# AI Act: what changes for Portuguese companies that use artificial intelligence > The AI Act explained for Portuguese companies: the timeline after the Digital Omnibus, prohibited practices, transparency, high risk and who supervises. [Home](https://alphaimpact.pt/en/) › [Guides](https://alphaimpact.pt/en/guias/) › AI Act Page: https://alphaimpact.pt/en/guias/ai-act-para-empresas-portuguesas · Updated: 2026-10-27 The AI Act is the European regulation that sets rules for artificial intelligence according to the risk of each use. For most Portuguese SMEs, which use AI to write, summarise, serve customers or process documents, the obligations that already apply are few and concrete: avoid prohibited practices, support the team's AI literacy and tell people when they are talking to a machine. The most demanding rules are for high-risk uses, such as recruitment or credit scoring, and only apply from 2 December 2027. ## What is the AI Act? It is Regulation (EU) 2024/1689 on artificial intelligence. It entered into force on 1 August 2024 and applies directly in Portugal, like the GDPR: it does not need a Portuguese law to take effect. It does not regulate the technology in the abstract, it regulates uses. Obligations depend on the risk of each one: there are prohibited practices, high-risk uses with demanding rules, uses that require transparency and, for everything else, almost nothing. ## Who has obligations: the provider or the user? The regulation distinguishes two roles. The provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name. The deployer uses an AI system in its professional activity. A company that uses ChatGPT, Copilot or Claude in the office is a deployer. A company that runs a WhatsApp assistant for its customers under its own name may also be the provider of that system, even if it commissioned it from another company. Purely personal use, outside professional activity, is not covered. ## The timeline: what already applies and what comes next - 2 February 2025: prohibited practices and AI literacy. - 2 August 2025: rules for general-purpose AI models, which fall on those who develop them, such as OpenAI, Google or Anthropic, and rules on national authorities and fines. - 2 August 2026: the transparency obligations in Article 50 and general application of the regulation. - 2 December 2026: technical marking of content generated by systems already on the market before 2 August 2026, and two new prohibitions: generating intimate images of real people without consent and generating child sexual abuse material. - 2 December 2027: obligations for the high-risk systems in Annex III, such as those for recruitment, credit and education. - 2 August 2028: high-risk systems built into regulated products, such as medical devices or machinery (Annex I). The December 2027 and August 2028 deadlines come from the Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026. Before that, the high-risk rules were scheduled for August 2026 and August 2027. ## What has been prohibited since February 2025? Some practices are prohibited, whoever uses them. For an SME, these are the ones that matter most: - Recognising the emotions of workers or students, for example from their voice or image, except for medical or safety reasons. - Using manipulative or deceptive techniques that change people's behaviour and cause them significant harm. - Exploiting vulnerabilities linked to someone's age, disability or social or economic situation. - Scoring people on their social behaviour or personal traits, with unfair consequences in other contexts. - Inferring race, political opinions, religion or sexual orientation from biometric data. - Building facial recognition databases from images scraped indiscriminately from the internet or CCTV. An example: a system that analyses call centre agents' voices to measure their emotional state is prohibited. Analysing the text of customer messages to prioritise complaints does not use biometric data and, in principle, does not fall under this prohibition. ## What obligations does an SME using AI have today? - AI literacy: take measures so that the people who use AI in the company know what they are doing, with training and usage rules suited to each role. The Digital Omnibus softened this obligation: a level of knowledge no longer has to be guaranteed, but action is still required. - Assistants that say they are AI: anyone talking to an AI assistant, on WhatsApp or on the website, must know they are talking to a machine, unless it is obvious. - Realistic imitations: images, audio or video that imitate real people, places or events must be labelled as generated or manipulated by AI. - Texts on matters of public interest: when they are generated by AI and published to inform the public, they must be labelled, unless a person reviews them and takes editorial responsibility. - Emotion recognition or biometric categorisation outside the prohibitions: the people exposed must be informed. An example: the assistant on our website, Redita, shows at the top of the conversation that you are talking to an AI assistant, with a link to the privacy policy. Writing emails, summarising meetings, translating or reading invoices with AI does not, in itself, bring obligations beyond literacy. The GDPR still applies whenever personal data is involved. ## What is a high-risk system? These are uses where a mistake can affect people's lives, rights or safety. The list is in Annex III of the regulation. The ones closest to SMEs are these: - Recruitment and people management: screening applications, ranking candidates, assessing performance, allocating tasks or supporting promotion and dismissal decisions. - Credit and insurance: assessing people's creditworthiness or pricing life and health insurance. - Education and training: deciding admissions, assessing learning outcomes or monitoring students during exams. - Biometrics: remote biometric identification and biometric categorisation. A system in these areas may not be high-risk if it only performs a narrow procedural task, improves work already done by a person or prepares an assessment that a person makes, as long as it does not profile people. That conclusion must be documented. For those who use one of these systems, obligations start on 2 December 2027: use it according to the provider's instructions, have human oversight by people competent to do so, monitor how it works, keep the logs and inform workers and their representatives before using it in the workplace. ## Who supervises in Portugal? In September 2025 the Government chose ANACOM as the market surveillance authority and single point of contact. The European Commission already lists it as such, but at the date of this review the national designation had not yet been published in a final legal act, and Portugal had not yet published its national penalties regime either. In the financial sectors, supervision of high-risk systems falls to Banco de Portugal, ASF and CMVM. The CNPD keeps its powers whenever personal data is involved, and bodies such as ACT, ERS or ASAE can request documentation on high-risk systems in their area. ## What fines are foreseen? The regulation sets the maximum limits and each country defines the actual regime. For prohibited practices, the maximums are higher than the GDPR's. For the other obligations, including transparency, they are lower but still high. For SMEs, the lower of the two limits applies, the fixed amount or the percentage of annual turnover, not the higher one. The Digital Omnibus extended this rule to small mid-cap companies. Being an SME lowers the maximum fine, but it does not exempt you. ## Where to start? 1. List the AI tools the company uses, who uses them and for what, including the ones people use on their own initiative. 2. Confirm that no use falls under the prohibited practices. 3. Flag the uses that may be high-risk, especially in recruitment, people management, credit and education, and start preparing for the December 2027 deadline. 4. Make sure assistants say they are AI right at the start of the conversation. 5. Set usage rules for the team: which tools to use, which data never goes into them and who reviews what the AI produces. 6. Provide training suited to each role and keep a record of what was done. 7. Ask the providers of your tools for the information you need on transparency, content marking and data processing. This guide summarises the regulation and is not a substitute for legal advice. For a specific case, especially a high-risk one, check with a lawyer. ## Frequently asked questions ### Does the AI Act apply to a company that only uses ChatGPT? It does, but only a little. It has to support the AI literacy of the people who use it and respect the prohibited practices. If it publishes realistic imitations of people or events, or texts of public interest without human review, it has to label them as AI-generated. ### Does a WhatsApp assistant have to say it is AI? Yes, since 2 August 2026, unless it is obvious. The safest option is to say so in the first message. It is also good practice to offer a handover to a person. ### Have the high-risk rules been postponed? They have. The Digital Omnibus on AI postponed them to 2 December 2027 (Annex III) and to 2 August 2028 (regulated products, Annex I). The prohibited practices and transparency were not postponed, and AI literacy still applies. ### Is using AI to screen CVs allowed? It is allowed, but it is a high-risk use. From 2 December 2027 it requires human oversight, logs and information for candidates and workers, and the system's provider must meet the high-risk rules. Until then, the GDPR already limits decisions about people taken solely by automated means. ### Who supervises the AI Act in Portugal? ANACOM, chosen by the Government as the market surveillance authority. In the financial sectors, Banco de Portugal, ASF and CMVM. The CNPD remains responsible for data protection. ## See also - [AI training](https://alphaimpact.pt/en/solucoes/formacao-em-ia) - [AI assistants](https://alphaimpact.pt/en/solucoes/assistentes-de-ia) - Case [Redita](https://alphaimpact.pt/en/casos/redita) --- Alpha Impact, Lda, Lisboa, Portugal · Company no. (NIPC) 516881590 · info@alphaimpact.pt · +351 916 464 768 · First step: a 30-minute call, free of charge.