Cybersecurity Law, Sector-Specific Security Requirements for Critical Infrastructure, Essential Services and Digital Providers

Lei n.º 13/2026, arts. 51 a 56

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

In force in 11 days, effective 29 September 2026.

A sector security regimes rule binding public and private bodies.

As of 18 September 2026.

What it requires

This duty does not yet bind: Mozambique's Cybersecurity Law (Lei n.º 13/2026) enters into force on 29 September 2026, ninety days after its 1 July 2026 publication.
It reaches you once it binds if you operate as a critical-infrastructure network operator, an essential-service network operator, a digital-service provider, a digital-intermediary-service provider, a data-centre operator, or a cloud-computing-platform operator under Articles 51 through 56.
Take technical and organisational measures proportionate to the risk your networks and information systems face, covering the security of your systems, infrastructure, and premises, incident handling, business-continuity management, ongoing monitoring, auditing, and testing, and conformity with applicable international standards.
If you are a private critical-infrastructure operator, additionally establish an institutional CSIRT.
If you operate a data centre or a cloud-computing platform, additionally give your subscribers a summary of your business-continuity, disaster-recovery, and risk-management rules and policies.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Criminal exposure note

Article 76's own sanctions for this Law's contraventions are administrative fines rather than a criminal penalty, though its introductory clause leaves room for a more serious penalty under separate criminal legislation for the same conduct.

Who enforces it

Enforcement body

Autoridade Nacional de Segurança Cibernética (National Cybersecurity Authority), empowered by Article 11(b) to regulate, supervise, oversee, and impose sanctions in the field of cybersecurity.

Settledness

No court decision or regulator guidance construing these articles has been published yet; the Law's own implementing regulation is still pending.

As of: 18 September 2026
Open questions: Which specific operators will the Government designate as Critical Infrastructure or Essential Service providers under Articles 51 and 52, given that the Law defines the categories but leaves their membership to further Government action?

What it reaches

Obligation class

Security, Governance

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Articles 51 through 56 of Mozambique's Cybersecurity Law layer sector-specific security-measure duties onto six categories the Law defines: critical-infrastructure operators, essential-service operators, digital-service providers, digital-intermediary-service providers, data-centre operators, and cloud-computing-platform operators, each required to take technical and organisational measures proportionate to the risk their networks and information systems face.

A private critical-infrastructure operator must additionally establish an institutional CSIRT, and a data-centre or cloud-computing-platform operator must safeguard the integrity, confidentiality, and availability of the data it stores. Breach of these requirements shares the same fine as Articles 47 through 50: 90 to 160 times the minimum public-service wage.

When LexLint raises it

operates_social_platform
distributes_software_product

Read the law

Official gazette text, Boletím da República I Série No. 123 (1 July 2026), hosted by INTIC

Back to the example · Lint your app