Cybercrime Law, Child Pornography Including Simulated Representations
Lei n.º 8/IX/2017, art. 9.º (pornografia infantil), de 20 de Março (Lei do Cibercrime)
In force.
An AI prohibited practices rule binding public and private bodies.
- Enforcement body
- Ministério Público (public prosecution), through the ordinary criminal courts
- How the hook was established
- express
- What makes it apply
- Place of effect
- Obligation class
- Prohibition
- Audit expectation
- none
- Setting the rule reaches
- General
What it requires
- Do not produce, offer, make available, disseminate, transmit, obtain, or possess, through a computer system, a real or simulated visual representation of a child under 18 in sexually explicit activity, or of a child's sexual organs for a predominantly sexual purpose; a simulated or computer-generated representation is treated the same as a depiction of a real child.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- NIST AI 600-1
- GAI-RISK-08Information Integrity
- GAI-RISK-11Obscene, Degrading, and/or Abusive Content
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- ETSI EN 304 223
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Producing child pornography for dissemination through a computer system draws 2 to 8 years' imprisonment (Article 9(1)); offering, making available, disseminating, or transmitting it draws 1 to 5 years (Article 9(2)-(3)); obtaining or possessing it draws 1 to 4 years (Article 9(4)-(5)); a reduced tier of up to 3 years applies where the victim depicted is 14 to 18 years of age (Article 9(6)(d)). Article 9 states imprisonment terms only; no fine or monetary amount is stated for this article.
What it makes you log
Logging duty
Article 9 punishes producing, offering, disseminating, obtaining, and possessing child pornography, including a simulated or computer-generated representation, through a computer system, and states no duty to create, keep, or produce a log or record of anything.
- Kind
- None
- As of
What this law does
Article 9 criminalises, through a computer system: producing child pornography with the purpose of disseminating it (2 to 8 years' imprisonment, paragraph 1); offering or making it available (1 to 5 years, paragraph 2); disseminating or transmitting it (1 to 5 years, paragraph 3); obtaining it for oneself or another (1 to 4 years, paragraph 4); and possessing it in any way (1 to 4 years, paragraph 5).
Paragraph 6 defines child pornography for these purposes as any pornographic material that visually represents: (a) a person under 14 years of age, or an incapable person, for exhibitionist purposes or involved in sexually explicit conduct; (b) a person 14 to 18 years of age involved in sexually explicit conduct; or (c) any representation, by any means, of a child under 18 performing real or simulated explicit sexual activities, or any representation of a child's sexual organs for a predominantly sexual purpose.
Paragraph 6(c)'s inclusion of a simulated representation reaches a computer-generated, AI-synthesised, or otherwise fabricated depiction of a child in sexually explicit activity on the same terms as a depiction of a real child, without requiring that an actual child be shown or that the material derive from a real event. Paragraph 6(d) sets a reduced penalty of up to three years' imprisonment where the victim depicted is 14 to 18 years of age.
Article 9 binds any person ("Quem"), not only an online service or platform. The Law was approved by the Assembleia Nacional on , promulgated by the President of the Republic on , and published in the Boletim Oficial of ; its own Article 33 provides that it enters into force 30 days after publication. It was published in Boletim Oficial n.º 13, I Série, of . No notice stating the day on which the thirty days ended has been located.
When LexLint raises it
When your app profile says your app generates images with AI, generates video with AI or publishes adult content.
Back to the example · Lint your app
Page updated .