AI consulting Portugal buyers can verify: regulators, language and supplier checks

The European Commission's AI Act service desk lists the dates below. It also notes that the Digital Omnibus on AI amended some provisions, so read the current text before you rely on a date.

• 1 August 2024: the Act enters into force.
• 2 February 2025: definitions, AI literacy and prohibitions apply.
• 2 August 2025: rules for general-purpose AI apply.
• 2 August 2026: most rules apply, including the transparency rules in Article 50, and enforcement begins.
• 2 December 2026: new prohibitions on certain AI-generated content and a transitional deadline for Article 50(2).
• 2 December 2027: high-risk rules for Annex III systems.
• 2 August 2028: high-risk rules for AI embedded in regulated products.

The Commission's regulatory framework page sorts systems into four levels: unacceptable risk, high risk, transparency risk and minimal risk. A chatbot that talks to customers falls under transparency. Ask any firm which level your system sits in and why. A good answer names the article it relied on, says what would move the system to a higher level and states who in your company owns that decision.

KPMG Portugal's AI page offers AI for Business, Trusted AI for responsible adoption in line with risk management and regulation, use cases by function and industry, alliances with technology providers, and a request-for-proposal route. That is a typical large-firm shape: strategy, governance and platform alliances.

A smaller firm will not look like that, and need not. Decide the kind of firm you need first.

• Direction and governance for a board: a large or strategy firm.
• One system in production: a product-engineering firm.
• Data platform work: a data and AI specialist.

Our guide to AI consulting firms by kind sets out each, and AI consulting companies compares them by size. In every case the question is the same: who, by name, will build and keep your system running, and what will you hold at the end?

A Portuguese buyer gets the most protection from a scope that states four things in plain words.

• The system, and the personal data it will touch.
• The risk level you and the firm agree it sits at under the AI Act, with the reasoning written down.
• The accounts and repositories where everything is built, which should be yours.
• The point at which you can stop, with what you keep.

Written down, these four take an afternoon. Left out, they turn into arguments in month three. Ask the firm to draft them and then change the draft. If a firm cannot say how its work is affected by the 2 August 2026 date, treat that as information about the firm, not about the law. Ask also who writes and signs the data protection impact assessment if the system profiles or decides about people, because the CNPD site lists impact assessment as a live subject.

Digiton is an AI consulting firm that builds AI agents and custom AI software and takes systems built with Claude, Cursor or Lovable into production. The company is registered in Tallinn, Estonia, and works from Lisbon. We do not claim a Portuguese office or entity on this page. The entry step is a 25-minute scoping call.

• For agents and workflows, see AI agent development.
• For larger builds, see custom AI development.
• For a system that exists and is not holding up, see production engineering, where we read the real repository and give you a scorecard across ten layers with evidence for each.

It is a poor fit if you need a firm with a registered Portuguese entity for a tender, regulated advice, or a board strategy deck. Use the scorecard in how to choose an AI consulting firm on every firm you consider.