Current position
Overview
AI legislation has been enacted.
Key legislation & sources
EU AI Act (Regulation 2024/1689)
ANACOM (National Communications Authority)
EU AI Act National Implementation Tracker
Portugal AI Strategy (AI Portugal 2030)
Council of Europe Framework Convention on AI (CETS 225)
EU AI ACT
The EU AI Act (Regulation 2024/1689) applies directly across all member states. Prohibitions on unacceptable-risk AI systems have been in force since 2 February 2025; GPAI model rules since 2 August 2025. High-risk AI obligations are due from 2 August 2026, subject to the Digital Omnibus proposal which may defer enforcement. For the full implementation timeline, governance structure, and current status, see the European Union overview.
INCM (National Communications Authority) has been proposed as market surveillance authority. A national AI Strategy 2030 is in place. MSA designation procedures are ongoing.
Regulatory developments
Latest updates
Latest event import:
Updates sourced from Digital Policy Alert ↗. The latest available entries for this jurisdiction.
passage
Parliament passed Bill concerning the Protection of Children in Digital Environments (PL 398/XVII/1) including design requirement by general vote
Source: Digital Policy Alert · View update ↗
On 12 February 2026, Parliament passed the Bill concerning the Protection of Children in Digital Environments (PL 398/XVII/1) by general vote. Article 6 requires platforms, services, games, and applications accessible to children to provide a dashboard available to both the child and the holders of parental responsibilities. This dashboard must enable the setting of time limits, monitoring of contacts and interactions flagged as risky, adjustment of enhanced privacy settings, activation of usage time controls by the child, and access to regular information on daily and weekly usage time. Article 10 establishes safe default settings for accounts of children under 16. By default, such accounts must be private, non-searchable, limit algorithmic recommendations to appropriate and non-addictive content, and hide social metrics. Article 11 prohibits certain functionalities on accounts of children under 16, including autoplay, infinite scroll, gamification designed to prolong use, non-essential notifications, particularly during nighttime hours, systems for creating fake images or videos, and loot boxes or similar mechanisms. Essential functionalities may be maintained, provided they are configured to minimise exposure to inappropriate content and the risks of digital addiction.
introduction
Bill concerning the Protection of Children in Digital Environments (PL 398/XVII/1) including design requirement was introduced to Parliament
Source: Digital Policy Alert · View update ↗
On 2 February 2026, the Bill on the Protection of Children in Digital Environments (PL 398/XVII/1) was introduced in Parliament. Article 6 requires platforms, services, games, and applications accessible to children to provide a dashboard available to both the child and the holders of parental responsibilities. This dashboard must enable the setting of time limits, monitoring of contacts and interactions flagged as risky, adjustment of enhanced privacy settings, activation of usage time controls by the child, and access to regular information on daily and weekly usage time. Article 10 establishes safe default settings for accounts of children under 16. By default, such accounts must be private, non-searchable, limit algorithmic recommendations to appropriate and non-addictive content, and hide social metrics. Article 11 prohibits certain functionalities on accounts of children under 16, including autoplay, infinite scroll, gamification designed to prolong use, non-essential notifications, particularly during nighttime hours, systems for creating fake images or videos, and loot boxes or similar mechanisms. Essential functionalities may be maintained, provided they are configured to minimise exposure to inappropriate content and the risks of digital addiction.
outline
National Cybersecurity Certification Authority adopted cybersecurity services certification scheme
Source: Digital Policy Alert · View update ↗
On 8 October 2025, Portugal’s National Cybersecurity Centre (CNCS) adopted the Cybersecurity Services Certification Scheme to identify and value cybersecurity services across the country. The voluntary scheme applies to all organisations established in Portugal, covering services including incident monitoring and response, vulnerability management, threat intelligence, and penetration testing. Administered by CNCS as the National Cybersecurity Certification Authority and implemented through IPAC-accredited independent bodies, it offers two certification levels, including Basic and Substantial, and requires periodic assessments to ensure compliance. The scheme aims to create a national catalogue of reliable providers, enhancing trust, competitiveness, and integration into European cybersecurity markets.
Showing 3 of 3 available API entries. Dates and summaries are supplied by Digital Policy Alert.