🇵🇹Portugal

Overview

Portugal has adopted a forward-thinking and comprehensive approach to Artificial Intelligence (AI) regulation, characterized by a blend of strategic policy instruments, legislative acts, and practical guidelines. The nation's overarching philosophy centers on fostering an ethical, scientifically rigorous, and economically competitive national AI ecosystem, while simultaneously safeguarding fundamental rights and promoting public trust. This multi-faceted strategy is deeply embedded within broader national digital transformation initiatives, reflecting a commitment to leveraging AI for societal benefit and economic growth. The regulatory maturity level is evolving, with foundational strategies already in place and more prescriptive measures, particularly for public sector AI, under active development or recently enacted. This proactive stance positions Portugal as a key player in shaping European AI governance, ensuring national policies are harmonized with the European Union's ambitious regulatory agenda. The Portuguese government's commitment to AI is evident through significant investments in research, talent development, and digital infrastructure, as articulated in documents like the Estratégia Digital Nacional and the Agenda Nacional de Inteligência Artificial. These strategic instruments provide a roadmap to 2030, outlining key pillars such as talent, innovation, and infrastructure, and identifying flagship operational measures. A strong emphasis is placed on ethical considerations, transparency, accountability, and the responsible deployment of AI systems, particularly within public administration. This commitment extends to ensuring that AI development and adoption contribute to digital sovereignty, the preservation of the Portuguese language, and the enhancement of public services, all while adhering to principles of inclusion, equality, and environmental sustainability.

Regulatory approach

Portugal's regulatory approach to AI is best described as a hybrid model, combining horizontal principles-based legislation with specific policy guidelines and decrees, underpinned by a strong commitment to EU alignment. The Carta Portuguesa de Direitos Humanos na Era Digital (Charter of Human Rights in the Digital Era) serves as a foundational horizontal instrument, affirming that constitutional rights fully apply in the digital sphere and establishing specific rights related to AI, such as explainability, auditability, and the availability of remedies. This act sets a broad ethical and rights-based framework that influences all subsequent AI-related policies and regulations. Complementing this, strategic documents like the AI Portugal 2030 and the draft Agenda Nacional de Inteligência Artificial provide a strategic, non-binding roadmap, outlining national priorities, recommended actions, and institutional responsibilities for fostering AI development and adoption across various sectors. The regulatory framework also incorporates soft law instruments, such as the Guia para uma Inteligência Artificial ética, transparente e responsável na Administração Pública (AMA GuIA), which offers practical, non-binding recommendations for public administration bodies. This guide promotes good practices, risk mitigation, and the integration of ethical considerations throughout the AI lifecycle, emphasizing accountability, transparency, explainability, fairness, and ethics. While not creating statutory sanctions, it prepares public entities for compliance with upcoming EU and national initiatives. More prescriptive, binding regulations exist for specific domains, such as the Decreto-Lei n.º 49/2024, which mandates rules for digital services by public administration, indirectly impacting AI systems used in these services by requiring interoperability, user-centric design, and adherence to common reference models. This layered approach allows for flexibility in fostering innovation while gradually introducing more concrete governance mechanisms, often with a risk-based perspective that prioritizes scrutiny for high-impact AI applications. Portugal's AI governance framework is distributed across several key public entities, reflecting a multi-stakeholder and coordinated approach. The Agência para a Modernização Administrativa (AMA) plays a central role in coordinating the National AI Agenda and overseeing public digital services, including the development and dissemination of guidelines like the AMA GuIA for ethical AI in public administration. AMA is instrumental in managing projects related to digital transformation and ensuring the operationalization of national digital strategies. The Fundação para a Ciência e a Tecnologia (FCT) is critical for driving AI research and innovation, coordinating technical aspects of projects like the AMÁLIA Large Language Model, and managing national scientific computing resources. FCT also plays a significant role in funding research projects and fostering collaboration between academia and industry, aligning with the objectives of AI Portugal 2030. The Agência para a Reforma Tecnológica do Estado (ARTE), created in 2025 as part of AMA's restructuring, is responsible for the direction, coordination, and execution of technological transformation and digitalization within the Public Administration. ARTE oversees compliance with decrees such as Decreto-Lei n.º 49/2024, ensuring the implementation of omnichannel public services and interoperability standards. High-level political oversight for the Estratégia Digital Nacional is provided by the Conselho de Ministros para a Transição para o Digital e Modernização (CM-TDM), which approves strategic frameworks and monitors progress. For data protection, the Comissão Nacional de Proteção de Dados (CNPD) acts as the national supervisory authority, enforcing GDPR and national data protection laws, which are crucial for AI systems processing personal data. The Entidade Reguladora para a Comunicação Social (ERC) is responsible for handling complaints related to disinformation, as outlined in the Charter of Human Rights in the Digital Era, demonstrating a distributed enforcement model that leverages existing sectoral regulatory bodies for AI-related issues.

Enforcement & penalties

Portugal's current AI regulatory landscape, particularly concerning strategic policies and guidelines, does not typically establish direct AI-specific criminal penalties or fine ranges in the manner of a prescriptive statute. Instead, enforcement mechanisms for AI-related non-compliance largely rely on existing sectoral laws and administrative oversight frameworks. For instance, violations concerning data protection in AI systems fall under the purview of the General Data Protection Regulation (GDPR) and national implementing laws, enforced by the Comissão Nacional de Proteção de Dados (CNPD), which can impose significant administrative fines. Similarly, non-compliance with rules for digital public services, as outlined in Decreto-Lei n.º 49/2024, can trigger administrative follow-up, technical remediation requests, and potentially prevent new digital investments until conformity is achieved, with oversight from the Agência para a Reforma Tecnológica do Estado (ARTE). The Charter of Human Rights in the Digital Era, while affirming rights related to AI, primarily sets state obligations and relies on existing sectoral supervisory and sanctioning frameworks for enforcement. For example, complaints regarding disinformation may be directed to the Entidade Reguladora para a Comunicação Social (ERC) under applicable media law procedures. The non-binding nature of strategic documents like the National AI Agenda and the AMA GuIA means they do not create direct sanctions but rather signal future regulatory and funding measures, instructing public administrations to prepare for compliance with upcoming EU and national initiatives. Therefore, penalties and enforcement in Portugal's AI context are characterized by a reliance on established legal and administrative mechanisms, with a strong emphasis on corrective actions, compliance verification, and alignment with broader legal obligations rather than a standalone AI-specific punitive regime.

Data protection

Portugal's data protection framework is robust and deeply rooted in European Union law, with the General Data Protection Regulation (GDPR) forming the cornerstone of its privacy regime. The Comissão Nacional de Proteção de Dados (CNPD) serves as the independent national supervisory authority responsible for overseeing and enforcing the GDPR and national data protection legislation. This means that any AI system developed or deployed in Portugal that processes personal data must adhere strictly to GDPR principles, including data minimization, purpose limitation, accuracy, storage limitation, integrity and confidentiality, and accountability. The CNPD has powers to conduct investigations, impose corrective measures, and levy substantial administrative fines for non-compliance, ensuring a high standard of data protection for individuals. Further reinforcing data protection in the digital era is the Carta Portuguesa de Direitos Humanos na Era Digital (Charter of Human Rights in the Digital Era). This foundational act explicitly recognizes and protects digital privacy, including the right to use encryption and other identity-protecting tools, and places limits on the processing of special categories of data in certain communication formats. Crucially, for AI systems, the Charter also mandates rights related to algorithmic decision-making, such as explainability, auditability, and the availability of remedies, which inherently link back to data protection principles by requiring transparency and accountability in how personal data influences automated decisions. While Portugal does not impose strict data localization requirements beyond what may be implied by GDPR's international data transfer rules, the emphasis is on ensuring secure and compliant processing, especially for public sector datasets used in AI development, as highlighted in the National AI Agenda's commitment to stronger data governance.

Sector-specific rules

While Portugal is developing an overarching AI strategy, specific sector-focused AI regulations are primarily integrated into broader digital transformation initiatives and existing sectoral frameworks, rather than standalone AI laws for each sector. A significant focus is on public administration, where the AMA GuIA provides non-binding but influential guidance for designing, procuring, and operating AI systems ethically, transparently, and responsibly. This guide highlights high-impact use-cases in the public sector, such as biometric identification, automated social benefits decisions, predictive policing, immigration-case prioritization, and employment screening, recommending proportional mitigation measures like human-in-the-loop controls, impact assessments, and privacy-by-design. The Decreto-Lei n.º 49/2024, governing digital public services, also indirectly impacts AI by mandating interoperability and user-centric design for all public-facing digital platforms, including those potentially incorporating AI. Strategic documents like the Agenda Nacional de Inteligência Artificial and AI Portugal 2030 explicitly envisage targeted funding and coordination with existing programs to support the development and adoption of sector-specific AI solutions. These strategies mention areas such as healthcare, justice, and public administration as priority sectors for AI pilots and innovation. The emphasis is on fostering AI solutions that enhance public services, improve efficiency, and support evidence-based governance, all while embedding ethical and fundamental rights safeguards. Although dedicated AI regulations for sectors like financial services or autonomous vehicles are not yet distinct from general EU or national frameworks, the ongoing alignment with the EU AI Act is expected to introduce more specific, risk-based obligations that will naturally apply to AI systems within these critical sectors, ensuring a harmonized approach across the European economic area.

International alignment

Portugal demonstrates a strong and explicit commitment to international alignment in its AI regulatory and strategic development, particularly with the European Union's framework. The Estratégia Digital Nacional and the Agenda Nacional de Inteligência Artificial both explicitly commit to aligning national policy with EU regulatory frameworks, most notably the forthcoming EU AI Act and the General Data Protection Regulation (GDPR). This alignment ensures that Portugal's efforts to foster an AI ecosystem are consistent with broader European objectives for trustworthy, human-centric AI. The nation actively participates in EU programs like EuroHPC and Horizon Europe, and its strategic documents reference the EU's 'Digital Decade 2030' targets, aiming to coordinate national investments with EU funding instruments such as the Recovery and Resilience Plan (PRR) and the Connecting Europe Facility. Beyond the EU, Portugal's approach to AI governance is also influenced by broader international principles, such as those promoted by the OECD. The emphasis on ethical AI, transparency, accountability, and fundamental rights protection, as seen in the Charter of Human Rights in the Digital Era and the AMA GuIA, reflects a convergence with globally recognized best practices for responsible AI development. The country's commitment to combating disinformation, for instance, explicitly aligns with the European Action Plan against Disinformation. This consistent international alignment not only facilitates cross-border interoperability and cooperation in AI research and deployment but also ensures that Portugal's regulatory environment remains competitive and attractive for international investment and talent, while upholding high standards of ethical and legal compliance.

What's next

Portugal's AI regulatory landscape is poised for significant future developments, driven primarily by the operationalization of existing strategic documents and the ongoing alignment with European Union initiatives. A key upcoming development is the formal presentation and operationalization of the Agenda Nacional de Inteligência Artificial (ANI). Currently in a draft and public consultation phase, the ANI is expected to define concrete actions and funding measures for 2025–2026, including the development and launch of a Portuguese large language model (LLM) named “Amália,” participation in a European AI Factory, and acquisition of dedicated computing capacity for AI development. The completion of this strategic instrument will provide a more detailed implementation framework for Portugal's AI ambitions, translating principles into actionable programs and investments, with a focus on ethical and rights-respecting safeguards. Further future developments include the potential creation of a dedicated Agência Nacional para o Digital, as foreseen in the Estratégia Digital Nacional, which aims to consolidate operational capabilities and centralize the coordination of public sector digital policy. This agency could significantly streamline the execution of AI-related initiatives and strengthen governance. The ongoing development of the AMÁLIA LLM, with planned beta, base, and multimodal releases over an 18-month timetable, represents a tangible future output of Portugal's AI strategy, emphasizing digital sovereignty and linguistic preservation. Additionally, Portugal's strong alignment with the EU means that the finalization and implementation of the EU AI Act will directly shape national legislation, likely introducing new binding requirements for AI systems across various sectors and necessitating further adaptation of national laws and guidelines to ensure full compliance with the European regulatory framework.