Law / Portugal

Decreto-Lei n.º 84/2021, Security Updates for Goods With Digital Elements and Digital Content

Decreto-Lei n.º 84/2021, de 18 de outubro (conformidade de bens, conteúdos e serviços digitais), artigos 8.º e 29.º

In force since 1 Jan 2022.

A product security requirements rule binding private bodies.

Obligation class

Security, Disclosure

As of 12 October 2026.

What it requires

• If you sell goods with digital elements to a consumer in Portugal, ensure that the updates, including security updates, needed to keep the goods in conformity are communicated and supplied to the consumer for the period the consumer could reasonably expect; for a continuous supply, the period is two years where the supply lasts up to two years and the duration of the contract where it lasts longer (Article 8(1) to (3)).NIST CSF 2.0PR.PS-02
• If you supply digital content or a digital service to a consumer in Portugal, ensure that the updates, including security updates, needed to keep it in conformity are communicated and supplied to the consumer for the period the consumer could reasonably expect where the contract provides one act or a series of acts of supply, and for the whole period of supply where it provides a continuous supply (Article 29(3) and (4)).NIST CSF 2.0PR.PS-02
• Supply digital content and services with the security characteristics that are usual and expected for content or services of the same type (Article 29(1)(b)).NIST CSF 2.0PR.PS-06
• Tell the consumer that an update is available and what happens if it is not installed, and give correct installation instructions, to rely on the consumer's failure to install it (Article 8(4) and Article 29(5)).NIST CSF 2.0PR.PS-02

These lines are LexLint's reading of the law's text, as of 12 October 2026.

In the frameworks

NIST CSF 2.0

• PR.PS-02Software is maintained, replaced, and removed commensurate with risk
• PR.PS-06Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle

CIS Controls

• 3.10Encryption of sensitive data as it crosses networks.
• 3.11Encryption of sensitive data where it is stored on servers and applications.
• 6.8Access rights defined by job role, and kept up to date.
• 7.1A documented, reviewed approach to finding and handling weaknesses.

FINOS AIGF

• AIR-PREV-007Legal and Contractual Frameworks for AI Systems
• AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
• AIR-PREV-012Role-Based Access Control for AI Data
• AIR-PREV-014Encryption of AI Data at Rest
• AIR-PREV-017AI Firewall Implementation and Management
• AIR-PREV-020MCP Server Security Governance

1 more

• AIR-DET-001AI Data Leakage Prevention and Detection

ENISA NIS2 guidance

• 2.1Risk management framework
• 3.1Incident handling policy
• 4.1Business continuity and disaster recovery plan
• 6.2Secure development life cycle
• 6.5Security testing
• 6.10Vulnerability handling and disclosure

2 more

• 9.1Cryptography
• 11.2Management of access rights

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Who enforces it

When LexLint raises it

When your app profile says your app distributes a software product or ships a mobile app.

Back to the example  ·  Lint your app