REGULATORY SANDBOXPortugal AI in Health Sandbox
A controlled environment to test and validate high-impact AI systems in healthcare with legal certainty and regulatory oversight.
Dual purpose
Accelerate innovation with legal certainty.
Build national regulatory capacity.
EHDS Alignment
Secure Processing Environments for pseudonymised data testing.
Portugal as a National Pilot in the EHDS rollout.
Strategic Focus Areas
High-risk, high social-value sectors:
Next-Generation Diagnostics
AI-powered medical devices for advanced diagnostics.
Care Optimisation
Predictive analytics for clinical workflows and patient outcomes.
Clinical Safety
Clinical Decision Support systems with mandatory human oversight.
Regulatory landscape
AI systems used in clinical decision-making sit at the intersection of several European regulations. The sandbox helps sponsors navigate all of them coherently — from classification to post-market monitoring.
Medical Devices — MDR & IVDR
AI that drives a diagnostic, prognostic or therapeutic output is regulated as a medical device under Regulation (EU) 2017/745 (MDR) or 2017/746 (IVDR), as amended by Regulation (EU) 2023/607 (MDR transition extension) and (EU) 2024/1860 (IVDR transition extension). Classification is risk-based; most clinical AI falls in Class IIa or higher and requires Notified Body conformity assessment. INFARMED is the Portuguese competent authority.
EU AI Act
Regulation (EU) 2024/1689 (AI Act) entered into force on 1 August 2024. Most clinical AI qualifies as high-risk, with obligations applicable from 2 August 2026 — data governance, transparency, human oversight, robustness, accuracy, cybersecurity and post-market monitoring — layered on top of MDR/IVDR requirements. Conformity is assessed by Notified Bodies.
Clinical Research — CTR, MDR/IVDR & Portuguese Law
Clinical evidence for AI follows the EU Clinical Trials Regulation 536/2014 (fully applicable since 31 January 2025) for medicinal products, MDR Articles 62–82 for clinical investigations of medical devices, and IVDR Articles 57–77 for performance studies of in-vitro diagnostics. In Portugal, the framework is set by Law 21/2014 as reformed by Law 49/2023, which aligned national rules with the CTR and streamlined the operation of ethics committees. CEIC grants ethics approval for national sites, INFARMED is the competent authority, and secondary use of personal data is authorised by CNPD.
European Health Data Space
Regulation (EU) 2025/327 on the European Health Data Space entered into force on 26 March 2025 and regulates both primary (care) and secondary (research, regulatory, innovation) use of health data. Sandbox pilots operate inside Secure Processing Environments aligned with the Portuguese EHDS Health Data Access Body.
Nine capabilities, one coordinated environment
The sandbox is not a document exchange — it is a coordinated operating model connecting promoters, regulators, clinical sites and research actors around each AI deployment.
Single Submission Platform
One front door for promoters — centralised submission of project applications, documentation and evidence, coordinated across all competent authorities.
Regulatory Support & Pre-Review
Early, informal feedback on compliance strategy, clinical evidence plans and data governance before formal submission.
AI Deploy Capacity Building
Training and co-design programmes that prepare hospitals and manufacturers to deploy, validate and maintain AI in real clinical settings.
Network of Clinical Living Labs
A federated network of SNS and private hospital sites providing real-world clinical environments for validation, shadow deployment and outcome studies.
Expedite Regulatory Route
Fast-track review pathways negotiated with INFARMED, CEIC and other regulators for sandbox participants meeting pre-defined quality gates.
Practical Review & Learning
Joint review sessions where promoters, deployers and regulators learn from each live case, turning individual deployments into shared regulatory knowledge.
Monitoring of AI Deployment
Continuous post-market surveillance framework — drift detection, incident reporting and performance benchmarks across the network.
Regulatory Guidance Creation
Publication of practical guidances distilled from sandbox evidence, translating real deployments into reusable regulatory expectations.
Regulatory Science Projects
Applied research — with universities and research centres — to develop new assessment methods, evaluation benchmarks and compliance frameworks.