Legal framework

Portugal: Decreto-Lei 82/2022 or 83/2018 for your website?

In Portugal, Decreto-Lei No. 83/2018 primarily governs public-sector websites and mobile applications. Decreto-Lei No. 82/2022 transposes the European Accessibility Act and applies to certain businesses offering covered products or services. Determining which legislation applies therefore requires examining the nature of the organisation, the service actually provided, and any applicable exemptions.

The short answer

Decreto-Lei n.º 83/2018 applies primarily to public sector bodies. For a private company, the relevant legislation is generally Decreto-Lei n.º 82/2022, but only if its activities fall within the products or services covered. The mere existence of a website or mobile application is therefore not sufficient to conclude that a company automatically falls within the scope of this decree.

Its requirements have applied since 28 June 2025, subject to the exemptions and transitional measures provided for in the legislation. The assessment must be based on the service offered to the public, not solely on the format of the digital medium. For example, the same website may include purely corporate pages and a transactional journey that may be linked to a covered service.

In practice, two shortcuts should be avoided: applying Decreto-Lei n.º 83/2018 to every Portuguese digital presence, or assuming that Decreto-Lei n.º 82/2022 indiscriminately imposes the same obligations on all private companies. Both pieces of legislation pursue an accessibility objective, but their intended recipients and scopes are not identical.

Two decrees for two scopes

Decreto-Lei n.º 83/2018 transposes the directive on the accessibility of the websites and mobile applications of public sector bodies. In particular, it requires an accessibility statement and a mechanism for reporting difficulties encountered. Applying it first requires determining whether the entity concerned falls within the public sector scope defined by the legislation.

This classification must not be based solely on the website’s appearance or domain name. The legal nature of the body, its functions, and the decree’s specific provisions must be examined. Where it applies, the framework covers the websites and mobile applications concerned, as well as the information and feedback mechanisms intended for users.

The legislation applicable to private companies

Decreto-Lei n.º 82/2022 transposes Directive (EU) 2019/882. It does not automatically make every company website subject to the EAA: the obligation depends on the product or service provided, particularly in e-commerce, electronic communications, certain consumer banking services, and certain transport services.

For a private company, the first question is therefore not simply whether it operates a website. It is necessary to identify what users can actually do on it: purchase a product, enter into a distance contract, use a consumer banking service, access an electronic communication, or carry out a transaction related to a covered transport service.

A corporate website that presents a business without itself providing a service falling within the decree’s scope must not automatically be treated as a covered e-commerce service. Conversely, a digital journey that enables consumers to select, order, and pay for a product or service may require an in-depth assessment under Decreto-Lei n.º 82/2022.

What deadlines should be kept in mind?

The requirements of Decreto-Lei n.º 82/2022 have applied since 28 June 2025. This date is the reference point for products and services that effectively fall within its scope. However, it does not remove the need to examine the transitional provisions, the date of the relevant contracts and the specific circumstances of each operator.

Certain service contracts concluded before this date may continue without modification until they expire, but no later than 28 June 2030. This transition is not a general exemption granted to all businesses until 2030. It applies to certain earlier contracts and must be assessed according to the conditions laid down in the legislation.

• 28 June 2025: application of the requirements to covered products and services
• 28 June 2030: end of the transition applicable to certain earlier contracts
• Microenterprises providing services: exemption available under the conditions laid down in the legislation

A business must therefore take an inventory of the services it offers, distinguish earlier contracts from new contractual relationships and retain the evidence needed to justify the potential application of a transitional measure. A deadline should never be interpreted separately from the material scope of the decree.

When a customer journey or service changes after 28 June 2025, it is also prudent to reassess its classification. An activity initially limited to providing information may become transactional, while a new payment, authentication or support module may materially change the service provided to consumers.

Is a microenterprise exempt?

The decree defines a microenterprise by reference to a workforce of fewer than 10 people and annual turnover or an annual balance sheet total not exceeding 2 million euros. These criteria must be assessed based on the company’s actual circumstances and the applicable calculation rules, not solely on the basis of its commercial presentation or the number of people featured on its website.

The exemption applies to microenterprises that provide services, not indiscriminately to all operators or all products. A company that markets or makes available a covered product should therefore not assume that its microenterprise status automatically exempts it from all obligations.

The classification must be documented and reassessed whenever the workforce, turnover, balance sheet, or nature of the business changes. A company operating close to the thresholds would be well advised to retain the data supporting its assessment and anticipate the consequences of exceeding a threshold.

Even when an exemption appears to apply, accessibility remains useful for reducing the barriers encountered by users and improving the robustness of the user journey. However, this practical consideration should not be confused with the existence of a legal obligation: the aim is to distinguish clearly between what the decree requires and what constitutes a voluntary initiative.

What obligations apply to an online service?

A covered service provider must make information about the service accessible and explain how it meets the applicable requirements. Information intended for consumers must be presented in a way that allows them to perceive, understand and use it in the context of the service concerned.

The analysis must cover the entire user journey, including identification, navigation, forms, authentication, payment and support when they form part of the service. Focusing solely on the homepage or a few editorial pages may overlook the stages where barriers have the most significant consequences for the user.

Recurring components require particular attention: menus, buttons, error messages, required fields, order validation, payment method selection, confirmation and access to support. It is also important to verify that essential information does not depend solely on a colour, image, movement or particular mode of interaction.

The assessment must be representative of real conditions of use. It may include multiple screen sizes, keyboard navigation, relevant assistive technologies and the main scenarios for accessing the service. Content added or modified after the audit must also be included in ongoing monitoring.

What automation alone cannot establish

An automated scan, such as the one offered by Inclaria, can quickly detect some testable issues. In particular, it can facilitate the identification of recurring technical anomalies and provide a structured basis for prioritising checks.

It does not replace the manual checks required to assess actual use, content and complex user journeys. A tool cannot always determine whether alternative text accurately describes an image, whether the reading order is coherent, whether an instruction is understandable or whether a procedure can actually be completed using assistive technology.

The most robust approach therefore combines automation, manual review and testing of significant user journeys. The results must be placed in context: the absence of detected errors does not prove compliance, while an automated alert must be verified before being classified as a failure to comply.

What sanctions regime applies in Portugal?

Both decrees provide for administrative offenses punishable by fines. The amount and the competent authority depend on the applicable legislation, the nature of the breach, the sector concerned, and whether the offender is a natural or legal person.

It would therefore be inaccurate to state that a single sanction applies to every inaccessible website. Before assessing an organization’s exposure, it is necessary to identify the relevant decree, the provision concerned, the type of operator, and the authority with supervisory powers in the sector.

Internal documentation can play an important role in demonstrating the approach taken: an inventory of services, a determination of the applicable scope, audits, remediation decisions, regression monitoring, and justification for an exemption or transitional measure. This documentation does not in itself guarantee compliance, but it makes the analysis traceable.

Who monitors the application of Decreto-Lei n.º 82/2022?

Supervision is divided among several Portuguese sectoral authorities. A company must therefore identify both the service covered and the competent market surveillance authority, rather than assume that a single body monitors all websites.

This division reflects the diversity of the products and services concerned. The authority responsible for a consumer banking service is not necessarily the authority responsible for electronic communications, a transport service, or an e-commerce activity.

In cases of uncertainty, a targeted legal analysis should confirm the classification of the service, the competent authority, and the consequences of a potential breach. This verification is particularly important when the same company offers several services falling within different sectors.

How to determine which legislation applies?

A reliable analysis begins by classifying the entity and the service, followed by an examination of exemptions, transitional provisions, and the digital journey. It is advisable to retain a written record of the assumptions, sources consulted, and conclusions reached.

• Determine whether the publisher belongs to the public or private sector
• Precisely classify the product or service offered to the public
• Check exclusions, exemptions, and transitional measures
• Map the pages, applications, and steps that genuinely contribute to the service
• Compare the digital journey with the applicable requirements
• Document automated and manual checks
• Assign corrective actions, set priorities, and monitor regressions
• Reassess the analysis following any significant change to the service

For a public-sector body, the assessment will focus primarily on Decreto-Lei n.º 83/2018 and the obligations applicable to its websites and mobile applications. For a private company, the analysis should begin with the categories of products and services covered by Decreto-Lei n.º 82/2022, without assuming that a corporate website necessarily falls within its scope.

Once the scope has been established, the audit can focus on the journeys that are genuinely affected. This method avoids both underestimating an applicable obligation and presenting an approach as legally mandatory when it does not fall within the legislation under review.

This content is provided for informational purposes and does not constitute legal advice. To classify a service, exemption, or risk of penalties in a specific case, consult a lawyer familiar with Portuguese law and European accessibility regulations.