Portugal overhauls its science and innovation system by decree-law

Portugal has published Decreto-Lei n.º 210/2026 of 3 November, which sets the legal regime for the Sistema Nacional de Ciência, Tecnologia e Inovação (SNCTI). It matters because one instrument now sets out who researches, who funds, and under which rules on data, artificial intelligence and security. We bring it to readers of the Euro-American Committee of Digital Law - CEA Digital Law.

Timeline and scope

The text was approved by the Conselho de Ministros on 9 September 2026, promulgated on 23 October and countersigned on 26 October. It appeared in the Diário da República, 1.ª série, n.º 213, and enters into force on 1 January 2027. It repeals Decreto-Lei n.º 63/2019 and Decreto-Lei n.º 126-B/2021. Entities already recognised keep their status, and funding contracts in progress remain effective until they expire.

The decree builds on the creation of the Agência para a Investigação e Inovação, E. P. E. (AI², E. P. E.) by Decreto-Lei n.º 132/2025, which absorbed the Fundação para a Ciência e a Tecnologia. AI² is now the system’s managing body: it recognises, accredits, evaluates and funds.

Organisation and funding

Alongside the existing classification by type of institution, the decree adds a functional approach. Entities are recognised as research entities or as development, technology and innovation entities, depending on the core functions they perform. It distinguishes three routes of public support: competitive structural funding, funding for programmes and projects, and funding for national strategic infrastructures. It also provides for transparent procedures, evaluation panels made up mostly of independent experts, and programme contracts with reporting duties.

Data, open science and AI

This is where digital law readers will find the most interest:

• Open science: the default is access to publications and data funded with public money, supported by data management plans and repositories. Proportionate exceptions are allowed for legal, ethical, security or personal data protection reasons, including justified temporary embargoes.
• Security and integrity: knowledge should be « as open as possible, as protected as necessary ». Institutions need integrity and research security plans, with attention to dual use, export controls and AI-related risks.
• Artificial intelligence: use must be responsible and transparent, and it does not relieve researchers and institutions of responsibility for the accuracy and reliability of results. The definition of scientific misconduct covers abusive use of automated systems.
• Data registry and cybersecurity: the State maintains a data system on science and innovation, shared with the Instituto Nacional de Estatística. Security incidents must be reported to AI², the Centro Nacional de Cibersegurança and the Comissão Nacional de Proteção de Dados.
• Digital procedures: calls use authentication through the Cartão de Cidadão or Chave Móvel Digital, qualified electronic signatures under Regulation (EU) No 910/2014, electronic notifications and machine-readable publication on the Portal de Dados Abertos da Administração Pública.

The decree also lists the promotion of Portuguese as a working language of science, without prejudice to internationalisation, and provides for networks with the Portuguese research diaspora.

Our view at CEA Digital Law

We welcome Portugal’s decision to bring into a science organisation law duties that are often scattered: open data with safeguards, research security and human accountability for AI use. The mix is consistent with the European Research Area and with the European data protection framework, and it can serve as a reference for countries in Latin America and the Caribbean and in Africa that are updating their science systems.

Some open questions deserve attention. The first is the regulations AI² will adopt, which will determine the concrete accreditation and funding criteria. The second is how the balance between openness and protection will work in practice, especially for health data and dual-use technologies, where institutions will need clear guidance and training. The third is proportionality: integrity and security plans must be enforceable without overburdening smaller centres.

We also suggest making the most of the Lusophone dimension. Portugal, Brazil and the Portuguese-speaking African countries could share metadata standards, research data policies and integrity practices, so that scientific cooperation gains legal interoperability. CEA Digital Law is ready to contribute to that dialogue.

Sources

• Decreto-Lei n.º 210/2026, de 3 de novembro (Diário da República, 1.ª série, n.º 213)
• Diário da República: ficha del Decreto-Lei n.º 210/2026

CEA Digital Law