days" after the decree came into force, and during that period "a new security assessment must be carried out".

The decree came into force 120 days after publication, on 3 April 2026, as the National Cybersecurity Centre (CNCS) confirms on its website. Add 180 days and the transitional period ends on 30 September.

What happens next

Article 8 of the decree does not say directly what happens if the deadline passes without a new assessment. It does say that, on the basis of that assessment, the member of government responsible for cybersecurity may renew, modify or replace the old decisions. The same article keeps in force, until replaced or revoked, the regulations and acts adopted by the communications regulator ANACOM on the security and integrity of networks, as long as they are compatible with the new regime. Under the old Electronic Communications Law, it was ANACOM that had to enforce the commission's decisions.

ECO asked the National Security Office (Gabinete Nacional de Segurança), whose director-general, Manuel da Costa Honorato, chairs the commission, at the end of August whether the new assessment was under way and would be ready by 30 September. It received no reply. It also contacted the Ministry of the Presidency on Friday and was still waiting. Because the commission's work is covered by secrecy, developments behind the scenes cannot be ruled out, but a sector source told ECO on Friday that there was no news.

The operators' bill

Few in the industry expect Huawei to get back into Portuguese 5G. MEO, the operator hit hardest by the 2023 decision, said this summer through its chief executive, Ana Figueiredo, that it did not expect "radical changes" in the State's position on high-risk suppliers. She argued for a longer deadline so that existing equipment could be used until the end of its working life. In April MEO sued the Portuguese State, asking for 81.7 million euros to cover the cost of replacing the equipment.

For mobile customers nothing changes on Wednesday. What is at stake is whether the rule behind one of the country's most sensitive telecoms decisions is renewed on time, or left in legal limbo.