Portugal AI Regulation Overview

Overview

Portugal's regulatory approach to artificial intelligence blends soft-law strategic governance, targeted public sector modernization, and statutory protections for fundamental human rights in the digital space. Rather than maintaining a single prescriptive AI legal code, Portugal governs AI through a combination of national digital strategies, public administration guidelines, and rights-oriented legislation. Central to this landscape is the Estratégia Digital Nacional (EDN), approved via Resolução do Conselho de Ministros n.º 207/2024, which establishes national digital priorities across People, State, Companies, and Infrastructures, and incorporates the draft Agenda Nacional de Inteligência Artificial (ANI).

Strategic public investments focus heavily on digital sovereignty, high-performance computing infrastructure, and public sector adoption. A flagship national initiative is Resolução do Conselho de Ministros n.º 201/2024, which approves and funds the development of AMÁLIA—a Portuguese Large Language Model (LLM)—under a staged 18-month delivery timeline. In parallel, public sector digital transformation is governed by Decreto-Lei n.º 49/2024, establishing an omnichannel service model under the gov.pt brand and mandating technical interoperability, service cataloguing, and prior checking of digital investments.

Rights and safeguards for citizens are anchored in the Charter of Human Rights in the Digital Era (Lei n.º 27/2021), which guarantees fundamental constitutional rights in cyberspace, including specific requirements for explainability, transparency, and human review for automated decision-making and AI systems. Combined with operational guidance from the Agência para a Modernização Administrativa (AMA GuIA), Portugal's framework balances technological innovation, research funding, and ethical accountability.

Regulatory Approach

Portugal employs a hybrid regulatory approach that combines non-binding strategic roadmaps and soft-law guidelines with binding horizontal legislation. Strategic policy instruments such as the draft Agenda Nacional de Inteligência Artificial (ANI) and the earlier AI Portugal 2030 strategy focus on talent acquisition, research funding, expanding compute resources (including participation in European AI Factories), and sectoral adoption. To guide public sector implementation, the Agência para a Modernização Administrativa (AMA) issued the Guia para uma Inteligência Artificial ética, transparente e responsável na Administração Pública (AMA GuIA), providing non-binding risk assessment tools and five core evaluation dimensions: Responsabilization, Transparency, Explicability, Justice, and Ethics.

Binding legal obligations operate horizontally across sectors rather than through AI-specific codes. Lei n.º 27/2021 (Charter of Human Rights in the Digital Era) imposes statutory rules for AI systems, demanding explainability, auditability, transparency, and human review where automated decisions impact individuals. Similarly, Decreto-Lei n.º 49/2024 sets mandatory procedural and technical requirements for public sector digital services, mandating alignment with the Mosaico reference architecture and state authentication mechanisms (Cartão de Cidadão and Chave Móvel Digital).

Key AI Legislation

• Charter of Human Rights in the Digital Era (Lei n.º 27/2021, as amended by Lei n.º 15/2022): Statutory charter establishing rights in digital environments, including Article 9 guarantees regarding AI explainability, auditability, transparency, and human review.
• Decreto-Lei n.º 49/2024: Establishes rules for omnichannel public digital services under the gov.pt brand, requiring compliance with the Mosaico reference model and prior verification by ARTE.
• Resolução do Conselho de Ministros n.º 201/2024: Approves the development of the Portuguese Large Language Model (AMÁLIA) and mandates the preparation of the National AI Agenda.
• Estratégia Digital Nacional (Resolução do Conselho de Ministros n.º 207/2024): Sets Portugal's overarching digital transformation strategy through 2030, incorporating Initiative #10 (Agenda Nacional de IA).
• Agenda Nacional de Inteligência Artificial (ANI, Draft 2025): Strategic roadmap structured around Talent, Innovation & Research, and Infrastructure to build a competitive and ethical AI ecosystem.
• Guia para uma Inteligência Artificial ética, transparente e responsável na Administração Pública (AMA GuIA, 2022): Non-binding public administration guidance and Ethical Risk Assessment Tool published by AMA.
• AI Portugal 2030 (2019): Former national AI strategy under INCoDe.2030, superseded by the National AI Agenda.

Governance & Enforcement Bodies

Governance of AI and digital transformation in Portugal is distributed across multiple public agencies and ministerial bodies. At the political level, the Council of Ministers for the Transition to Digital and Modernization (CM-TDM) holds primary oversight for the Estratégia Digital Nacional. Operational coordination and administrative guidance are primarily led by the Agência para a Modernização Administrativa (AMA), which handles project management for the AMÁLIA LLM project, coordinates public consultation for the draft National AI Agenda, and sets public digital service standards.

Technical coordination, model training, data curation, and research infrastructure management are entrusted to the Fundação para a Ciência e a Tecnologia (FCT). Oversight of public administration digital service deployments and verification of planned digital investments are performed by the Agency for the Technological Reform of the State (ARTE) under Decreto-Lei n.º 49/2024. Additionally, specialized advisory bodies, such as the Comité de Acompanhamento Especializado, support monitoring and evaluation for flagship AI projects.

Penalties & Enforcement

Portugal's primary AI strategic policies (RCM 207/2024, RCM 201/2024), draft strategic agendas (ANI), and public administrative guidelines (AMA GuIA) do not establish statutory administrative fines or criminal penalties. Because these instruments function as policy frameworks and guidance, compliance is enforced through funding allocation criteria (e.g., PRR funding conditions), procurement checklists, and mandatory prior checking of public digital investments.

Enforceable remedies and administrative sanctions are handled through existing statutory regimes and sectoral supervisory authorities. Complaints regarding online disinformation under Lei n.º 27/2021 are channelled to the media regulator, Entidade Reguladora para a Comunicação Social (ERC), under established media legislation procedures. Data protection enforcement related to AI processing falls under the jurisdiction of the national supervisory authority, Comissão Nacional de Proteção de Dados (CNPD), enforcing the GDPR. For digital public services, failure to comply with Decreto-Lei n.º 49/2024 results in administrative oversight, required technical remediation from ARTE, or withholding of approval for planned digital investments.

Data Protection Framework

Data protection in Portugal is anchored in the EU General Data Protection Regulation (GDPR) and enforced by the Comissão Nacional de Proteção de Dados (CNPD). Lei n.º 27/2021 reinforces GDPR protections in cyberspace, establishing explicit rights to use encryption, rights regarding control over personal data, digital identity safeguards, and the "right to be forgotten" subject to European and national legal frameworks.

For public sector AI deployment and LLM development, data governance requirements emphasize strict compliance with GDPR rules. Strategic instruments like RCM 201/2024 (AMÁLIA LLM) and the draft National AI Agenda enforce data curation from Portuguese data sources, dataset documentation transparency, and compliance with data protection impact assessments (DPIAs) when processing public sector datasets for model training.

Sector-Specific Rules

Public administration is the most comprehensively regulated sector under Portuguese AI and digital policy framework instruments. Decreto-Lei n.º 49/2024 sets mandatory omnichannel requirements across telephony, web, mobile, and physical service channels under gov.pt, mandating the Mosaico reference architecture, state authentication mechanisms (Cartão de Cidadão and Chave Móvel Digital), and service cataloguing (CUSP). Furthermore, the AMA GuIA provides specific pre-deployment evaluation tools, sample procurement clauses, and lifecycle oversight rules for public sector decision-support and automated AI systems.

Beyond public administration and media oversight (where ERC handles disinformation complaints under Lei n.º 27/2021), the corpus holds no record of standalone regulatory frameworks for sectors such as autonomous vehicles, financial AI, or employment AI. Existing national strategic documents reference sector-specific pilots in healthcare, justice, and agriculture, but dedicated statutory codes for these sectors are not present in the corpus.

International Alignment

Portugal aligns its national AI policy closely with European Union regulatory frameworks, funding programs, and infrastructure initiatives. Both the Estratégia Digital Nacional (EDN) and the draft Agenda Nacional de Inteligência Artificial (ANI) explicitly commit to alignment with the EU AI Act, GDPR, and EU Digital Decade 2030 targets. Portugal also connects its computing infrastructure directly to European networks by participating in EuroHPC European AI Factories and utilizing European Recovery and Resilience Plan (PRR) funds for national AI development.

European standards also guide Portugal's rights frameworks and research structures. Lei n.º 27/2021 (as amended by Lei n.º 15/2022) aligns national rules on protection against online disinformation with the European Action Plan against Disinformation. Additionally, national R&D initiatives under AI Portugal 2030 and the National AI Agenda coordinate national participation with Horizon Europe and Digital Europe funding programs.

Future Developments

Upcoming milestones in Portugal's AI governance focus on the formal presentation and adoption of the Agenda Nacional de Inteligência Artificial (ANI) and the phased rollout of the AMÁLIA national large language model. Subject to public auscultation via Participa.gov.pt and Consultalex, the draft ANI outlines a roadmap to 2030 across Talent, Innovation & Research, and Infrastructure. Under RCM 201/2024, the AMÁLIA project sets a phased delivery timeline over 18 months, progressing from a text-only beta release to a base model and a final multimodal release.

Institutional structures may also evolve under the Estratégia Digital Nacional (EDN). Initiative #11 of the EDN outlines plans to study and potentially establish a dedicated Agência Nacional para o Digital to consolidate national digital execution capacity. In addition, public entities must meet progressive implementation deadlines established by Portaria n.º 345/2024/1 under Decreto-Lei n.º 49/2024, extending digital service cataloguing, design updates, and portal integrations into 2026–2028.

Enforcement Bodies

Agency	Mandate	Key Powers	Website
Agência para a Modernização Administrativa (AMA)	Coordinates public administrative modernization, digital service delivery, execution of the AMÁLIA LLM project, and ethical AI guidance for public bodies.	Project management, issuance of non-binding ethical guidance (AMA GuIA), public consultation coordination, oversight of digital service standards.
Fundação para a Ciência e a Tecnologia (FCT)	Coordinates scientific research, advanced computing infrastructure, model training, and technical development for national AI projects.	Technical coordination of the AMÁLIA model training, compute capacity procurement, allocation of research funding calls, coordination with EU programs.
Agency for the Technological Reform of the State (ARTE) / Agência para a Reforma Tecnológica do Estado	Verifies compliance of public administration digital investments and services with omnichannel and technical standards under Decreto-Lei n.º 49/2024.	Prior verification of planned public digital investments, compliance review against the Mosaico reference model, enforcement of technical remediation.
Entidade Reguladora para a Comunicação Social (ERC)	Regulates media and communication platforms, including handling user complaints regarding online disinformation under the Charter of Human Rights in the Digital Era.	Complaint investigation, enforcement of media regulatory procedures, application of media-related sanctions under media laws.
Comissão Nacional de Proteção de Dados (CNPD)	National supervisory authority responsible for enforcing GDPR and data protection laws in digital environments.	Supervision of personal data processing, investigation of privacy violations, enforcement of GDPR sanctions, guidance issuance.
Council of Ministers for the Transition to Digital and Modernization (CM-TDM)	Primary political executive decision-making body for national digital transformation strategies under the Estratégia Digital Nacional.	Approval of national digital policies, top-level political oversight, authorization of major digital initiatives and corrective actions.