Portugal’s AI Regulatory Framework: A Criminal Justice Blind Spot

Article by Vitor Neves, President of Associação Jurídica do Porto (AJP)

As the 2 August 2026 deadline for full application of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689) approaches, Portugal finds itself in a position that is simultaneously typical and distinctive among EU Member States. Typical, in that no standalone national AI law has been adopted or is presently foreseen; distinctive, in that the gap between European substantive rules and the domestic procedural architecture becomes particularly visible in the field of criminal justice.

Portugal’s regulatory baseline relies entirely on the direct application of the AI Act, complemented by horizontal frameworks: Law 58/2019 implementing the GDPR, Decree-Law 125/2025 transposing the NIS2 Directive (in force from 3 April 2026), and sectoral regimes for consumer protection, product safety and electronic communications. In September 2025, following months of delay relative to the 2 August 2025 deadline, the Government designated ANACOM — the National Communications Authority — as the single market surveillance authority and point of contact under Article 70 of the AI Act. ANACOM coordinates the activities of fourteen other public authorities with sectoral competence, including the Portuguese Data Protection Authority (CNPD), the Bank of Portugal, the Securities Market Commission (CMVM), and the Media Regulatory Authority (ERC). The National AI Agenda (Agenda Nacional de Inteligência Artificial), approved in January 2026, sets strategic orientations for 2026–2030 but has no binding regulatory effect. No national implementing act has been adopted establishing penalties, notified bodies, or procedural rules tailored to the Act’s high-risk regime.

This institutional architecture is oriented towards market surveillance. It does not address the specific procedural challenges raised by the use of AI systems in the administration of justice and in law enforcement — areas that Annex III, points 6 and 8, of the AI Act classifies as high-risk, subject to the most stringent substantive obligations on risk management, data governance, transparency, human oversight and technical documentation. Recital 61 is explicit in identifying the potential impact of these systems on the rule of law, the right to an effective remedy and the right to a fair trial.

It is at this intersection that the Portuguese blind spot emerges. The AI Act creates extensive obligations on providers and deployers of high-risk AI systems, but it does not, in itself, confer procedural rights exercisable within a criminal proceeding. Such translation depends on national procedural law. The Portuguese Code of Criminal Procedure contains no specific provision addressing algorithmic evidence, no explicit right to an explanation of automated outputs used in the production of suspicion or proof, and no mechanism allowing the defence to access training data, model documentation, performance metrics or logs of the systems used by investigating authorities. The general rules on expert evidence (prova pericial) and on the principle of contradiction apply residually, but they were not designed for — and do not adequately accommodate — the opacity of machine learning systems, the distributed nature of their development, or the trade-secret and operational-security objections routinely raised by providers and law enforcement agencies.

The result is a structural asymmetry between prosecution and defence. Investigating authorities may lawfully rely on the outputs of AI systems — for risk assessment, facial recognition, forensic analysis of digital evidence, or the identification of patterns in large datasets — without being required to disclose, in a form usable for adversarial scrutiny, the technical substrate on which those outputs rest. The defence is thus placed in the position of contesting conclusions whose underlying logic remains inaccessible. The AI Act’s transparency obligations, conceived primarily for market surveillance and fundamental rights authorities designated under Article 77, do not automatically translate into disclosure entitlements within criminal proceedings.

A comparative reading confirms that this is not an inevitable consequence of the Act’s design. Italy has adopted a national AI law addressing, among other matters, the use of AI in the administration of justice, with dedicated provisions on oversight by the Agenzia per l’Italia Digitale and the National Cybersecurity Agency. Spain, through AESIA, has published sixteen technical guidance documents, including operational criteria for conformity assessment and human oversight applicable to high-risk systems. Germany’s draft implementation act, dated 11 September 2025, is being coordinated through a dedicated federal ministry. France and Belgium remain, like Portugal, behind on the governance deadline, but each has engaged public consultation processes on the specific question of AI use by judicial and law enforcement authorities. Against this background, the Portuguese legislator’s silence on the procedural dimension is conspicuous.

The forthcoming national implementing framework should therefore address not only the designation of authorities and the architecture of administrative penalties — the current focus — but also the procedural conditions under which AI systems classified as high-risk under Annex III may be lawfully deployed within criminal proceedings. This includes rules on disclosure of technical documentation to the defence, on the admissibility and weight of algorithmic evidence, on the right to an independent technical examination, and on the articulation between the AI Act’s transparency obligations and the procedural guarantees derived from Articles 6 and 8 of the European Convention on Human Rights and Articles 47 and 48 of the Charter of Fundamental Rights of the European Union. Without such translation, the substantive guarantees of the AI Act risk remaining operative only in the administrative sphere, while the constitutional core of the criminal process continues to absorb algorithmic inputs whose epistemic status remains unexamined.