PORTUGAL Law and Practice Contributed by: Luís Portela de Carvalho, Pedro Cortés and Cláudia de Azevedo Neves, Lektou
2.5 Commitments Regarding Ongoing Availability of Saas Solutions SaaS providers usually give commitments on avail - ability, support and continuity. A typical Portuguese SaaS contract will include: • an uptime commitment (commonly between 99.5–99.9% per month), subject to exclusions for scheduled maintenance and force majeure; • incident response and resolution targets based on severity levels; • support channels and escalation procedures; • service credits as the primary remedy for missed service levels; and • disaster recovery and business continuity commit - ments, including recovery time and recovery point objectives where the service is critical. Customers also increasingly request clear rights to export their data in usable formats and assistance during exit or migration. This is particularly important for longer-term or business-critical SaaS arrange - ments.
data protection. These may be exercised directly by the customer or through an independent auditor, usu - ally subject to confidentiality, notice and frequency limits. Supplier Audit Rights Suppliers are more likely to request audit rights where the customer controls the deployment environment, particularly in on-premises licensing. Their focus is usually on over-deployment, unlicensed use, user limits, geographic restrictions and compliance with In SaaS contracts, traditional on-site audits are less common. Parties more often rely on usage reports, self-certifications, security attestations and targeted audits where there is a specific compliance concern. 2.4 Escrow Provisions On-Premise Solutions licence metrics. Market Practice Escrow is still seen in Portugal for business-critical on-premises software, particularly where the custom - er depends heavily on the supplier for maintenance and support (eg, public sector and large corporates). Release triggers usually include supplier insolvency, prolonged failure to maintain the product or discon - tinuation without an adequate replacement or migra - tion route. SaaS Solutions Escrow is less common and generally of more limited utility in a pure multi-tenant SaaS model because the customer normally cannot operate the service inde - pendently. The operational platform, infrastructure and service dependencies are often as important as the code itself. For that reason, SaaS negotiations tend to focus instead on data export, transition assistance, business continuity, disaster recovery and advance notice of service discontinuation. Where escrow is included in a SaaS context, it is often limited to supporting materi - als, such as documentation, configuration information or container images that may assist with migration.
3. Artificial Intelligence 3.1 AI Legislation and Regulation 3.1.1 General Legislative Regime for AI EU AI Act as the Main Regime
Portugal has not adopted a separate national AI stat - ute. The regulation of AI is therefore mainly driven by EU law, especially the AI Act – Regulation (EU) 2024/1689, which introduces a risk-based model, with prohibited practices, detailed duties for high-risk sys - tems, transparency obligations for certain AI applica - tions (including chatbots and deepfakes) and specific rules for general-purpose AI models. The AI Act also sits alongside the Council of Europe Framework Convention on AI, Human Rights, Democ -
racy and the Rule of Law. Portuguese Legal Context
In Portugal, AI systems must also be assessed against existing rules on data protection, consumer protec - tion, product safety, liability, employment and sectoral regulation. The GDPR and Law No 58/2019 will be
56 CHAMBERS.COM
Powered by FlippingBook