On-premise licence models continue to be used in Portugal where customers want greater operational control or have constraints that make cloud migration less attractive. This is most common in heavily regulated sectors, such as financial services, healthcare and the public sector, where customers may prefer to keep sensitive data and key systems within infrastructure they manage directly. Other drivers include latency, performance and integration requirements. Some organisations still rely on legacy systems that are costly or risky to move to a SaaS environment. Existing investment in data centres and hardware may also make an on-premise model commercially appealing. Customers may also perceive on-premise arrangements as giving them more influence over customisation, upgrade cycles and change control. 

By contrast, SaaS products are often standardised and supplied on less negotiable terms.

Suppliers usually frame suspension rights around situations where continued access would create payment, security, legal or operational risk. Common triggers include:

• non-payment, normally after a short cure period and sometimes following a staged approach from partial suspension to full suspension and termination;
• suspected misuse of the platform, security incidents, malware, credential compromise, denial-of-service attacks;
• breach of acceptable use policies, illegal content and infringement of third-party rights; and
• where required by law, by a regulator or by a competent authority.

Customers typically negotiate limits on these rights. They often seek prior notice where practicable, with suspension limited to the affected users or functionality, prompt reinstatement once the issue is resolved and, in SaaS contracts, access to data for export during the suspension period where technically feasible.

Audit rights are negotiated differently depending on whether the arrangement is on-premises, hosted or SaaS.

Customer Audit Rights

Customers often ask for audit rights covering licence use, information security (sometimes referencing standards such as ISO 27001 or SOC reports) and data protection. These may be exercised directly by the customer or through an independent auditor, usually subject to confidentiality, notice and frequency limits.

Supplier Audit Rights

Suppliers are more likely to request audit rights where the customer controls the deployment environment, particularly in on-premises licensing. Their focus is usually on over-deployment, unlicensed use, user limits, geographic restrictions and compliance with licence metrics.

Market Practice

In SaaS contracts, traditional on-site audits are less common. Parties more often rely on usage reports, self-certifications, security attestations and targeted audits where there is a specific compliance concern.

On-Premise Solutions

Escrow is still seen in Portugal for business-critical on-premises software, particularly where the customer depends heavily on the supplier for maintenance and support (eg, public sector and large corporates). Release triggers usually include supplier insolvency, prolonged failure to maintain the product or discontinuation without an adequate replacement or migration route.

SaaS Solutions

Escrow is less common and generally of more limited utility in a pure multi-tenant SaaS model because the customer normally cannot operate the service independently. The operational platform, infrastructure and service dependencies are often as important as the code itself.

For that reason, SaaS negotiations tend to focus instead on data export, transition assistance, business continuity, disaster recovery and advance notice of service discontinuation. Where escrow is included in a SaaS context, it is often limited to supporting materials, such as documentation, configuration information or container images that may assist with migration.

SaaS providers usually give commitments on availability, support and continuity. A typical Portuguese SaaS contract will include:

• an uptime commitment (commonly between 99.5–99.9% per month), subject to exclusions for scheduled maintenance and force majeure;
• incident response and resolution targets based on severity levels;
• support channels and escalation procedures;
• service credits as the primary remedy for missed service levels; and
• disaster recovery and business continuity commitments, including recovery time and recovery point objectives where the service is critical.

Customers also increasingly request clear rights to export their data in usable formats and assistance during exit or migration. This is particularly important for longer-term or business-critical SaaS arrangements.

Providers of AI solutions are mainly concerned with controlling risk in a fast-moving regulatory and technical environment. Their key concerns include the following.

• Liability exposure – providers are reluctant to accept uncapped liability for outcomes affected by customer instructions, poor data quality, misuse or model limitations.
• Regulatory compliance – the evolving and complex regulatory landscape, including the AI Act, GDPR, cybersecurity requirements and sector-specific rules, creates practical challenges in demonstrating compliance, including through documentation, testing, monitoring, human oversight and governance measures.
• Confidentiality and IP protection – providers need to protect model architecture, training data, prompts, evaluation methods and trade secrets while still giving customers enough information for due diligence and compliance.
• Data rights – providers often seek contractual rights to use data, particularly non-personal, aggregated or properly anonymised data, to improve services and develop models, while managing customer concerns about data use.
• Performance expectations – many AI systems cannot deliver complete accuracy or full explainability. Providers therefore try to avoid warranties that imply error-free performance or a level of transparency that the technology cannot realistically provide.

The provision of IT services in Portugal is affected by several horizontal regimes, depending on the nature of the service and the customer’s sector.

• Data protection – where the service involves personal data, the GDPR and Law No 58/2019 apply, including rules on lawful processing, security, data-processing agreements, sub-processing and breach notification.
• Cybersecurity – entities covered by Decree-Law No 125/2025 must adopt cybersecurity risk-management measures and address supply-chain risks, including risks arising from cloud, managed services and other IT suppliers.

Sector-specific rules may also apply. Telecoms, financial services, healthcare and public sector customers may be subject to additional requirements on availability, integrity, resilience, outsourcing and incident reporting.

Consumer protection rules are also relevant where IT services are supplied to consumers, particularly for conformity, remedies and pre-contractual information.

Typical Structure

Liability clauses in Portuguese IT services contracts usually combine a general cap with exclusions and specific carve-outs. The cap is often calculated by reference to fees paid or payable during a defined period, commonly 12 months. Contracts also frequently exclude loss of profits, loss of business, reputational damage and other indirect or consequential losses. Depending on the transaction, carve-outs may apply for wilful misconduct (dolo), death or personal injury, confidentiality breaches, data protection breaches and intellectual property infringement.

Mandatory Law Considerations

Contractual limitations cannot remove mandatory statutory liability. This is relevant, for example, in consumer contracts, product liability, data protection and cases involving wilful misconduct. Portuguese courts may also scrutinise clauses that are excessive or inconsistent with mandatory legal protections.

Negotiation Practice

More sophisticated contracts increasingly use tiered caps. A lower cap may apply to ordinary contractual breaches, while a higher cap applies to higher-risk areas such as data protection, cybersecurity or intellectual property indemnities.

Warranties in IT services contracts are usually tailored to the nature of the project, but several provisions are common. Suppliers are typically asked to warrant that:

• the services will be performed with reasonable skill and care;
• deliverables will materially conform to the agreed specifications and service levels;
• the services and deliverables will not infringe third-party intellectual property rights;
• the supplier will comply with applicable laws, including data protection and cybersecurity requirements; and
• the supplier has the rights, resources and authorisations needed to provide the services.

In consumer-facing arrangements, mandatory conformity rules under Decree-Law No 84/2021 limit the extent to which a supplier can disclaim or narrow statutory rights. Business-to-business contracts allow more flexibility, but customers will still often resist broad “as is” disclaimers for bespoke or critical services.

Agile contracting is increasingly used in Portugal for software development, digital transformation and systems integration projects, particularly where requirements are expected to evolve.

The usual structure is a framework agreement covering governance, pricing, intellectual property, confidentiality and liability, with statements of work, backlogs or sprint plans defining the work in more detail. These contracts require a different approach from traditional fixed-scope projects. They normally place greater emphasis on collaboration, prioritisation, change management and acceptance criteria, rather than on a complete specification agreed at the outset. Pricing is often based on time and materials, capacity or sprint-based fees, sometimes combined with milestone or quality controls.

Payment models vary according to the predictability of scope and the allocation of project risk. The most common models are:

• time and materials, used where the work is exploratory, advisory or agile and the scope may change;
• fixed price, used where deliverables are well defined and acceptance criteria can be agreed in advance;
• milestone-based payments, often linked to delivery, testing or acceptance stages;
• subscription fees, typical for SaaS and managed services; and
• hybrid or outcome-based models, combining fixed, variable and performance-related elements.

Public sector customers tend to prefer more predictable pricing structures, while private sector customers are generally more open to hybrid models where the commercial incentives are clear.

Portugal’s telecommunications framework is mainly based on two statutes.

• Law No 16/2022 is the Electronic Communications Law. It implements the European Electronic Communications Code and regulates electronic communications networks and services, including market entry, spectrum, numbering, end-user rights and universal service. Note that Decree-Law No 125/2025 has revoked certain provisions of Law No 16/2022 relating to security of networks and services, security incidents and related measures, with effect from 3 April 2026, although transitional provisions apply in relation to certain ANACOM acts;
• Law No 41/2004 addresses privacy in electronic communications. It implements the ePrivacy Directive and contains rules on confidentiality of communications, traffic and location data, cookies and unsolicited marketing communications.

Various ANACOM regulations, decisions and notices further develop technical and consumer-protection aspects, including accessibility requirements for end users with disabilities. Law No 16/2022 was also amended by Decree-Law No 5/2026.

ANACOM (Autoridade Nacional de Comunicações) is the main telecommunications regulator in Portugal. Its responsibilities include market access, spectrum and numbering management, competition issues, service quality and end-user rights under Law No 16/2022. ANACOM also has additional roles as Digital Services Co-ordinator under the DSA, as the relevant sectoral cybersecurity authority for electronic communications and postal services under the Decree-Law No 125/2025 regime, and as the authority designated in relation to supervision of fundamental-rights obligations for high-risk AI systems under the AI Act.

CNPD (Comissão Nacional de Proteção de Dados) supervises data protection and privacy issues in the electronic communications sector, including cookies, traffic data, location data and direct marketing.

Consumer protection authorities, including the Directorate-General for Consumers (Direção-Geral do Consumidor), may also intervene where telecoms contracts raise consumer law issues.

General Authorisation

Electronic communications networks and services are generally provided under a general authorisation regime. In practical terms, this means that a provider usually notifies ANACOM rather than applying for an individual licence before starting activity.

Spectrum and Numbering

This general rule does not apply in the same way to scarce public resources. Rights of use for radio spectrum and numbering resources require specific allocation and licensing procedures overseen by ANACOM.

Ongoing Obligations

Operators may also be subject to regulatory fees and sector contributions, including under Decree-Law No 114/2024. They must comply with obligations on access, interconnection, emergency services, universal service funding and end-user protection.

Interconnection

Interconnection is governed by Law No 16/2022, which implements the European Electronic Communications Code. Operators with significant market power may face specific access or interconnection obligations, including transparency, non-discrimination and cost-oriented pricing. ANACOM may impose, monitor and enforce these obligations, taking account of the relevant EU and BEREC framework.

Roaming

Roaming within the EEA is mainly governed by directly applicable EU rules. These rules underpin the “Roam Like at Home” framework and related retail price protections. ANACOM is responsible for monitoring and enforcing compliance in Portugal, including in relation to end-user complaints.

End-User Rights

Law No 16/2022 contains a detailed set of protections for end-users of electronic communications services. These include rules on pre-contractual information, contract summaries, tariff transparency, billing, quality of service, number portability, contract duration and contract changes. For consumer contracts, the maximum initial commitment period is generally 24 months, although shorter alternatives must be made available in certain circumstances. Consumers must also be informed in advance of contract changes and may terminate without penalty where the law so provides, particularly where changes are detrimental to them.

Online Termination

Portugal has introduced a central online platform for terminating or switching telecoms contracts, under Ministerial Order No 284/2022. This makes it easier for consumers to exercise termination rights and reduces practical barriers to switching providers.

These telecoms-specific rules operate alongside general consumer protection law and the unfair commercial practices regime.

Legal Framework

The CDADC protects works as intellectual creations and treats the author as the natural person who creates the work (criador intelectual da obra). Copyright therefore arises first with the human author, although economic rights may be assigned or licensed. Computer programs are protected under the specific software copyright regime in Decree-Law No 252/94, as amended, which gives them protection analogous to literary works.

Contractual Distinction

Technology contracts usually separate pre-existing rights from rights created during the project.

Background IP refers to rights, tools, know-how and materials that a party brings to the engagement.

Foreground IP refers to new software, documentation, configurations or other deliverables developed under the contract.

Each party normally keeps its own background IP and grants the other party only the licences needed for the project. Foreground IP is dealt with according to the commercial model: bespoke development is more likely to involve assignment to the customer, while platform, SaaS and configurable solutions more often involve a licence. Transfers of registered rights, such as trade marks or patents, may require additional formalities and registrations.

The intellectual property rights most often discussed in IT and technology contracts are:

• copyright, especially in software, source code, object code, documentation, interfaces and other written or visual materials;
• patents and utility models, mainly where the technology includes hardware, technical processes or software-implemented inventions;
• trade secrets and confidential know-how, protected through contract and the trade secrets regime introduced by Decree-Law No 110/2018;
• trade marks and domain names, particularly for branding, platforms and online services; and
• database rights, where the value lies in the investment made in obtaining, verifying or presenting data.

In SaaS and software projects, copyright and confidential know-how are usually the main focus. Patents become more relevant in hardware-heavy, life sciences, telecommunications and advanced manufacturing projects.

Portuguese technology contracts commonly allow suppliers to retain and re-use general know-how, techniques, methodologies and tools acquired or improved during a project. This is commercially important for suppliers, as it allows them to apply accumulated expertise across future engagements. That permission is usually limited by confidentiality and customer ownership provisions. Suppliers should not re-use customer-specific materials, proprietary data, business processes, branding or confidential information except where the contract expressly permits it.

This balance allows suppliers to build cumulative expertise and improve their offerings, while giving customers comfort that their proprietary data, business processes or branding will not be replicated for competitors. The distinction is consistent with Portuguese IP principles: copyright protects concrete expression, not abstract ideas, methods or general skills. Similarly, trade secrets protection does not normally prevent a professional from using general experience and expertise acquired lawfully.

Patent disputes in Portugal remain less common than in larger European jurisdictions, although patent awareness has grown in sectors such as pharmaceuticals, life sciences, telecoms and high-tech manufacturing. The Unified Patent Court and the European patent with unitary effect have also increased the strategic importance of patent issues for Portuguese businesses operating across Europe.

In software and IT contracts, however, parties still tend to focus more on copyright, trade secrets and contractual restrictions than on patents. Patent indemnities are nonetheless often included where the supplier provides hardware, embedded technology or standardised software that may be used in several jurisdictions. Portugal is not generally seen as a major forum for patent assertion entity activity, but cross-border patent risk is increasingly taken into account in larger technology transactions.

Human Authorship Requirement

Portuguese copyright law has no special rule for AI-generated works. The CDADC is based on the idea that a protected work is an intellectual creation and that the author is the human creator of that work. For that reason, the prevailing view is that output generated autonomously by AI, without meaningful human creative input, is unlikely to be protected by copyright.

AI as a Tool

The analysis is different where AI is used as an instrument in a broader human creative process. If a person makes creative choices in selecting, prompting, arranging, editing or refining the output, the final result may still be protected, provided it reflects that person’s own intellectual creation. This approach is consistent with the Court of Justice of the European Union’s emphasis on originality as the author’s own intellectual creation.

Contractual Solutions

Because the statutory position is still uncertain at the margins, parties increasingly address AI-assisted outputs in their contracts. They typically specify who may use the output, whether rights are assigned or licensed, and whether any warranty is given as to originality, non-infringement or lawful use of training data.

The main Portuguese and EU instruments in this area are:

• the GDPR, which is directly applicable and sets the core rules on lawful processing, data subject rights, security, accountability and international transfers;
• Law No 58/2019, which supplements the GDPR in Portugal, including by designating CNPD as the supervisory authority and setting national rules such as the age of consent for information society services at 13;
• Law No 41/2004, which deals with privacy in electronic communications, including cookies, traffic and location data and unsolicited marketing;
• Decree-Law No 125/2025, which transposes NIS2 and imposes cybersecurity risk-management and incident-notification duties on essential and important entities. The regime entered into force on 3 April 2026, and the implementing Regulation No 756/2026, published on 22 June 2026, should be checked for operational details, including notification forms and platform requirements; and
• Law No 73/2025, which adapts Portuguese law to DORA for the financial sector. DORA has been directly applicable since 17 January 2025. The Banco de Portugal, CMVM and ASF are the competent authorities within their respective supervisory perimeters, and financial entities must maintain registers of ICT third-party agreements and report severe ICT incidents under the DORA framework.

Together, these regimes create overlapping obligations on data protection, information security, cybersecurity governance, supply-chain risk and incident reporting.

Personal Data Transfers

The GDPR restricts transfers of personal data from Portugal to third countries or international organisations unless the conditions in Chapter V are met. Transfers are typically allowed where there is an adequacy decision for the destination country, or where the controller or processor has provided appropriate safeguards (such as standard contractual clauses or binding corporate rules), in the absence of such a decision.

In situations where there is no adequacy decision nor appropriate safeguards, Article 49 GDPR allows transfers only under specific derogations, such as explicit informed consent of the data subject, necessity for the performance of a contract, important reasons of public interest, legal claims, vital interests or from a public register.

Non-Personal Data

There is no equivalent general restriction on transfers of non-personal data. However, sectoral confidentiality rules, trade secrets, export control requirements or contractual restrictions may still be relevant, depending on the type of data and the sector involved.

Portuguese law generally requires risk-based security rather than adherence to one mandatory technical standard.

Under the GDPR, controllers and processors must implement appropriate technical and organisational measures.

For entities covered by Decree-Law No 125/2025, which entered into force on 3 April 2026, the cybersecurity regime requires risk-based technical, operational and organisational measures and takes into account a national cybersecurity reference framework. The implementing Regulation No 756/2026, published on 22 June 2026, should also be checked for operational details before finalising incident reporting and platform references.

Sectoral regulators may recommend or expect adherence to recognised standards (eg, ISO 27001, NIST, or CSA CCM) as evidence of best practice, but these standards are typically not expressly mandated by legislation.

GDPR Breach Notification

Where a personal data breach occurs, the controller must notify CNPD without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to create risk for individuals. Processors must notify the controller without undue delay. If the breach is likely to result in a high risk to individuals, the controller may also need to notify the affected data subjects.

Cybersecurity Incident Notification

Entities within the scope of Decree-Law No 125/2025 are subject to a separate notification regime for significant cybersecurity incidents to the competent cybersecurity authority (CNCS). The process is phased and may include an initial notification within 24 hours, an update within 72 hours where relevant, a notification of the end of the significant impact and a final report within the applicable statutory deadline, generally 30 business days after notification of the end of the significant impact.

Telecoms providers may also have to notify ANACOM of significant network security or integrity incidents under sector-specific rules, with short-phased notification deadlines. If personal data is affected, CNPD notification may also be required.

Customer and Supplier Roles

The legal duty to notify usually sits with the data controller, the telecoms operator or the essential or important entity. In contracts, however, customers typically require suppliers to notify them quickly, provide technical information and assist with investigation, mitigation and regulatory reporting.

Portuguese AI regulation is likely to develop mainly through implementation of the AI Act rather than through a separate national AI code. The immediate focus should be institutional: designating competent authorities, creating supervisory capacity and, where appropriate, developing regulatory sandboxes and sector-specific guidance. Further changes are also expected in adjacent areas. Product safety, product liability, consumer protection, data protection and employment rules may all need to be applied or adapted to AI-related risks, particularly in credit scoring, healthcare, recruitment, workplace monitoring and critical infrastructure.

At EU level, the proposed AI Liability Directive has been withdrawn. The principal EU-level liability development is now the revised Product Liability Directive – Directive (EU) 2024/2853 – which modernises the product-liability regime by expressly bringing software, including AI systems, and digital manufacturing files within scope. Portugal will need to transpose the Directive by 9 December 2026.

Cybersecurity will also become more closely linked to AI regulation, as AI tools are increasingly used both to launch and to defend against cyber-attacks.

Contract drafting in Portuguese IT, cloud and AI projects has become more detailed and risk based. Several developments are now common in the market:

• data-processing agreements are usually more comprehensive and are often accompanied by separate security schedules;
• security clauses increasingly refer to recognised standards or frameworks, including ISO 27001 and CNCS guidance;
• AI provisions are now appearing in procurement documents, especially around training data, transparency, human oversight and regulatory change;
• liability clauses more often use different caps for different types of risk; and
• exit, portability and interoperability clauses are receiving more attention in cloud and SaaS contracts.

The EU Data Act must be taken into account, particularly in relation to switching, access to data and interoperability in cloud and data-driven services.

Hyperscalers have materially influenced technology contract negotiations in Portugal. Their standard cloud contracts, which are often offered on largely non-negotiable terms, set a de facto benchmark for market expectations, especially regarding availability commitments, data protection measures and security certifications.

At the same time, customers often have limited ability to negotiate core risk provisions with major cloud providers. Liability caps, audit rights, unilateral service changes and standard security terms are frequently presented on a take-it-or-leave-it basis, although large enterprise customers and public sector customers may obtain specific addenda or tailored commitments.

This affects negotiations with smaller vendors. Customers may ask local or smaller providers to match hyperscaler-style security and resilience standards, even where those providers cannot offer the same scale, infrastructure or pricing model. The result is a market in which hyperscaler terms often set expectations, but not always realistic benchmarks for all suppliers.

Traditional intellectual property concepts still apply to current technologies, but they do not always map neatly onto AI, big data, cloud computing or open-source software. Portuguese and EU law remain based on familiar categories such as copyright, patents, trade secrets, database rights and contractual licences.

Practical Adaptations

In practice, parties use contracts to fill many of the gaps. They allocate rights in outputs, restrict use of confidential information, regulate access to data, define permitted use of open-source components and clarify ownership of configurations, prompts, documentation and deliverables. AI creates particular difficulty because Portuguese copyright law is built around human authorship. The EU text and data mining exceptions, transposed into the CDADC, are also relevant to AI training, particularly in relation to rights reservations by rights-holders and the distinction between scientific research and other text and data mining uses.

Future Developments

Further clarification may be needed on AI-generated works, data access, model training and the relationship between copyright, trade secrets and transparency. Until then, Portuguese practitioners are likely to continue relying heavily on contract drafting to manage issues that legislation has not yet resolved.