Portugal: technology regulation at a glance

Framework: EU Markets in Crypto-Assets Regulation (MiCA, Reg. (EU) 2023/1114) transposed by Portuguese Law No. 69/2025 of 22 December; supervised by CMVM (conduct, CASPs, public offerings) and Banco de Portugal (ARTs/EMTs, prudential). Tax under the Personal Income Tax Code (CIRS), as amended by the 2023 State Budget Law.

Portugal is fully within the EU MiCA regime, which has applied directly since 30 December 2024, and has now enacted national implementing legislation (Law No. 69/2025) designating CMVM and Banco de Portugal as the joint competent authorities and setting out authorisation, conduct, and supervisory rules. Existing VASPs registered with the Banco de Portugal may continue providing services under a transitional regime until 1 July 2026, by which time they must hold a MiCA CASP licence. Crypto is legal to hold and trade; gains on assets held under 365 days are taxed at 28% under the CIRS, while gains on assets held one year or longer are exempt.

Framework: EU Artificial Intelligence Act (Regulation (EU) 2024/1689), directly applicable in Portugal, with ANACOM (Autoridade Nacional de Comunicações) designated as the national market surveillance authority and single point of contact; complemented by the AI Portugal 2030 national strategy.

As an EU member state, Portugal is governed by the EU AI Act, a comprehensive, risk-based horizontal AI law that is directly applicable and phasing in (prohibitions and AI-literacy duties since February 2025; GPAI rules from August 2025; full high-risk obligations by August 2026). Portugal has not enacted a standalone national AI statute; instead it focuses on national implementation, designating ANACOM in September 2025 as the lead market surveillance authority coordinating sectoral regulators. Portugal also maintains a non-binding national strategy, AI Portugal 2030, under the INCoDe.2030 initiative.

Framework: EU General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) as the directly-applicable baseline, executed nationally by Lei n.º 58/2019 of 8 August; supervised by the Comissão Nacional de Proteção de Dados (CNPD)

As an EU member state, Portugal applies the GDPR directly as its comprehensive personal-data protection regime, complemented nationally by Law no. 58/2019 of 8 August (which executes the GDPR in the Portuguese legal order rather than transposing it). Sector-specific laws complete the framework: Law no. 59/2019 covers data processing for criminal/law-enforcement purposes (transposing Directive (EU) 2016/680), and Law no. 41/2004 governs privacy in electronic communications (ePrivacy/cookies). The Comissão Nacional de Proteção de Dados (CNPD) is the independent supervisory authority.

Framework: EU PSD2 transposed by Decree-Law No. 91/2018 (the RJSPME, Legal Framework for Payment Services and Electronic Money), supervised by Banco de Portugal; MiCA Regulation (EU) 2023/1114 implemented nationally (in force July 2026) with Banco de Portugal and CMVM as joint national competent authorities.

Portugal operates a clear, EU-harmonised licensing regime for payments and fintech. Banco de Portugal authorises and supervises payment institutions and electronic money institutions under the RJSPME (Decree-Law 91/2018, transposing PSD2), and open banking (AIS/PIS) access is fully operative. Crypto-asset services are governed by EU MiCA, implemented by national law with Banco de Portugal and the securities regulator CMVM splitting prudential and market supervision.

Framework: Portuguese Immigration Act (Lei n.º 23/2007, as amended); residence/temporary-stay visas issued by consulates via the MNE portal (vistos.mne.gov.pt), residence permits administered by AIMA. Golden Visa (ARI) under Art. 90.º-A, amended by Lei n.º 56/2023 (Mais Habitação).

Portugal offers a dedicated remote-work pathway: the D8 'digital nomad' visa (introduced Oct 2022), available as either a temporary-stay visa or a residence visa for remote employees and independent professionals. Applicants must show monthly income of at least 4x the national minimum wage (€3,680 in 2026), and residence-route holders obtain a 2-year AIMA residence permit (renewable for 3 years) leading toward permanent residence/citizenship after 5 years. Separate routes include the older D7 passive-income visa and the investment-based Golden Visa (ARI), from which real estate was removed in 2023.

Framework: EU Digital Services Act (Regulation (EU) 2022/2065), implemented nationally by Law No. 12-A/2026 of 15 April 2026; ANACOM is the competent authority and Digital Services Coordinator.

As an EU member state, Portugal applies the directly-effective EU Digital Services Act (DSA) as its comprehensive online-content and platform-safety regime, and on 15 April 2026 enacted national implementing Law No. 12-A/2026 establishing supervision, enforcement and sanctions. ANACOM serves as the Digital Services Coordinator and single point of contact, with ERC, IGAC and CNPD holding sectoral competences. A separate bill restricting social-media access for under-16s passed a first parliamentary reading in February 2026 but is not yet final law.

Framework: Regime Jurídico da Cibersegurança (Decree-Law no. 125/2025, de 4 de dezembro), transposing EU NIS2 Directive (EU) 2022/2555; supervised by the Centro Nacional de Cibersegurança (CNCS) as national competent authority and single point of contact, with CERT.PT as national CSIRT.

Portugal has a comprehensive horizontal cybersecurity law. The previous NIS-based regime was replaced by Decree-Law no. 125/2025 (published 4 December 2025), which transposes the EU NIS2 Directive following the enabling Law no. 59/2025 (22 October 2025). The CNCS is the central supervisory authority and EU single point of contact, with NIS2-aligned risk-management and staged incident-reporting duties entering into force in April 2026.

Framework: Código das Sociedades Comerciais and Código do Registo Comercial, administered via the 'Empresa na Hora' (on-the-spot) and 'Empresa Online' regimes run by IRN/Ministry of Justice; tax registration through Autoridade Tributária (AT). EU-baseline (Services Directive single point of contact) applies.

Portugal is one of the easiest EU jurisdictions for company formation: a private limited company (Sociedade por Quotas / Lda) can be incorporated in under an hour at an 'Empresa na Hora' counter or online, with no foreign-ownership restrictions and minimum share capital effectively set at €1 per shareholder. Foreigners face the same rules as residents, the main extra step being obtaining a Portuguese tax number (NIF) and, for non-EU/EEA residents without a fiscal representative, activating electronic tax notifications.