Answers to the questions that arise most often, with the article cited alongside wherever the answer follows from a rule.
Questions and answers
We serve Spanish customers from Portugal. Does Spanish law apply to us?
Very likely. Ley 10/2025 of 26 December applies to undertakings established in Spain or in another State, provided they operate in Spanish territory. It covers providers of services of general interest and all large undertakings — 250 or more employees, turnover above €50 million or a balance sheet above €43 million. It has been fully enforceable since 28 December 2026 and its waiting-time and human-attention requirements are markedly more demanding than the Portuguese ones.
Ley 10/2025 (Spain)
We hold a quality certification. Are we covered?
No. Certification against a voluntary standard demonstrates conformity with that standard, not with the law. Certification schemes address service quality; the legal regimes address obligations, deadlines and evidence. An operation can be certified and non-compliant at the same time, and frequently is.
Does our virtual assistant have to identify itself as a machine?
Yes. Article 50 of Regulation (EU) 2024/1689 requires that a person interacting with an AI system be informed of that fact, unless it is obvious to a reasonably well-informed person. The duty has applied since 2 August 2026, with a grace period to 2 December 2026 for systems already in operation.
Article 50 of Regulation (EU) 2024/1689
When does the sixty-second period start running?
In Portugal, from the moment the caller selects the option for contact with a professional in the menu, not from the moment the call is connected. Where there is no menu, it runs from connection. The rule is in article 6(2) and (3) of Decree-Law 134/2009 of 2 June.
Article 6(2) and (3) of Decree-Law 134/2009
Our customer service is outsourced. Who is responsible?
The undertaking that offers the service to the consumer. Outsourcing distributes execution, not liability towards the consumer, without prejudice to any allocation of liability agreed between the parties. Where personal data is processed, the outsourcing provider is generally a processor and a contract under article 28 of the General Data Protection Regulation is required.
Article 28 of Regulation (EU) 2016/679
Your question is not here
Put it directly. Recurring questions are added to this page.