Lei 58/2019 — beyond GDPR
Portugal's GDPR implementation law, with stricter rules on employee data and health data.
Art. 28. Employee consent is, as a rule, not a valid basis for processing their data. So each agent's lawful basis is legitimate interest or contract, documented — never “the employee agreed”.
Product commitment: agent logs are never used to evaluate employee performance. The CNPD's remote-work guidance makes monitoring software disproportionate; our logs serve the audit of the platform, not of people.
Art. 29. Health data only on a need-to-know basis, with notification of each access to the data subject. The per-access audit log is the mechanism; hosting on your VM is what closes the trust gap (see clinics).
The AI Act in Portugal
How the EU regulation is supervised nationally.
ANACOM is the national supervisory authority, coordinating 14 sector authorities. There is no national AI law or sanctions decree yet — the Regulation applies directly, and Art. 50 transparency has been in force since 2 August 2026.
ANACOM's draft guidance on prohibited practices includes emotion recognition at work. The platform doesn't do it, and won't — it is written into our governance policy as a prohibited action.
Lei 13/2023 — Código do Trabalho, Art. 106
The 2023 labour-law reform: employers must inform workers about algorithms and AI affecting work.
The employer must inform workers, the works council (comissão de trabalhadores) and union delegates about the use of algorithms and AI that affect work. Breach is a serious administrative offence, enforced by ACT (the labour inspectorate).
The governance pack delivers the notice ready before go-live: what the agents do, what they don't, who approves, how to complain. It is the practice that backs the word “colleague”, not “replacement”.
Carta Portuguesa de Direitos Humanos na Era Digital — Lei 27/2021, Art. 9
Portugal's charter of digital rights; Art. 9 covers the use of AI and robots.
Explainability, transparency, auditability and appealable decisions. Mapped one to one:
| Right (Art. 9) | Platform feature |
|---|
| Explainability | Readable charter for each agent; searchable transcripts of every conversation; the agent cites the source of what it states. |
|---|
| Transparency | AI identification on every message and in the profile; verifiable platform state (platform-state.json). |
|---|
| Auditability | Log of every command, approval and cost, with the model actually used; retention ≥ 6 months. |
|---|
| Appealable decisions | No consequential decision belongs to the agent: it proposes, a manager approves or rejects; immediate retirement by chat; kill switch on the roadmap. |
|---|
Certified invoicing (faturação certificada)
Portuguese invoicing software must be certified by the tax authority (AT).
Agents operate your AT-certified invoicing software (Portaria 363/2010, SAF-T, ATCUD) through its APIs — Moloni, InvoiceXpress, Primavera, PHC. They prepare, match, remind.
They never issue or alter fiscal records. The certified accountant (contabilista certificado) keeps the responsibility they always had. We are not invoicing software and we don't replace the accountant: we are their right hand.
Honesty about enforcement
CNPD fines are rare (two in 2025). Warnings and stop-processing orders are not. We design for the standard, not for the fine: if a processing activity has no clear basis, the agent doesn't start.