In short: as of September 2026 there is no regulation or opinion of the Portuguese Bar Association on the use of artificial intelligence, and no directive of the data protection authority on the subject. That does not mean there are no rules: professional secrecy, the General Data Protection Regulation and the duties of competence already cover the essentials. And on the other side of the bench, judges now have a written guide for detecting fabricated citations.
What does not exist, and what that does not mean
The page the Bar Association devotes to the subject is a compilation of Union legislation, not an instrument of its own. The data protection authority has five published directives, the most recent on security measures, and none deals with artificial intelligence; what it does is circulate documents of the European Data Protection Board. The absence of a specific rule is itself a useful fact — but it is misread if one concludes from it that the ground is clear. The rules that apply are the usual ones, and they apply in full.
Professional secrecy does not distinguish the medium
Article 92 of the Statute of the Bar Association, approved by Law no. 145/2015 of 9 September, covers every fact learned through the exercise of the profession. The law does not distinguish between telling someone and typing into a text box. Pasting into a public system the draft of a contract, a medical report or the name of a witness is disclosure to a third party, with everything that follows. The question is not what the tool does with the information — it is the act of handing it over.
Whoever supplies the tool is a processor
Under the General Data Protection Regulation, the system’s supplier is a processor for the purposes of article 28, which requires a written contract with the clauses in paragraph 3 — a contract which, in free consumer accounts, simply does not exist. To this are added article 5, on minimisation and confidentiality, article 32, on security measures appropriate to the risk, and articles 44 and following, on international transfers, since most suppliers process data outside the Union. The practical line separating the acceptable from the unacceptable is the version of the product: consumer plans use by default what is typed to train models; enterprise plans with a processing agreement, as a rule, do not.
The rule the CCBE has already put in writing
The guide of the Council of Bars and Law Societies of Europe, of 2 October 2025, sets the position out in simple terms: do not enter personal or confidential client data without adequate safeguards, and first understand what the supplier does with what is typed. It is the minimum standard of conduct available today in a professional document, and it is what a disciplinary body would have to hand in assessing diligence.
Judges already have a guide — and the fine has figures
Since 8 April 2026 the High Council of the Judiciary has had written recommendations on the use of artificial intelligence in judicial activity: they forbid entering judicial data into systems not provided or validated, require anonymisation and list the indicators to look for in a filing — judgments with no real existence, legislation with no application in national territory, expressions not current in European Portuguese. On the representative’s side, article 542(2) of the Code of Civil Procedure defines litigation in bad faith by intent or gross negligence and covers altering the truth of the facts and making manifestly reprehensible use of the proceedings. The fine ranges from 2 to 100 accounting units — between 204 and 10,200 euros, with the unit set at 102 euros for 2026 — and article 545 requires notification of the Bar Association where the representative bore personal and direct responsibility. Abroad there are already identifiable decisions: in England, the Divisional Court decided on 6 June 2025 two cases, in one of which five non-existent decisions were invoked and in the other eighteen of forty-five citations did not correspond to real cases; in California, an appellate court imposed in September 2025 a sanction of ten thousand dollars for filings with fabricated citations.
Checking a reference takes two minutes
The method is simple and depends on no tool. First: open the database of the court invoked on dgsi.pt — there are separate databases for the Supreme Court, for each Court of Appeal and for the administrative courts — and search for the exact case number. If nothing appears, confirm by the triad of case number, reporting judge and date; it is worth knowing that dgsi does not publish everything, so absence is a warning sign and not proof. Second: read the quoted passage inside the judgment once opened, and not merely confirm that the judgment exists — a good share of errors are real decisions credited with a passage they never contained. Third: confirm each statute in the consolidated legislation of the Official Gazette, which shows the version in force, the amendments and the repeals; citing an article repealed three years ago is the commonest error of all.
What to do this week
Take stock of the tools actually used in the office, including those each colleague uses on their own account, and confirm for each whether inputs are used for training, whether a signed processing agreement exists and where the data is hosted. Set down in writing a short rule: nothing identifying a client, an opposing party or a case goes into a consumer account, and general research is done in abstract language, without names, case numbers, dates or amounts. And keep in the internal file a record of the verification of each reference cited — that is what makes it possible to demonstrate diligence if the question is raised, and that is what separates a slip from gross negligence.
This note is provided for information purposes only and does not constitute legal advice. For an analysis of your specific case, please contact us.