PORTUGAL Law and Practice Contributed by: Luís Portela de Carvalho, Pedro Cortés and Cláudia de Azevedo Neves, Lektou
Cybersecurity will also become more closely linked to AI regulation, as AI tools are increasingly used both to launch and to defend against cyber-attacks. 8.2 Standards in Contract Drafting Contract drafting in Portuguese IT, cloud and AI pro - jects has become more detailed and risk based. Sev - eral developments are now common in the market: • data-processing agreements are usually more comprehensive and are often accompanied by separate security schedules; • security clauses increasingly refer to recognised standards or frameworks, including ISO 27001 and CNCS guidance; • AI provisions are now appearing in procurement documents, especially around training data, trans - parency, human oversight and regulatory change; • liability clauses more often use different caps for different types of risk; and • exit, portability and interoperability clauses are receiving more attention in cloud and SaaS con - tracts. The EU Data Act must be taken into account, par - ticularly in relation to switching, access to data and interoperability in cloud and data-driven services. 8.3 Hyperscalers Hyperscalers have materially influenced technol - ogy contract negotiations in Portugal. Their standard cloud contracts, which are often offered on largely non-negotiable terms, set a de facto benchmark for market expectations, especially regarding availability commitments, data protection measures and security certifications. At the same time, customers often have limited abil - ity to negotiate core risk provisions with major cloud providers. Liability caps, audit rights, unilateral service changes and standard security terms are frequently presented on a take-it-or-leave-it basis, although large enterprise customers and public sector customers may obtain specific addenda or tailored commitments.
This affects negotiations with smaller vendors. Cus - tomers may ask local or smaller providers to match hyperscaler-style security and resilience standards, even where those providers cannot offer the same scale, infrastructure or pricing model. The result is a market in which hyperscaler terms often set expecta - tions, but not always realistic benchmarks for all sup - pliers. 8.4 IP Evolution Traditional intellectual property concepts still apply to current technologies, but they do not always map neatly onto AI, big data, cloud computing or open- source software. Portuguese and EU law remain based on familiar categories such as copyright, pat - ents, trade secrets, database rights and contractual licences. Practical Adaptations In practice, parties use contracts to fill many of the gaps. They allocate rights in outputs, restrict use of confidential information, regulate access to data, define permitted use of open-source components and clarify ownership of configurations, prompts, documentation and deliverables. AI creates particu - lar difficulty because Portuguese copyright law is built around human authorship. The EU text and data mining exceptions, transposed into the CDADC, are also relevant to AI training, particularly in relation to rights reservations by rights-holders and the distinc - tion between scientific research and other text and data mining uses. Future Developments Further clarification may be needed on AI-generated works, data access, model training and the relation - ship between copyright, trade secrets and transpar - ency. Until then, Portuguese practitioners are likely to continue relying heavily on contract drafting to man - age issues that legislation has not yet resolved.
65 CHAMBERS.COM
Powered by FlippingBook