The EU AI Act in Portugal

Per Portugal - National AI Agenda

• Agência para a Modernização Administrativa (AMA) — Central coordinator for operationalisation and public sector adoption of the Agenda; responsible for public auscultation sessions.
• Fundação para a Ciência e a Tecnologia (FCT) — Coordinate research and infrastructure projects including the national LLM and participation in AI Factory initiatives.
• Comissão Nacional de Proteção de Dados (CNPD) — National data protection authority; oversight of GDPR compliance for AI systems using personal data.
• Ministry of Youth and Modernization (Ministério da Juventude e Modernização) — Political champion and sponsor of the Agenda within Government structures.

Per Portugal - Development of AI Model (201/2024)

• Agência para a Modernização Administrativa (AMA, I.P.) — Operational project manager and dissemination lead
• Fundação para a Ciência e a Tecnologia (FCT, I.P.) — Technical coordinator, infrastructure and data curation lead
• Comissão Nacional de Proteção de Dados (CNPD) — Data protection supervisory authority (applicable to data processing for training)
• Presidency of the Council of Ministers / Government Portal — Political sponsoring authority and publication channel for the resolution

Per Portugal - Digital Services Rules (49/2024)

• Agency for the Technological Reform of the State (ARTE) — Primary oversight, prior verification of digital investments and technical conformity checks
• Ministry / Secretariat responsible for Youth and Modernisation (Juventude e Modernização) — Policy coordination and publication of sectoral portarias and implementation calendars
• Comissão Nacional de Protecção de Dados (CNPD) — Supervision of personal data protection compliance in digital services

Per Portugal - National Digital Strategy (207/2024)

• Council of Ministers for the Transition to Digital and Modernization (CM-TDM) — Political approval and high‑level oversight of the EDN and Action Plans
• Agência para a Modernização Administrativa (AMA) — Lead agency for public sector digital services, implementation partner and initiative lead for state modernization
• Fundação para a Ciência e a Tecnologia (FCT) — Responsible for research infrastructure and lead executor of AI research, compute procurement and projects (e.g., LLM project, IA factory)
• National Data Protection Commission (Comissão Nacional de Proteção de Dados - CNPD) — Data protection oversight; ensures GDPR compliance for EDN projects handling personal data

Per Portugal - Ethical AI in Public Administration

• Agência para a Modernização Administrativa (AMA) — Publisher and coordinator of the GuIA guidance; capacity-building and dissemination in public administration.
• Ministry/Secretariat pages referencing GuIA (SGEconomia / Digital Government portals) — Dissemination and cross-government coordination; reference and indexing of the GuIA on government portals.
• Portuguese Data Portal (dados.gov.pt) — Official publication and archiving of the GuIA announcement and links to full documents.

Per Portugal - Digital Human Rights (27/2021)

• Assembleia da República — Legislative authority that approved Lei n.º 27/2021 and provides consolidated texts and legislative history.
• Diário da República (DRE) — Official publisher of the law and source of the authentic text (publication and PDF).
• Entidade Reguladora para a Comunicação Social (ERC) — Regulatory body for media: accepts complaints and applies media-sector procedures and sanctions relevant to disinformation and media-law violations.
• Comissão Nacional de Proteção de Dados (CNPD) — National Data Protection Authority — enforces data protection rights and GDPR compliance in Portugal.
• Government / Secretaria de Estado / Ministries — Responsible for implementing State programmes on connectivity, digital skills and administrative implementing measures referenced in the Charter.

Per Portugal - National AI Strategy

• INCoDe.2030 — Coordinating initiative / responsible body for the strategy and working groups
• Ministry of Science, Technology and Higher Education (MCTES) — Policy sponsor and inter-ministerial coordination
• Fundação para a Ciência e a Tecnologia (FCT) — Research funding and coordination of academic R&D programs
• Agência para a Modernização Administrativa (AMA) — Support for public administration modernization and digital government pilots

Per Portugal - National AI Agenda

• The Agenda itself does not establish new administrative penalties; enforcement of obligations will rely on existing legal frameworks (e.g., GDPR, sectoral rules) and on future regulatory measures such as the EU AI Act.
• Contractual remedies and liability clauses in public procurement may trigger financial or contractual penalties for breaches.
• Non‑compliance by public bodies with data protection obligations may lead to CNPD investigations and sanctions under GDPR.
• Sectoral regulators retain powers to impose sanctions under sectoral laws where applicable (e.g., healthcare, finance).

Per Portugal - Development of AI Model (201/2024)

• No bespoke administrative penalty regime in the resolution; non‑compliance addressed through contractual remedies and administrative oversight
• Potential funding recovery or contractual sanctions under PRR and public procurement rules in case of misuse or failure to meet contractual obligations
• Sectoral sanctions and liability remain subject to applicable national law, including GDPR enforcement by CNPD and other supervisory authorities
• Public audit, accountability measures and possible reputational and institutional consequences for entities that fail to comply with reporting/transparency requirements

Per Portugal - Digital Services Rules (49/2024)

• Administrative corrective measures and mandatory remediation orders issued by oversight authorities (ARTE and sectoral ministries) for non-compliance.
• Conditional withholding or denial of prior approvals for new digital investments until conformity is achieved.
• Sectoral administrative sanctions under applicable administrative law where defined by complementary regulations.
• Liability exposure under data-protection (GDPR) and accessibility rules where failures impact fundamental rights, potentially leading to regulatory fines by CNPD or other competent authorities.
• Ordinary administrative and judicial remedies remain available to affected parties; courts may order compliance or reparative measures.

Per Portugal - National Digital Strategy (207/2024)

• The EDN resolution itself does not specify new penalties; compliance is enforced through existing statutory regimes (e.g., GDPR enforcement by CNPD for data breaches, sectoral regulator sanctions for regulated sectors).
• Procurement non‑compliance or misuse of public funds is subject to administrative and financial accountability remedies under Portuguese administrative and public finance law.
• Failure to meet contractual obligations in projects financed under EDN is subject to standard contractual remedies, termination rights and recovery measures per public contracts law.
• Any regulatory enforcement regarding cybersecurity, consumer protection or sectoral rules is carried out by the competent regulators under their statutory powers.

Per Portugal - Ethical AI in Public Administration

• The GuIA itself does not create statutory penalties—its status is guidance. Non-compliance with the GuIA is not in itself a sanctionable offence.
• Failure to adhere to legal obligations referenced by the GuIA (for example GDPR breaches or public procurement violations) may result in penalties under the applicable statutes and enforcement bodies.
• Entities that ignore recommended accountability and documentation practices may face administrative, reputational and legal risk if harm occurs or if statutory duties are breached.

Per Portugal - Digital Human Rights (27/2021)

• Enforcement and sanctions are applied through existing sectoral frameworks: media-related sanctions and procedures under media law are handled by the ERC (as referenced in the Charter and under Law n.º 53/2005).
• Data protection breaches remain subject to the GDPR enforcement regime and CNPD corrective powers, including fines and remedial measures.
• Civil and criminal liability for unlawful acts in the digital environment continues to be pursued under general civil, criminal, intellectual property and consumer protection laws.
• The Charter envisages administrative implementing rules that may specify additional procedural measures or remedies in particular areas, to be adopted within statutory deadlines.

Per Portugal - National AI Strategy

• AI Portugal 2030 is a non-binding strategic framework and does not itself establish penalties or enforcement sanctions.
• Any sanctions or penalties for AI-related misconduct would arise from later sectoral or national legislation and EU binding rules (to be applied when enacted).