Portugal — CNPD + EU AI Act + Portuguese National AI Strategy: AI Compliance Requirements
Portugal's Comissão Nacional de Proteção de Dados (CNPD) enforces GDPR and has issued sector-specific AI guidance for financial services, healthcare, and public administration. Portugal published its "Estratégia Nacional para a Inteligência Artificial — ENIA 2030" establishing AI governance principles. Portugal is an EU member and fully subject to EU AI Act. The CNPD actively monitors AI-driven profiling and credit scoring systems.
Summary of publicly-available regulatory text as of 2026-08-22. Verify against current official sources before relying on this for compliance decisions. Not legal advice.
Key Facts
January 1, 2021
August 2, 2026
GDPR (CNPD): up to €20M or 4% global turnover. EU AI Act: €35M or 7% global turnover.
What Your Business Must Do
3 compliance requirements identified. Critical requirements carry the highest risk of enforcement action.
EU AI Act Compliance (Mandatory)
CriticalPortugal is subject to the EU AI Act. Risk classification required for all AI systems used in Portugal or processing data of Portuguese residents. High-risk AI in public administration, banking (Banco de Portugal oversight), healthcare (DGS oversight), and justice requires conformity assessment. Portugal's market surveillance authority coordinates with CNPD on AI enforcement. NOTE: the EU AI Act high-risk (Annex III) conformity-assessment deadline was deferred EU-wide from 2026-08-02 to 2027-12-02 by the "Digital Omnibus" amendment, Regulation (EU) 2026/1744 (in force 2026-07-27) -- Article 50 transparency obligations still apply from 2026-08-02, but conformity assessment/technical documentation/registration for stand-alone high-risk systems is not due until 2027-12-02 (2028-08-02 for Annex I product-embedded high-risk systems).
Deadline: December 2, 2027
EU AI Act Art. 6, Annex III (high-risk classification); Art. 16 (provider obligations); Art. 43 (conformity assessment); Art. 26 (deployer obligations)CNPD GDPR AI Compliance
High PriorityCNPD guidance requires: legal basis documentation for AI training data from Portuguese residents, DPIA for AI profiling systems, disclosure of automated decision-making under Art. 22, and explicit consent for sensitive AI processing. CNPD has issued guidance specifically on AI credit scoring and employee monitoring.
ENIA 2030 National AI Strategy Compliance
Lower PriorityPortugal's ENIA 2030 strategy creates AI ethics principles applicable to Portuguese public procurement. Organizations bidding on Portuguese government AI contracts must demonstrate ENIA compliance: human oversight, transparency, fairness testing, and data governance. Voluntary CNPD AI certification available.
Who Does This Apply To?
Applies to: any organisation established in Portugal, and any organisation outside Portugal processing the personal data of Portuguese residents through AI systems — GDPR applies with extraterritorial reach (Art. 3), obligations attaching to the processing activity rather than company size, with no general small-business exemption. As an EU member state, Portugal is fully subject to the EU AI Act: AI systems used in Portugal or processing Portuguese residents' data must be risk-classified, and high-risk AI in public administration, banking (Banco de Portugal oversight), healthcare (DGS oversight) and justice requires conformity assessment. The Comissão Nacional de Proteção de Dados (CNPD) requires a documented lawful basis for AI training data, a DPIA for AI profiling systems, Article 22 disclosure of automated decision-making, and a plain-language explanation plus genuine human review for adverse AI credit and employment decisions. Penalties reach €20M / 4% of global turnover under GDPR and €35M / 7% under the EU AI Act. The national strategy ENIA 2030 adds AI-ethics expectations for Portuguese public-procurement bidders.
Recent Enforcement Actions
Against:
Recent Regulatory Guidance
CNPD AI and GDPR — Sector Guidance for Financial Services and Healthcare
CNPD guidance for AI in Portuguese banking and healthcare: (1) credit-decision AI must provide Art. 22 human review by a person with genuine authority to change the decision; (2) medical AI diagnosis-support tools are high-risk under the EU AI Act — require both a DPIA and conformity assessment; (3) AI vendors to Portuguese regulated entities must sign DPA agreements documenting AI-specific processing details. Note: since CNPD stopped publishing individually-attributed decisions after 2022, verifying specific named enforcement of this guidance is not currently possible from public sources.
Frequently Asked Questions
Does Portugal — CNPD + EU AI Act + Portuguese National AI Strategy apply to my business?
Portugal's Comissão Nacional de Proteção de Dados (CNPD) enforces GDPR and has issued sector-specific AI guidance for financial services, healthcare, and public administration. Portugal published its "Estratégia Nacional para a Inteligência… Use Aegis Firma's free scanner to get a personalized assessment in under 5 minutes.
What is the penalty for non-compliance?
The maximum penalty under Portugal — CNPD + EU AI Act + Portuguese National AI Strategy is: GDPR (CNPD): up to €20M or 4% global turnover. EU AI Act: €35M or 7% global turnover.. Fines are typically scaled by company size, severity of violation, and whether violations were willful or accidental.
How do I comply with Portugal — CNPD + EU AI Act + Portuguese National AI Strategy?
The 3 requirements above cover the core obligations. The fastest path to compliance is: (1) conduct an AI risk assessment, (2) document your AI systems, (3) implement transparency disclosures where required. Aegis Firma generates all required documents automatically.
Official Source
https://www.cnpd.pt/home/orientacoes/orientacoes.htmLast updated: 2026-08-22 — verify at source before relying on this information.
Don't leave compliance to chance
Aegis Firma scans your AI tools, tells you exactly which regulations apply, and generates all required documents — in 30 minutes.
Start your free compliance scan