Life Sciences 2025
Portugal
Authors
PLMJ is a law firm based in Portugal that combines full service with bespoke legal craftsmanship. For more than 50 years, the firm has supported clients in all areas of the law, often with multidisciplinary teams and always acting as a business partner in the most strategic decision-making processes. PLMJ has specialist lawyers who know the sectors and markets in which they work well and keep close contact with the regulators for each sector. The firm created PLMJ Colab, a collaborative network of law firms spread across Portugal and other countries with which it has cultural and strategic ties. PLMJ Colab makes the best use of resources and provides a bespoke response to clients’ international challenges. International co-operation is ensured through firms specialising in the legal systems and local cultures of Angola, Cabo Verde, China/Macau, Guinea-Bissau, Mozambique, São Tomé and Príncipe, and Timor-Leste.
1. Life Sciences Regulatory Framework
1.1 Legislation and Regulation for Pharmaceuticals and Medical Devices
The rules on medicines for human use come from Decree-Law 176/2006 of 30 August 2006, while the rules on medical devices come from Decree-Law 189/2000 of 12 August, Decree-Law 145/2009 of 17 June, Decree-Law 29/2024 of 5 April, Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 (the Medical Devices Regulation – MDR) and Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 (In Vitro Medical Devices Regulation – IVMDR). There are also several sets of regulations that implement decree laws in different matters.
The regulatory body that applies and enforces pharmaceutical and medical device regulation is INFARMED (the National Authority of Medicines and Health Products, IP), which is part of the State’s indirect administration and is endowed with administrative and financial autonomy. It is responsible for carrying out the responsibilities of the Ministry of Health under the supervision and guidance of the Minister of Health.
As a rule, the Minister of Health takes decisions regarding expenditure on medicines and medical devices, who may delegate these decisions to INFARMED.
1.2 Challenging Decisions of Regulatory Bodies That Enforce Pharmaceuticals and Medical Devices Regulation
INFARMED’s decisions regarding medicines and medical devices may be challenged through administrative and/or judicial channels within a given period.
Individuals and entities affected by these decisions can react against them, mainly on the grounds of breach of the law. These means of reaction are common to decisions that affect other products (eg, food supplements and cosmetics), although there may be specific details.
1.3 Different Categories of Pharmaceuticals and Medical Devices
Certain categories of medicines and medical devices are subject to specific regulations. As an example, medicines containing psychotropic and narcotic substances are regulated by Decree-Law 15/93 of 22 January 2022, Decree-Regulation 61/94 of 12 October 1994, Law 33/2018 of 18 July 2018 and Decree-Law 8/2019 of 15 January.
2. Clinical Trials
2.1 Regulation of Clinical Trials
Different pieces of legislation regulate clinical trials of medicines and clinical studies of medical devices.
Medicines
Regulation regulates clinical trials of medicines (EU) 536/2014 of the European Parliament and of the Council of 16 April 2014 (“Clinical Trials Regulation”) and Law 21/2014 of 16 April 2014 (“Clinical Trials Law”).
The entry into force of the Clinical Trials Regulation on 31 January 2022 involved the entry into force of the Clinical Trials Information System (CTIS), through which all clinical trial submission, assessment and supervision processes in the EU are to be submitted. The three-year transition period provided by the Clinical Trials Regulation has elapsed on 31 January 2025, after which all ongoing trials will have to be transferred to the CTIS under the Clinical Trials Regulation.
Medical Devices
The rules regarding clinical studies of medical devices are found in Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices and in DL 29/2024, implementing MDR in Portugal.
In Vitro Medical Devices
The legal rules applicable to clinical studies of in vitro medical devices are established in Regulation (EU) 2017/746 of the European Parliament and of the Council of 5 April 2017 on in vitro diagnostic medical devices (IVDR) and in the Clinical Trials Law.
2.2 Procedure for Securing Authorisation to Undertake a Clinical Trial
Medicines
Since 31 January 2025, authorisation to conduct a clinical trial of medicine needs to be obtained through the CTIS, pursuant to the Clinical Trials Regulation.
Applications for clinical trials in the EU and the European Economic Area must be submitted under the CTIS, under the terms provided by Regulation (EU) 536/2014 of the European Parliament and of the Council of 16 April 2014 on clinical trials of medicinal products for human use. In this case, applications must be submitted through the CTIS, and the sponsor should propose a reporting member state that will be responsible for the analysis of the application.
Medical Devices
Applications to conduct clinical investigations as defined in the MDR must be submitted by the sponsor to the member state(s) where the clinical investigation will be conducted. The application must be submitted through the electronic system referred to in the MDR, accompanied by the documents referred to in Chapter II of Annex XV of the MDR.
2.3 Public Availability of the Conduct of a Clinical Trial
Clinical trials of medicines and clinical studies of medical devices are available on the National Clinical Trials Register website at www.rnec.pt. The results of clinical trials and clinical studies of medical devices are not available in publicly accessible databases.
2.4 Restriction on Using Online Tools to Support Clinical Trials
The recruitment methods for clinical trials of medicines and clinical studies of medical devices must follow the legally prescribed rules. In addition to physical advertising methods, digital means can be used for this purpose. These means may also be used for monitoring purposes, provided that they do not jeopardise the purpose and safety of the trial.
2.5 Use of Data Resulting From Clinical Trials
Data from clinical trials of medicines and clinical studies of medical devices may qualify as personal data in the sense of sensitive data. However, if the data is fully anonymised (and not merely pseudonymised), it is no longer personal data, and subsequently, it does not fall within the category of sensitive data. Anonymisation implies that the data subject’s identity is unobtainable, which makes the data anonymous.
If the data resulting from processing is still classified as personal data, it may be shared with third parties or affiliates. However, this transfer must adhere to the requirements of the General Data Protection Regulation (GDPR). This includes obtaining consent, fulfilling information obligations, ensuring the security of the processing, establishing joint controllership or sub-processing agreements, and complying with regulations regarding international data transfers. If the resulting data is anonymised, then those GDPR requirements do not apply.
2.6 Databases Containing Personal or Sensitive Data
The GDPR requirements regarding the processing of health data apply to the grounds for the lawfulness of processing, transparency, and security measures.
3. Marketing Authorisations for Pharmaceuticals or Medical Devices
3.1 Product Classification: Pharmaceuticals or Medical Devices
Products are classified through the definition of medicine (function and/or presentation) and the definition of medical device provided in the applicable legal provisions. In the case of borderline products, the purpose intended by the manufacturer of the product in question and the mechanism through which the main desired effect is achieved is considered.
3.2 Granting a Marketing Authorisation for Biologic Medicinal Products
Medicines developed by means of one of the following biotechnological processes must be subjected to the centralised community procedure:
- recombinant DNA technology;
- controlled expression of genes coding for biologically active proteins in prokaryotes and eukaryotes, including transformed mammalian cells; and
- hybridoma and monoclonal antibody methods.
3.3 Period of Validity for Marketing Authorisation for Pharmaceuticals or Medical Devices
Medicines
In the case of medicines, the MA is valid for five years; after the first renewal, it is valid indefinitely or, if considered necessary, for a second five-year period. The renewal of the MA is subject to a specific renewal procedure.
An MA may be revoked, suspended or amended whenever there is non-compliance with the applicable legal and regulatory provisions or with the conditions of the MA in question. This includes when it is concluded that the risk-benefit balance is unfavourable, the medicine is harmful or the manufacturing process does not comply with the applicable good practices.
Medical Devices
No authorisation is required to place medical devices on the market. The manufacturer must submit the medical device to a conformity assessment and notify the competent authority that the medical device has been made available on the market. INFARMED may withdraw a product from the market or may suspend, restrict or subject to certain conditions the placing on the market and putting into service of a device or group of medical devices under certain conditions – namely when the use of medical devices could compromise the health and safety of patients or other persons, or for public health reasons.
3.4 Procedure for Obtaining a Marketing Authorisation for Pharmaceuticals and Medical Devices
The marketing of a medicine may follow one of these procedures:
- a national procedure, if the medicine is intended to be approved only for placing on the Portuguese market;
- a mutual recognition procedure, in which an authorisation obtained in a member state is used to apply for authorisation in a new member state;
- a decentralised procedure, when the application is submitted in several member states simultaneously and when the medicine does not have an MA in any member state; and
- a centralised procedure, managed by the European Medicines Agency (EMA), leading to an MA that is valid in all member states.
Any change in the terms of an MA must be subject to an application for a variation of the MA, including changes to the summary of product characteristics and any conditions, obligations or restrictions affecting the MA or changes to the labelling or package leaflet in connection with changes to the summary of product characteristics.
An MA may be transferred to a new holder by submitting a transfer application by the MA holder.
The placement of a medical device on the market does not require authorisation (see 3.3 Period of Validity for Marketing Authorisation for Pharmaceutical or Medical Devices).
3.5 Access to Pharmaceuticals and Medical Devices Without Marketing Authorisations
Medicines without an MA or without an MA that is valid in Portugal may be made available to patients through the exceptional use authorisation, under which patients can access them through early access programmes, which have a specific regulation issued by INFARMED.
Regarding medical devices, INFARMED may authorise the placing on the market or putting into service of a medical device for which no conformity assessment procedures have been carried out but the use of which is in the interest of public health or patient safety or health.
Compassionate use also takes place in the context of clinical trials.
3.6 Marketing Authorisations for Pharmaceuticals and Medical Devices: Ongoing Obligations
The MA for a medicine may be granted subject to the subsequent conduct of additional studies or compliance with special rules regarding safety and the reporting of all incidents associated with the use of the medicine and the measures to be taken, the conduct of a post-authorisation safety or efficacy study, or the fulfilment of other obligations established by INFARMED.
After the granting of an MA, INFARMED may require its holder to conduct a post-authorisation safety study if there are doubts about the risks of the authorised medicine or if knowledge about the disease or clinical methodology indicates that previous efficacy evaluations may need to be significantly revised.
The holder of an MA is obliged to comply with the obligations provided for by law – namely, to comply with pharmacovigilance obligations and to make this or other data proving that the benefit-risk relationship of the medicine remains favourable available to INFARMED.
Manufacturers of medical devices other than investigational devices must report any field safety corrective action to INFARMED, as well as any serious incident or any statistically significant increase in the frequency or severity of incidents that are not serious incidents or that are expected to have undesirable side effects that could have a significant impact on the benefit-risk analysis, and which have led or may lead to unacceptable risks to the health or safety of patients, users or other persons.
3.7 Third-Party Access to Pending Applications for Marketing Authorisations for Pharmaceuticals and Medical Devices
INFARMED publishes information on the status of an MA application and its assessment report on its website. It suppresses any commercially confidential information and allows access to the summary of product characteristics, the package leaflet, and information on the medical devices placed on the market.
4. Regulatory Reliance and Fast Track Registration Routes
4.1 Fast Track Registration Routes
Fast-track procedures for the registration of medicines and medical devices may be created and applied in very specific circumstances, such as those caused by the COVID-19 pandemic. However, the Portuguese regulatory framework does not generally provide for a specific fast-track mechanism for the registration of medicines and medical devices.
In the case of medicines, the applicant may submit a reasoned request for the accelerated assessment procedure, which reduces the assessment period of the application, based on a major public health interest, in particular from the perspective of therapeutic innovation, as provided for in Regulation (EC) 726/2004 of the European Parliament and of the Council of 31 March 2004.
4.2 Regulatory Reliance
INFARMED has not issued authorisations based on specific Portuguese regulatory reliance rules. Nevertheless, as an EU member, Portugal is covered by the mutual recognition agreements between EU and third-country authorities concerning the conformity assessment of regulated products. Such agreements contain a sectoral annex on the mutual recognition of good manufacturing practice inspections and batch certification of human and veterinary medicines.
5. Manufacturing of Pharmaceuticals and Medical Devices
5.1 Requirement for Authorisation for Manufacturing Plants of Pharmaceuticals and Medical Devices
The manufacture of medicines, experimental medicines and medical devices requires authorisation from INFARMED.
The manufacture of medicines requires the existence of facilities licensed for the purpose and compliance with good manufacturing practices. The facilities are subject to periodic inspections by INFARMED, which certifies their compliance and issues a certificate of good manufacturing practices, valid for three years.
For medical devices, facilities must obtain an industrial activity licence in accordance with the applicable legislation and have an industrial activity code associated with the categories of medical devices produced in conjunction with the respective manufacturing activities performed.
6. Distribution of Pharmaceuticals and Medical Devices
6.1 Wholesale of Pharmaceuticals and Medical Devices
INFARMED issues authorisation for the wholesale of medicines. It covers supplying, holding, storing, or delivering medicines for processing, resale, or use in medical services, healthcare facilities, and pharmacies, excluding the supply to the public. It specifies the facilities from which distribution is carried out and is subject to the validity of the certificate of good distribution practices, which must be renewed every five years.
The wholesale of medical devices is subject to prior notification to INFARMED. It covers supplying, holding, storing or supplying medical devices for resale or use in medical services, healthcare facilities, pharmacies and other points of sale to the public, excluding supply to the public.
6.2 Different Classifications Applicable to Pharmaceuticals
For dispensing to the public, medicines are classified into prescription-only medicines (MSRMs) and non-prescription medicines (MNSRMs). The former can also be classified as renewable, special or for restricted use in specialised monitored conditions, and the latter as MNSRMs for dispensing only in pharmacies.
7. Import and Export of Pharmaceuticals and Medical Devices
7.1 Governing Law for the Import and Export of Pharmaceuticals and Medical Devices and Relevant Enforcement Bodies
The import and export of medicines is regulated by Decree-Law 176/2006 of 30 August 2006 and by related legislation on good practice in transportation and distribution. The MDR and Decree-Law 29/2024 apply to medical devices.
INFARMED is the entity responsible for monitoring compliance with these regulations.
7.2 Importer of Record of Pharmaceuticals and Medical Devices
Any natural or legal person can be an importer of medicines and medical devices if they are duly authorised and licensed for that purpose by INFARMED.
7.3 Prior Authorisations for the Import of Pharmaceuticals and Medical Devices
The import and export of medicines and medical devices require the economic operator to be licensed by INFARMED for that purpose. For personal use, medicines can be transported only for the necessary period, provided that they are accompanied by a medical prescription, when necessary. In the case of emergencies or donations, INFARMED will assess each case individually.
7.4 Non-Tariff Regulations and Restrictions Imposed Upon Imports
The following regulations are to be considered upon the importation of any products into the Portuguese territory, which is part of the customs territory of the European Union:
- Regulation (EU) 952/2013 of the European Parliament and of the Council of 9 October 2013, which approves the Union Customs Code;
- Commission Delegated Regulation (EU) 2015/2446 of 28 July 2015; and
- Commission Implementing Regulation (EU) 2015/2447 of 24 November 2015.
7.5 Trade Blocs and Free Trade Agreements
Portugal is part of the EU and a single European market. It applies the principle of free movement of goods and services and has harmonised regulatory rules for medicines and medical devices.
8. Pharmaceutical and Medical Device Pricing and Reimbursement
8.1 Price Control for Pharmaceuticals and Medical Devices
Price Control for Medicines
Non-reimbursed medicines have free pricing arrangements, but all other medicines are regulated and subject to maximum price rules or notified price rules. They cannot be sold unless the MA holder obtains a retail price (RP).
The RP of the medicine is composed of:
- the ex-factory price (EFP), which is the maximum price at the stage of production or import and has fixed rules for its determination;
- the wholesalers’ and retailers’ selling margins, as fixed by ministerial order;
- the tax on the sale of medicines; and
- value-added tax (VAT).
MSRMs intended to be dispensed and used in National Health Service (NHS) establishments are also subject to maximum price rules. Their final price is composed of the EFP, the sales tax, and the VAT.
The prices of medicines subject to the maximum price rules are reviewed annually. The pricing rules for medicines are set out in Decree-Law 97/2015 of 1 June 2015 and regulated by several Ministerial Orders (in particular, Ministerial Order 195-C/2015 of 30 June 2015 and Ministerial Order 154/2016 of 27 May 2016).
Requests for price authorisation and price revision communications follow their own procedures and are submitted to INFARMED by the MA holder.
Price Control for Medical Devices
As a rule, medical devices financed by the State have fixed maximum prices. Medical devices not financed by the State have free pricing.
The pricing rules for medical devices are set out in Decree-Law 97/2015 of 1 June 2015, and there are Ministerial Orders that define the maximum prices applicable to certain devices or groups of medical devices, which usually include the marketing margins and VAT. In these cases, the RP proposed is indicated by the manufacturer at the time of the request for reimbursement to INFARMED, which follows its own procedure.
8.2 Price Levels of Pharmaceuticals or Medical Devices
Medicines
The price of medicines is generally set and reviewed based on the prices in the reference countries with comparable GDP per capita or lowest price level, which are defined annually among EU countries.
Ministerial Order 293/2024/1 of 15 November has defined Spain, France, Italy and Belgium as reference countries in 2025.
Medical Devices
Medical device prices do not depend on the prices applied in other countries.
8.3 Pharmaceuticals and Medical Devices: Reimbursement From Public Funds
Public financing of medicines and medical devices depends on an application to INFARMED by the MA holder or the manufacturer, respectively. This public financing may be full or partial and differs according to various factors, such as pathologies or special groups of patients, therapeutic indications, the prevalence of certain diseases in the population, etc (see 8.4 Cost-Benefit Analyses for Pharmaceuticals and Medical Devices).
8.4 Cost-Benefit Analyses for Pharmaceuticals and Medical Devices
Medicines
As a rule, State funding of medicines is cumulatively subject to prior technical-scientific demonstration of therapeutic innovation or equivalence for the therapeutic indications claimed, as well as demonstration of the economic advantage of the medicine. These factors are not decisive in fixing the price of medicines, given that these prices tend to be fixed, taking into account the prices in the reference countries – see 8.1 Price Control for Pharmaceuticals and Medical Devices and 8.2 Price Levels of Pharmaceuticals or Medical Devices.
Medical Devices
A cost-benefit analysis is also carried out in the financing of medical devices by the State, considering the therapeutic innovation demonstrated for the clinical purposes claimed and the demonstration of an economic advantage – see 8.1 Price Control for Pharmaceuticals and Medical Devices.
8.5 Regulation of Prescriptions and Dispensing by Pharmacies
In order to ensure the sustainability of the NHS, the prescribing of reimbursed medicines is made using the international non-proprietary name and may only include the commercial name of the medicines in the exceptional cases listed in the law. Pharmacies must inform the patient about the medicine that, in compliance with the prescription, has the lowest price. These rules apply to reimbursed medical devices with the necessary adaptations.
PLMJ
Av Fontes Pereira de Melo 43
1050-119
Lisboa
Portugal
+351 213 197 300
+351 213 197 400
plmjlaw@plmj.pt www.plmj.com/en
Trends and Developments
Authors
Eversheds Sutherland is an innovative, international, multidisciplinary firm with more than 30 years of experience. The firm has approximately 80 professionals and 22 partners, with three offices in Portugal (Lisbon, Oporto and Faro) that collaborate closely with EVC Advogados/Eversheds Sutherland in Angola and AG Advogados/Eversheds Sutherland in Mozambique. The life sciences team provides comprehensive legal support beyond technical aspects, working closely with clients’ regulatory departments. Eversheds Sutherland advises on agreements with public entities and patient associations, compliance with industry and ethical codes, SOPs, clinical trials (including GDPR and insurance matters), sponsorships, transparency disclosures and pharmacovigilance. The firm’s expertise extends to OTC launches, food supplements, medical devices, product labelling, advertising claims, prize promotions and compliance with MedTech and EFPIA ethical codes. With deep industry knowledge, Eversheds Sutherland provides strategic, tailored guidance for its clients in all life sciences regulatory and commercial matters.
Upcoming Challenges for Life Sciences in an Ever-Changing World
The world is constantly changing, and the law is no exception. In a society where innovation and technology are the watchwords, there is an increasing need for the law to keep up with developments, particularly in the area of health.
The challenges are manifold: technological advances occurring at breakneck speed, regulatory changes and the increase in cyberthreats are just some of the issues in the healthcare and pharmaceutical sectors. It is crucial to address these fundamental issues in order to strike a balance between patient access to innovative health technologies and safe and ethical promotion of sustainable of health systems.
The future of medicine and artificial intelligence
It is impossible to talk about challenges and not mention artificial intelligence (AI). We are witnessing a revolution in various industry sectors owing to AI, with life sciences being one of the most exciting in this respect.
AI could play a role in drug discoveries, improvements in disease diagnosis, clinical research, support for patient care during treatment and even increased productivity when carrying out administrative tasks. However, although AI is here to stay, concerns remain. The increased use of AI raises both ethical and legal questions, which explains why the European Union has attempted to regulate this new technology, albeit with some difficulties.
Currently, AI is notoriously flawed. We know that it is biased, can have hallucinations, makes classification or prediction errors, provides allegedly reliable results based on non-existent sources and is characterised by a lack of transparency regarding its design, development, evaluation and use. Questions also arise about how to determine responsibility when AI makes mistakes. Is the system itself to blame, or is it the person who developed the software, the health professional accompanying the patient or even the healthcare institution?
The European Union has endeavoured to address these issues, notably through the AI Act (Regulation (EU) 2024/1689), which applies risk-based regulatory frameworks to AI applications – ie, it provides for a uniform legal regime for developing AI and placing it on the market, and for putting AI systems into service and use in Europe, using a classification based on the risks posed to citizens’ health, safety and/or fundamental rights.
The law classifies AI systems used in critical infrastructure that could jeopardise the lives and health of citizens as high risk; therefore, such systems are subject to a set of strict requirements that must be met before they can be used.
In this context, Serviços Partilhados do Ministério da Saúde, EPE (SPMS) published a white paper entitled Inteligência Artificial na Saúde em Portugal: Regulamentação, Impactos e Perspetivas de Futuro (Artificial Intelligence in Health in Portugal: Regulations, Impacts and Future Prospects) in February 2025, providing a glimpse of the state of the art in Portugal in the use of AI technologies, as well as some recommendations and good practices identified as important for the application of AI solutions in the healthcare area.
Furthermore, as a rule, the use of AI in the health sector involves the processing of a special category of data: “sensitive” health data. Therefore, now more than ever, compliance with the rules of the General Data Protection Regulation (GDPR) is essential, particularly with regard to the rules on data minimisation, obtaining unequivocal consent from the data subject for the processing of data as required, automated profiling – which, because sensitive data is involved, requires that appropriate measures be applied to safeguard the rights and freedoms and legitimate interests of the data subject – and the international transfer of data. Accordingly, it is necessary to ensure that those who develop AI solutions, as well as the health institutions themselves, implement systems to guarantee compliance with the legislation, not least because in Portugal the national supervisory authority, the National Data Protection Commission (Comissão Nacional de Protecção de Dados; CNPD), is increasingly vigilant; fines of up to EUR20 million or 4% of worldwide annual turnover, whichever is higher, can be imposed for violating the GDPR.
Alongside the aforementioned AI Act, the Council of the European Union adopted the Regulation on the European Health Data Space (the “EHDS Regulation”), which aims to improve people’s access to and control over their personal electronic health data, facilitating the international exchange of health data between health service providers located in various member states. The EHDS Regulation distinguishes two health data infrastructures: primary use of data (clinical context) and secondary use of data (for research, decision-making, etc).
With the application of the EHDS Regulation, it is expected that people will have easier access to their electronic health data, regardless of where they are located (ie, in their country of origin or in any other member state). Therefore, each country in the European Union will have to designate at least one e-health authority, which will be responsible for implementing these new provisions.
The interoperability of data is also fundamental to the quality of AI, since the higher the quality of the data used to train AI systems, the more likely it is that the algorithms will provide accurate and reliable results. A structured, organised and accurate database will give AI systems greater capacity for analysis, reducing the risk of biased decisions and gross errors in healthcare.
In Portugal, Order No 3030/2025 of 7 March designated the SPMS as the entity responsible for co-ordinating the preparatory work for the implementation of the EHDS Regulation. As such, the SPMS will co-ordinate an interdisciplinary working group to monitor and follow up the implementation and development of electronic health record systems, in line with European guidelines.
Electronic health record systems are essential if the EHDS Regulation is to be implemented effectively in Portugal, bearing in mind that citizens’ health information not only includes that which is collected and used within the scope of the National Health Service (NHS), but also that collected in other sectors. As such electronic health records must be operationalised for health operators in all sectors that keep electronic clinical records.
Although the EHDS Regulation is ambitious and has the positive aim of promoting a true single market for electronic health record systems, it does present some obstacles that the companies to which it applies must be aware of. As well as intellectual property, sensitive commercial information is at stake, so it is of great importance for the organisations concerned to adapt accordingly.
More recently, after a period in which various European laws were published, and in contrast to other major world powers such as the United States of America, the European Union apparently realised that there was a need to slow down its regulatory activities.
Notwithstanding its virtues and legitimate objectives, it is clear that the proliferation of European legislation has disincentivised innovation in some sectors, as well as investment and the deployment of venture capital, due to the number of requirements and demands imposed on companies and technology creators. For many observers, Europe now seems to be trying to find a middle ground, promoting the updating of legislation while not jeopardising change and innovation.
Cybersecurity
Attacks on hospital computer systems, data breaches and medical device hacking are all threats that healthcare organisations must be increasingly careful about and prepared for. The concern should not be if they will be attacked, but rather when they will be attacked, since it is impossible to completely eliminate the risk of all possible types of attacks in the face of asset vulnerabilities, no matter how robust the information security system.
With this in mind, the regulatory power of the European Union will again play a key role, highlighting the importance of Directive (EU) 2022/2555 – commonly referred to as Network and Information Security Directive 2 (NIS2) or Security of Network and Information Systems 2 (SRI2), to use the nomenclature of the National Cybersecurity Centre – which introduces more stringent cybersecurity requirements for the life sciences sector.
NIS2 has changed the cybersecurity paradigm, widening the scope of application of Directive (EU) 2016/1148 – also called the Network and Information Security (NIS) Directive (now NIS1 or SRI1) – to healthcare providers, manufacturers of medical devices and entities that carry out research and development activities for medicines as “essential entities” or “important entities”. Organisations identified as such must ensure that improved cybersecurity measures are in place, carry out risk assessments and ensure that any cybersecurity incidents are reported within 24 hours.
If organisations fail to comply with the NIS2 standards, fines of up to EUR10 million euros or 2% of the annual worldwide turnover, whichever is higher, can be imposed.
In Portugal, as in several other European Union countries, the deadline for transposing NIS2 has long since passed. However, the Portuguese government presented a draft law to transpose the Directive – which was subject to public consultation during December 2024, leading to its revision and the presentation of a new draft law – with a vote on the approval of this second law by the Assembly of the Republic scheduled for 20 March 2025; this would give the government the power to pass the transposition law.
However, because Portugal will hold an election again on 18 May 2025, the vote has been withdrawn, and the transposition of NIS2 will thus occur during the next parliamentary term. At the moment, it is not known when the Directive will be transposed, and it is possible that the European Union will impose sanctions because of the delay in transposition.
Despite this legislative delay in Portugal, companies and public organisations to which NIS2 applies should start preparing for its application. Healthcare providers, manufacturers of medical devices and organisations carrying out research and development activities in relation to medicines – and which, due to their size and turnover, will be required to comply with NIS2 – should implement robust information security systems.
Alongside NIS2, and reflecting the European Union’s concern, in January this year the European Commission presented an action plan aimed at strengthening cybersecurity for hospitals and healthcare providers. The European Union intends to give high priority to this plan, as it is a fundamental step towards protecting the health sector from the various cyberthreats.
The European Union is sensitive to the issues that digitalisation can cause, showing awareness that cyberattacks can delay medical procedures, create bottlenecks in emergency rooms and disrupt vital services that, in serious cases, can have a direct impact on the lives of Europeans. Accordingly, the action plan has four main priorities:
- reinforce prevention;
- improve threat detection and identification;
- respond to cyber-attacks in order to minimise their impact; and
- dissuade the entities responsible for cyberthreats in order to protect European health systems.
It is expected that the plan will be progressively implemented, this year and next, by healthcare providers, member states and the cybersecurity community.
Regulatory matters
Value-based healthcare
With an increasingly ageing population, fewer specialised healthcare staff and growing inequalities in access to healthcare, the value-based healthcare (VBH) financing model is gaining greater prominence in Europe, as it makes it possible to constrain, and above all rationalise, healthcare expenditure.
The VBH model is, in practice, a financing model centred on measurable results and incentives linked to quality. As its name suggests, the VBH model focuses on providing high-quality healthcare with better-controlled costs, linking reimbursement or payment to the outcome of the patient’s treatment.
However, the concept of “value” is indeterminate, and it is difficult to quantify value in healthcare since patients’ experience and treatment outcomes can differ.
It is essential to devise study programmes to measure patient satisfaction throughout the treatment and recovery process, and thus provide a baseline to determine whether a particular treatment falls below or exceeds the minimum acceptable threshold. In turn, this will make it possible to remunerate according to the value generated.
The VBH model can aid the exchange of personal data between healthcare providers, insurers and regulatory bodies. The GDPR, in this context, poses a challenge to the exchange of information, which must obviously comply with the applicable legal standards. This is clearly an area where innovation can thrive in the absence of regulation. Therefore, once again, there is a need to avoid complicating European and national rules, or to make them more flexible, in order to allow new models for costing and financing healthcare, particularly the NHS, to be studied and implemented. The balance between ensuring that innovation is possible while regulating the sector is an issue that the European Union will increasingly face in the future.
Another challenge related to the VBH financing model is its compatibility with public procurement, since in Portugal this sector is very rigid, and there are doubts and difficulties regarding how to operationalise a VBH-based payment model in the context of public procurement.
In Portugal, some pilot projects introducing value-based payments models have already been implemented. A white paper published by Health Cluster Portugal in June 2023 even refers to the crucial role that the legislator and the government have in developing legislation to encourage healthcare providers to focus on improving treatment outcomes.
To integrate the VBH financing model, several regulatory changes, both in Europe and in Portugal, would be desirable; even though it is already possible to implement VBH projects, there are difficulties and uncertainties related to the existing legislation. The European Union is currently harmonising the various regulations in this area, but each European jurisdiction will also have to individually adapt its health systems. In summary, the VBH model will certainly see strong growth in the coming years.
Extraordinary contribution to the pharmaceutical industry
Another pressing issue in the health area that the pharmaceutical industry hopes will soon be addressed by the regulators in Portugal concerns a concept introduced by Law No 82-B/2014 of 31 December (the “2015 State Budget Law”), namely “extraordinary contribution to the pharmaceutical industry”, with the ultimate aim of financing the NHS.
Extraordinary contribution to the pharmaceutical industry is predicated on the sales of medicines in Portugal. The contribution varies between 2.5% and 14.3% and is calculated according to the total value of sales of:
- medicines reimbursed by the state;
- medicines subject to prescription restrictions;
- medicines with exceptional use authorisation or exceptional authorisation;
- medical gases and derivatives of human blood and plasma;
- other medicines whose packaging is intended for hospital use; and
- orphan drugs.
It transpires, however, that this contribution was provisional, yet the regime has been included in all successive state budget laws for more than ten years.
The extraordinary contribution to the pharmaceutical industry regime is applicable to entities that make the first sale of medicines for human use in Portugal. These entities include:
- holders of marketing authorisations or registrations;
- representatives, intermediaries and wholesale distributors; and
- marketers of medicinal products under exceptional use authorisation or exceptional authorisation.
However, the law provides for the possibility of an agreement between the Portuguese state and the pharmaceutical industry – through the Portuguese Association of the Pharmaceutical Industry (Associação Portuguesa da Indústria Farmacêutica; APIFARMA), the local industry association, on the one hand and the National Authority for Medicines and Health Products (Autoridade Nacional do Medicamento e Produtos de Saúde; INFARMED), the local medicine supervisory authority acting on behalf of the state that sets the maximum amounts of public spending on medicines and the contribution (according to the sales volume) of pharmaceutical companies, on the other hand. In this way, APIFARMA’s member companies provide the state with a contribution that is, as a rule, lower than that which would result from applying the above-mentioned rates.
Companies in the pharmaceutical industry that are not APIFARMA members have been able to declare their adherence and sign an agreement with INFARMED on an individual basis, thus being exempted from making contributions at the above-mentioned rates. However, such companies that do not join the scheme voluntarily are obliged to contribute on the basis of the rates laid down in the State Budget Law, and there is no indication as to when this obligation will be lifted.
The foregoing shows how a scheme that was provisional has in fact been treated as definitive for the last ten years, and although VBH models for rational NHS cost contributions and payments are being discussed, the pharmaceutical industry is still being asked to essentially finance the NHS.
Conclusion
Healthcare in Europe, and more specifically in Portugal, has undergone major changes in recent years, and this evolution is accelerating through the use of new technologies and innovations. With the emergence of new issues, however, it is essential for healthcare providers and other organisations involved in the healthcare sector to be up to date with respect to cybersecurity and to maintain an environment in which personal data is effectively protected.
Along with technological innovation, Portugal also has several regulatory issues that the pharmaceutical industry hopes will soon be resolved, although the unstable political situation places the country at something of a disadvantage.
Eversheds Sutherland
Av da Liberdade, 249, 1º
1250-143 Lisboa
Portugal
+351 213 587 500
+351 213 587 501
geral@eversheds-sutherland.net www.eversheds-sutherland.pt/en/
Law and Practice
Authors
PLMJ is a law firm based in Portugal that combines full service with bespoke legal craftsmanship. For more than 50 years, the firm has supported clients in all areas of the law, often with multidisciplinary teams and always acting as a business partner in the most strategic decision-making processes. PLMJ has specialist lawyers who know the sectors and markets in which they work well and keep close contact with the regulators for each sector. The firm created PLMJ Colab, a collaborative network of law firms spread across Portugal and other countries with which it has cultural and strategic ties. PLMJ Colab makes the best use of resources and provides a bespoke response to clients’ international challenges. International co-operation is ensured through firms specialising in the legal systems and local cultures of Angola, Cabo Verde, China/Macau, Guinea-Bissau, Mozambique, São Tomé and Príncipe, and Timor-Leste.
Trends and Developments
Authors
Eversheds Sutherland is an innovative, international, multidisciplinary firm with more than 30 years of experience. The firm has approximately 80 professionals and 22 partners, with three offices in Portugal (Lisbon, Oporto and Faro) that collaborate closely with EVC Advogados/Eversheds Sutherland in Angola and AG Advogados/Eversheds Sutherland in Mozambique. The life sciences team provides comprehensive legal support beyond technical aspects, working closely with clients’ regulatory departments. Eversheds Sutherland advises on agreements with public entities and patient associations, compliance with industry and ethical codes, SOPs, clinical trials (including GDPR and insurance matters), sponsorships, transparency disclosures and pharmacovigilance. The firm’s expertise extends to OTC launches, food supplements, medical devices, product labelling, advertising claims, prize promotions and compliance with MedTech and EFPIA ethical codes. With deep industry knowledge, Eversheds Sutherland provides strategic, tailored guidance for its clients in all life sciences regulatory and commercial matters.
