15 APR 2026 · Law / Act

Law implementing Digital Services Act including measures designating competent authorities (No. 25/XVII/1)

On 15 April 2026, the Law implementing the Digital Services Act, including measures designating competent authorities, enters into force. The Law implements EU Regulation 2022/2065 (the Digital Services Act) into national law. The Law applies to all intermediary service providers operating in Portugal, including hosting services, online platforms, marketplaces, and search engines. It requires intermediaries to comply with orders to act against illegal content and to provide information about ...

Secondary evidenceContent ModerationIssuing institution: Issuing authority not identified

25 FEB 2026 · International Agreement

CNPD and CNDP signed Memorandum of Understanding in the field of personal data protection, covering AI

La Présidente de la CNPD du Portugal (Comissão Nacional de Protecção de Dados) Mme Paula Meira Lourenço et le Président de la CNDP Maroc (Commission nationale de contrôle de la protection des données à caractère personnel) M. Omar Seghrouchni ont signé, le 25 février 2026 au siège de la CNPD à Lisbonne, un MoU (Mémorandum d’entente) dans le domaine de la protection des données à caractère personnel.

Secondary evidenceData Privacy & Protection ·DeepfakesIssuing institution: Issuing authority not identified

20 FEB 2026 · Other

Competition authority warns of risks in the AI value chain

A Autoridade da Concorrência (AdC) publicou hoje um novo short paper no qual analisa questões concorrenciais associadas ao acesso a chips utilizados no treino e na execução de modelos de Inteligência Artificial (IA). O acesso a chips de IA — bem como a hardware relacionado, designadamente através de serviços de computação em cloud — constitui um fator determinante para o desenvolvimento de sistemas de IA. No entanto, a AdC observa que a cadeia de valor destes chips apresenta características estruturais que a torna propensa a elevados níveis de concentração.

Secondary evidenceAntitrust & CompetitionIssuing institution: Issuing authority not identified

10 AUG 2025 · Other

National Cybersecurity Certification Authority's cybersecurity services certification scheme

On 8 October 2025, Portugal’s National Cybersecurity Centre (CNCS) adopted the Cybersecurity Services Certification Scheme to identify and value cybersecurity services across the country. The voluntary scheme applies to all organisations established in Portugal, covering services including incident monitoring and response, vulnerability management, threat intelligence, and penetration testing. Administered by CNCS as the National Cybersecurity Certification Authority and implemented through I...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

12 APR 2025 · Executive Order

Decree-Law No. 125/2025 transposing EU Directive 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive)

On 4 December 2025, Decree-Law No. 125/2025 was issued, formalising the cybersecurity framework approved on 5 November and promulgated on 28 November. The publication enacted the transposition of Directive (EU) 2022/2555, confirmed the expanded categories of covered entities and the regimes for essential entities and important entities, and implemented the supervisory model led by the National Cybersecurity Centre (CNCS) with sectoral authorities. It confirmed amendments to the Internal Secur...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

07 SEP 2024 · Other

National Data Protection Authority investigation into Worldcoin's biometric data collection

On 9 July 2024, the National Data Protection Commission (CNPD) of Portugal issued a decision addressing the jurisdiction over the matter concerning Worldcoin's processing of personal and biometric data. CNPD recognised the Data Protection Authority of Bavaria for the Private Sector (BayLDA) as the lead supervisory authority for the investigation of Worldcoin's data processing compliance with the General Data Protection Regulation (GDPR) and declared itself a concerned supervisory authority. T...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

11 APR 2024 · Law / Act

Bill No. 32/XVI/1st implementing Digital Services Act, designating competent authorities and coordinator, outlining intermediary obligations, and establishing sanctions framework

On 4 November 2024, the Bill No. 32/XVI/1st implementing the Digital Services Act (DSA) (Regulation (EU) 2022/2065) was presented to the Parliament. The Bill designates the National Communications Authority (ANACOM) as the Digital Services Coordinator, responsible for supervising and executing DSA obligations. ANACOM serves as the single point of contact with the European Commission, the European Board for Digital Services (EBDS), and Coordinators of Digital Services in other EU Member States...

Secondary evidenceContent ModerationIssuing institution: Issuing authority not identified

17 FEB 2024 · Law / Act

Decree-Law No. 20-B/2024 designating Portuguese competent authorities and coordinator under Digital Service Act

On 17 February 2024, the Decree-Law No. 20-B/2024 designating competent authorities and coordinator under the Digital Service Act (DSA) entered into force. The decree designates the National Communications Authority (ANACOM) as the competent authority and coordinator of digital services in Portugal. The Media Regulatory Authority and the General Inspectorate of Cultural Activities are also designated as competent authorities in matters of media and copyright, respectively. The authorities are...

Secondary evidenceContent ModerationIssuing institution: Issuing authority not identified

23 MAY 2023 · Executive Order

Cybersecurity Council resolution regarding national security risks arising from 5th generation telecommunications technology

On 23 May 2023, the Portugal Cybersecurity Council (CSSC) issued a resolution containing criteria for assessing safety risks regarding national security risks arising from the use of 5th generation telecommunications technology (5G). The CSSC details in paragraph 5 that certain equipment from suppliers may pose a high risk to the security of 5G telecommunication networks where those suppliers are domiciled or connected to countries outside the EU, NATO or OECD, whose legal system allows the g...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

29 JAN 2022 · Law / Act

Content moderation requirements in Law 82/2021

Law 82/2021, which establishes procedures for monitoring content protected by copyright in the digital context, enters into force. Firstly, the Law establishes the competence of Inspeção-Geral das Atividades Culturais (IGAC) to monitor the access to content protected by copyright and to determine the access restriction in the cases in which such content is unlawfully made available. Secondly, the Law details how rightsholders can submit a complaint to IGAC when their content is unlawfully mad...

Secondary evidenceContent ModerationIssuing institution: Issuing authority not identified

25 JAN 2022 · Standard / Framework

Portuguese CNPD Guidelines (1/2022) on Direct Marketing Electronic Communications

The Portuguese National Commission for Data Protection (CNPD) emitted the Guidelines on Direct Marketing Electronic Communications (1/2022). The Guidelines approach the topic of legal grounds for sending electronic marketing communications, particularly treating the use of legitimate interest and prior consent as lawful grounds.

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

27 APR 2021 · Executive Order

Restriction of data transfer to U.S. in Deliberacao 2021/533

The Portuguese data protection authority (Comissão Nacional de Proteção de Dados (CNPD)) issues the deliberation 2021/533, which suspends the transfer of data on the national census (Censos 2021) to the U.S. by the national institute of statistics.

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

Law / Act

Measures regarding enforcement in Law for the Protection of Children in Digital Environments (398/XVII/1)

On 12 February 2026, Parliament passed the Bill concerning the Protection of Children in Digital Environments (PL 398/XVII/1) by general vote. It designates the National Communications Authority and the National Data Protection Commission as the authorities responsible for overseeing compliance, within their respective competencies. The National Communications Authority may adopt additional regulations and technical guidelines, including the National Technical Reference Framework for Age Veri...

Secondary evidenceContent ModerationIssuing institution: Issuing authority not identified

National Strategy

Agenda Nacional de Inteligência Artificial (National AI Agenda / ANI) — planned national AI agenda (in public consultation/auscultation)

AI law in Portugal: The Agenda Nacional de Inteligência Artificial is a draft national AI strategy launched by the Portuguese Government as part of its Digital Strategy (Estratégia Digital Nacional). Presented for public auscultation in January 2025, it sets out priorities across Talent, Innovation & Research and Infrastructure, including the development of a national LLM (Amália), an AI Factory participation and increased compute capacity, while aligning with EU regulatory frameworks and fundamental-rights safeguards....

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

National Strategy

Guia para uma Inteligência Artificial ética, transparente e responsável na Administração Pública (AMA Guide)

AI law in Portugal: The AMA Guide (GuIA) is a non-binding practical framework published by the Portuguese public administration’s modernisation agency to promote ethical, transparent and responsible use of Artificial Intelligence in the public sector. It sets principles, five evaluation dimensions (accountability, transparency, explainability, fairness and ethics), and provides a risk-assessment tool and implementation guidance aimed at public entities, but reusable by academia and private sector actors....

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

Law / Act

Charter of Human Rights in the Digital Era

AI law in Portugal: The Charter (Lei n.º 27/2021) formally recognises and consolidates a set of rights, freedoms and guarantees applicable in the digital environment in Portugal, including access to the Internet, digital privacy, protection against disinformation, net neutrality, digital skills and safeguards for children. It requires the State to promote connectivity and digital inclusion, provides routes for complaints (including to the media regulator for disinformation) and aligns national practice with European instruments....

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

National Strategy

AI Portugal 2030 (Estratégia Nacional para a Inteligência Artificial)

AI law in Portugal: AI Portugal 2030 (Estratégia Nacional para a Inteligência Artificial) is Portugal's national strategy, published in 2019 and coordinated under the INCoDe.2030 initiative, which sets out priorities to develop human capital, research, innovation ecosystems and public sector adoption of AI while aligning with EU priorities. The strategy is a non-binding national framework that stimulates investment, skills, and institutional coordination for AI development in Portugal. (incode2030.gov.pt)...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

National Strategy

Resolution of the Council of Ministers No. 201/2024 — Approval of the development of a Portuguese Large Language Model (AMÁLIA) and mandate to prepare the National AI Agenda

AI law in Portugal: Resolução do Conselho de Ministros n.º 201/2024 (30 December 2024) approves the development of a national Large Language Model (LLM) named AMÁLIA and mandates the preparation of a National Artificial Intelligence Agenda. The resolution sets strategic objectives, an 18‑month delivery timetable (beta, base, multimodal releases), an estimated investment of €5.5 million (PRR‑funded), and establishes roles for the Agência para a Modernização Administrativa (AMA), the Fundação para a Ciência e a Tecnologia (FCT) and a specialized monitoring committee....

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

National Strategy

Decreto-Lei n.º 49/2024 — Rules on the provision of digital services by the Public Administration (gov.pt omnichannel)

AI law in Portugal: Decreto-Lei n.º 49/2024 (8 August 2024) creates a legal framework requiring Portuguese public administration entities to provide digital services under a unified omnichannel model centered on the Portal Único de Serviços Digitais (gov.pt), and mandates adoption of a common reference model (Mosaico) and specified technical and organisational measures to ensure interoperability, accessibility and continuity of service. (dre.tretas.org)...

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

National Strategy

Estratégia Digital Nacional (National Digital Strategy, includes Agenda Nacional de IA)

AI law in Portugal: The Estratégia Digital Nacional (EDN) is Portugal’s national strategic framework to guide digital transformation to 2030, approved by Resolução do Conselho de Ministros n.º 207/2024 on 30 December 2024. It sets vision, principles, four dimensions (People, State, Companies, Infrastructure), 16 initiatives and a 2025–2026 Action Plan and explicitly includes an Agenda Nacional de Inteligência Artificial to be operationalized from 2025....

Secondary evidenceNational StrategyIssuing institution: Issuing authority not identified

National Strategy

National Strategy for Artificial Intelligence (2019)

O portal Digital.gov é financiado pelo Compete 2020, Portugal 2020, Plano de Recuperação e Resiliência e o Next Generation EU.

Secondary evidenceData Privacy & Protection ·Education & Training ·Liability & AccountabilityIssuing institution: Issuing authority not identified