PORTUGAL Law and Practice Contributed by: Luís Portela de Carvalho, Pedro Cortés and Cláudia de Azevedo Neves, Lektou
particularly relevant where AI involves personal data or automated decision-making. Portugal has not yet adopted a general domestic law that expands the AI Act. However, ANACOM has been designated in relation to supervision of EU fundamental-rights obligations for high-risk AI sys - tems under the AI Act. Further national developments are expected to focus on enforcement architecture, competent authorities and sector-specific guidance. The AI Act’s phased application includes prohibited practices from February 2025, governance and GPAI rules from August 2025, and transparency rules from August 2026. 3.1.2 AI-Related Lower-Level Regulation Portugal does not yet have a broad set of sector-spe - cific AI regulations below the level of the AI Act. Most sectoral obligations apply to AI systems indirectly, because AI tools form part of wider ICT, data protec - tion, cybersecurity or outsourcing arrangements. The Labour Code, as amended by Law No 13/2023, expressly extends equality and non-discrimination principles to decisions based on algorithms or other AI systems. It also includes information duties relat - ing to the use of algorithms or AI systems affecting employment decisions, including towards employees and worker representative structures. In other regulated sectors, such as financial services, telecommunications, healthcare and public admin - istration, AI deployments will generally be assessed through existing legal frameworks rather than AI- specific national rules. These include data protection, cybersecurity, operational resilience, outsourcing, consumer protection and professional liability rules. As a result, sectoral compliance requirements may be highly relevant to AI projects, but they are not, in most Larger organisations in Portugal are increasingly adopting internal AI governance measures. These measures commonly include AI use policies, approv - al processes for higher-risk tools, ethics guidelines, model inventories, internal risk assessments and restrictions on the use of confidential or personal data cases, AI-specific requirements. 3.1.3 AI-Related Self-Regulation
in public AI tools. This is generally driven by GDPR compliance, operational risk, reputational concerns and preparation for the AI Act, rather than by a stan - dalone Portuguese legal requirement. This trend is likely to accelerate as the AI Act encour - ages the development of codes of conduct and other voluntary compliance measures for AI systems that fall outside the mandatory high-risk regime. 3.2 Contractual Requirements With Respect to AI 3.2.1 Key Requirements Sought by Customers Customers are increasingly seeking contractual con - trols that make AI use transparent, auditable and legally manageable. The main negotiation points are as follows. • Transparency – customers want to know where AI is used, what the system does, whether outputs are automated or AI-assisted, and what technical or legal limitations apply. • Data use and data protection – contracts common - ly address the use of customer data for training, fine-tuning or improving models. Customers also seek compliance with the GDPR, rules on interna - tional transfers, processor obligations and appro - priate security measures. • Intellectual property – customers seek sufficient rights to use and commercialise outputs, and clarity on ownership of bespoke configurations, prompts, fine-tuned models or deliverables. • Performance and compliance – customers may request accuracy commitments, testing evidence, human oversight, audit rights and assistance with AI Act compliance where relevant. These provisions are increasingly treated as core risk- allocation provisions rather than as technical annexes. 3.2.2 AI-Related Liabilities in Contracts AI-related liability clauses increasingly separate dif - ferent categories of risk. Contracts commonly distin - guish between regulatory non-compliance, defective or biased outputs, misuse by the customer, data pro - tection breaches and intellectual property claims aris - ing from training data or generated content.
57 CHAMBERS.COM
Powered by FlippingBook