Engineering perspectives
AI Act in Portugal (2026): Inventory, Transparency and Compliance Checklist for SMEs and Product Teams
What is already mandatory, what waits until 2027, and how to produce evidence IT and legal can audit.
5 November 2026 · 9 min read
The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) applies directly in Portugal — no national transposition law is required for core obligations. From 2 August 2026, transparency rules bite for chatbots, assistants and synthetic content. Many SMEs discover AI only when legal asks for an inventory: Copilot in Word, AI scoring in the CRM, a recruitment filter, a customer widget on the website. This article is the most practical technical–legal checklist for product, IT and compliance leads: what to do now, what can wait until 2027, and how software delivery teams implement evidence. It links to shadow AI governance, HR and recruitment AI, LLM security and AI-ready data. Damascode supports inventories, integrations and conformant customer-facing AI via IT consulting and cybersecurity engineering.
Table of contents
- Who the AI Act covers in Portugal
- Timeline through 2028 (including Digital Omnibus)
- Roles: provider, deployer, importer
- Step 1 — AI system inventory (template)
- Step 2 — Risk classification in plain language
- Step 3 — Transparency (Article 50) from August 2026
- Step 4 — Prohibited practices (Article 5)
- Step 5 — AI literacy (Article 4)
- Step 6 — High-risk Annex III (employment, credit, essential services)
- Step 7 — GPAI and vendor contracts
- Step 8 — RGPD overlap and DPIAs
- Step 9 — Documentation pack for auditors
- Sector notes: SaaS, agencies, public contractors
- Sandboxes and ANIA (Portugal)
- FAQ
- References
Who the AI Act covers in Portugal
Applies if you place on the market, put into service or use AI systems in the EU — including US/UK vendors when output affects people in the EU.
| Organization type | Typical AI Act touchpoints |
|---|---|
| SME using Microsoft 365 Copilot | Deployer; transparency for customer-facing bots you configure |
| Software vendor embedding LLM features | Often provider or deployer depending on customization |
| Integrator building client chatbot | Deployer for client; document subprocessors |
| HR using SaaS screening | Deployer of high-risk use case (timeline 2027 for full Annex III HR) |
| Marketing agency generating synthetic ads | Transparency and marking obligations |
Size does not exempt you from prohibited practices, transparency or literacy duties. Concessions exist for SMEs in documentation burden for some high-risk duties — not for core safety.
Timeline through 2028 (including Digital Omnibus)
Dates below reflect the regime as commonly described after Regulation (EU) 2026/1744 (Digital Omnibus) adjustments. Confirm with counsel for your exact systems.
| Date | Milestone |
|---|---|
| 2 Feb 2025 | Prohibited AI practices; AI literacy measures |
| 2 Aug 2025 | GPAI model obligations; penalty framework |
| 2 Aug 2026 | General application expansion; Art. 50 transparency in force |
| 2 Dec 2026 | End of transitional period for marking certain existing synthetic content |
| 2 Dec 2027 | Many Annex III high-risk obligations (e.g. recruitment screening, credit scoring in scope) |
| 2 Aug 2028 | Annex I product-embedded AI systems |
Operational priority today: inventory + transparency + literacy + vendor clauses. High-risk HR/credit: design now, full conformity by 2027.
Official Portuguese context: digital.gov.pt communications on AI transparency (August 2026).
Roles: provider, deployer, importer
| Role | You are likely this if… | Core duties (simplified) |
|---|---|---|
| Provider | You develop or brand an AI system for others | Conformity assessment, technical documentation, CE marking where applicable |
| Deployer | You use someone else’s AI in your processes | Instructions of use, human oversight, logs, worker information |
| Importer / distributor | Bringing non-EU AI products into EU market | Verify provider compliance, labeling |
Most Portuguese mid-market companies are deployers for Copilot, ATS AI, chat widgets. Custom software with embedded models may make you provider for that component — engage legal early.
Step 1 — AI system inventory (template)
Without inventory, compliance is fiction. Run a two-week sprint:
| Column | What to capture |
|---|---|
| System name | Product + feature (e.g. “HubSpot AI email”, “Site chatbot v2”) |
| Vendor / internal team | Contract owner |
| Purpose | Business process supported |
| Users | Teams and customer exposure |
| Input data | Personal data? Special categories? |
| Output use | Automated decision or human review? |
| Customer-facing? | Y/N |
| Go-live date | |
| Risk tier (draft) | Minimal / limited / high / unacceptable |
| Evidence folder link | DPA, SOC2, model card, internal test report |
Hidden AI counts: autocomplete in CRM, “smart” prioritization in support tools, translation, meeting summaries, code assistants, image generators in marketing, RPA with ML components.
Engineering should grep repos for openai, anthropic, azure.*openai, bedrock, vertex, LangChain, LlamaIndex, and review n8n/Zapier flows.
Step 2 — Risk classification in plain language
AI Act uses risk tiers. Practical mapping for deployers:
| Tier | Examples | Deployer focus |
|---|---|---|
| Unacceptable | Social scoring, manipulative subliminal techniques, certain biometric mass surveillance | Stop use — verify Art. 5 list with counsel |
| High-risk | CV screening/ranking, credit scoring, exam scoring, critical infrastructure safety components | Full system of controls by applicable deadline |
| Limited risk | Chatbots interacting with people, deepfakes in scope of Art. 50 | Transparency, marking |
| Minimal risk | Spam filters, internal anomaly detection without individual legal effect | Good practice; document optionally |
Do not self-downgrade HR tools because vendor marketing says “assistant”. Ranking candidates by fit is typically high-risk territory under Annex III employment.
Step 3 — Transparency (Article 50) from August 2026
From 2 August 2026, organizations must ensure users know when they interact with AI (unless obvious to a reasonable person) and that certain synthetic content is labeled.
| Scenario | Action |
|---|---|
| Website chatbot | First message: “You are chatting with an AI assistant.” |
| AI-generated marketing image/video | Disclose synthetic origin where required |
| Support email fully drafted by AI | Internal policy; customer disclosure if material |
| Internal Copilot | Usually no Art. 50 customer duty; still govern shadow use |
Implement in product (UI strings), CMS (content labels) and contracts (agency delivers marked assets).
Technical checklist:
- List all user-facing AI touchpoints
- Add disclosure strings (locale PT + EN)
- Verify third-party widget compliance in vendor DPA
- Train support staff not to impersonate humans when AI handles chat
- Log version of disclosure text for audits
Step 4 — Prohibited practices (Article 5)
Cross-check inventory against prohibited practices (social scoring, exploitation of vulnerabilities, real-time remote biometric identification in public spaces with narrow exceptions, etc.). Document negative findings (“no prohibited use identified on DATE”) signed by compliance.
Penalties can reach 7% of global turnover for prohibited AI — treat as board-level risk.
Step 5 — AI literacy (Article 4)
Organizations must take measures so staff dealing with AI understand capabilities and limits. After Digital Omnibus wording shifts, focus on proportionate training, not box-ticking.
| Audience | Minimum content |
|---|---|
| All staff | Approved tools, data rules, incident reporting |
| Managers | Oversight, bias, when to escalate |
| Product/engineering | Deployer docs, logging, secure design |
| HR | Recruitment AI guide |
Keep attendance records and material versions.
Step 6 — High-risk Annex III (employment, credit, essential services)
If inventory flags high-risk, start conformity planning even before 2027:
- Risk management system across lifecycle
- Data governance and bias testing where you control inputs
- Technical documentation and logs (minimum six months for many deployer logs)
- Human oversight with authority to override
- Transparency to workers/candidates affected
- Correctness, robustness, cybersecurity appropriate to context
For recruitment, pair with Portuguese Labour Code algorithm transparency (Lei 13/2023 agenda) and RGPD.
Step 7 — GPAI and vendor contracts
General-purpose AI models (GPT-4 class, Claude, Gemini, Llama family in products) impose duties on providers; deployers must still:
- Request system cards, acceptable use, update notices
- Contractually require incident notification
- Map subprocessors and transfer mechanisms
- For fine-tuned or RAG-heavy products, clarify who is provider for conformity
Clause pack to add to SaaS renewals:
Vendor represents AI features comply with applicable EU AI Act obligations for their role; provides documentation updates within 30 days of material model change; supports deployer logging and transparency implementation.
Step 8 — RGPD overlap and DPIAs
AI Act does not replace RGPD. Joint triggers:
- Personal data in training or RAG index → lawful basis, minimization, retention
- Automated decisions with legal effect → Art. 22 RGPD analysis
- High-risk AI → DPIA often mandatory
Single record of processing entry per AI system beats duplicate spreadsheets.
Step 9 — Documentation pack for auditors
Maintain one folder per high-value system:
- Inventory row + risk classification memo
- Vendor DPA + AI Act statement
- Transparency screenshots / copy
- Training records
- Human oversight procedure (who can stop the system)
- Test results (accuracy, bias spot checks)
- Incident log
- Change log (model version upgrades)
For custom builds, add architecture diagram, prompt-injection test summary, and data lineage from governance guide.
Sector notes: SaaS, agencies, public contractors
| Sector | Extra pressure |
|---|---|
| B2B SaaS from Portugal | Customers ask for AI Act addendum; you may be provider |
| Digital agencies | Client chatbots and synthetic media — contract liability |
| Public procurement | Accessibility + AI transparency in citizen services; align with NIS2 readiness where essential entities |
Sandboxes and ANIA (Portugal)
Portugal’s Agenda Nacional para a IA (ANIA) 2026–2030 promotes adoption support, SME initiatives and regulatory sandboxes (EU deadline for availability 2 August 2027 for member state sandboxes). Sandboxes help test high-risk ideas with supervisor involvement — not a substitute for baseline inventory and transparency today.
FAQ
We only use Copilot — are we exempt?
No. You still need literacy, inventory, transparency on customer-facing uses, and HR diligence if recruiting features rank candidates.
Does open-source Llama on our server make us provider?
If you place a system on the market or put a customized system into service for clients, possibly. Internal-only use has different analysis.
What changed with Digital Omnibus?
High-risk Annex III timeline moved to December 2027 for many systems; transparency dates largely unchanged — verify for your category.
Is a Excel list enough for inventory?
Start there; move to a living register owned by IT with legal review quarterly.
Do we need CE marking?
Product-embedded AI under Annex I has separate timelines (2028). Most service companies do not CE-mark chatbots.
How does AI Act relate to NIS2?
Essential entities must secure AI systems in critical workflows; see NIS2 guide.
Can Damascode certify us?
We deliver technical readiness: inventories, secure architecture, logging, integration — not legal certification or Notified Body services.
References
- Regulation (EU) 2024/1689 (AI Act)
- Regulation (EU) 2026/1744 (Digital Omnibus — AI amendments)
- Portuguese Government — AI transparency (Aug 2026): digital.gov.pt
- Resolução do Conselho de Ministros — ANIA 2026–2030
- EURES — candidate rights in AI hiring (2026)
- Damascode: shadow AI, recruitment AI
Map your AI systems with engineering support
Share your SaaS stack and customer-facing bots. We deliver inventories, logging design and conformant integrations — not legal certification.