Cloud AI Explained: A Practical Guide for Portugal

Cloud AI is the delivery of machine learning workloads — model training, fine-tuning, and inference — through managed cloud services and GPU infrastructure rather than owned hardware. For engineering teams in Portugal and the rest of the EU, it collapses into three concrete decisions: which managed platform to standardize on, how to control per-request and per-GPU cost, and how to satisfy the EU AI Act and GDPR obligations that attach to the data a model touches. The framework that makes those decisions consequential is the EU AI Act, formally Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024, the first comprehensive legal framework laying down harmonised rules on artificial intelligence worldwide.

What Cloud AI Actually Means

A cloud AI service delivers three primitives: compute instances with attached accelerators, a managed training runtime that handles distributed data parallelism and checkpointing, and a serving runtime that exposes a model behind an HTTP or gRPC endpoint with autoscaling. The practical difference between platforms is not raw capability — all three can train and serve a model — but integration gravity: the platform that already holds your data lake and identity layer usually wins the procurement decision. Amazon SageMaker bundles these primitives under one console, marketed as the next generation center for all your data, analytics, and AI with fully managed infrastructure, tools, and workflows spanning the entire machine learning lifecycle. Azure Machine Learning mirrors the same trio with tight integration into the Microsoft cloud, responsible-AI tooling, and MLOps pipelines that track every run from notebook to endpoint. Google’s platform, now rebranded Gemini Enterprise Agent Platform (formerly Vertex AI), exposes more than two hundred Google and third-party models in a Model Garden alongside custom training and tuning.

Three Deployment Paths Compared

Teams choose one of three deployment shapes; the cost gap between them is wide.

Deployment path	What you manage	Primary cost lever	Best fit
Fully managed model API	Prompts and schemas only	Per-million-token routing	Low-volume prototyping
Managed training and serving	Model code and data	GPU instance type and utilization	Stable production, custom models
Self-hosted on GPU VMs	Drivers, serving stack, autoscaling	Commit discounts and spot capacity	High-volume inference, residency

The per-token API path is the cheapest way to start but the most expensive way to scale, because pricing scales linearly with usage. On Google’s platform, for example, text, chat, and code generation is metered starting at $0.0001 per 1,000 characters, a rate that compounds quickly at production volume. Self-hosting inverts that curve: fixed infrastructure cost stays flat while request volume grows, which is why high-throughput workloads move to GPU virtual machines with a serving framework such as vLLM. Data-residency rules can force that path earlier than economics suggest, and GPU spot capacity demands checkpointing discipline to keep its savings.

AI Act Timeline Now in Force

Cloud AI decisions for Portuguese teams cannot be separated from the regulatory clock. The AI Act entered into force on 1 August 2024 and becomes fully applicable two years later, on 2 August 2026. The obligations did not arrive all at once: prohibited AI practices and AI literacy duties entered into application from 2 February 2025, and the governance rules together with the obligations for general-purpose AI models became applicable on 2 August 2025. The transparency rules of the AI Act — covering chatbot disclosure and labelling of AI-generated content — come into effect in August 2026. In November 2025 the Commission proposed targeted amendments known as the AI omnibus, and in May 2026 a political agreement to simplify AI rules was reached, but the core risk-based structure remains intact.

Risk Tiers and Deployer Obligations

The AI Act defines four levels of risk for AI systems, and where a cloud AI workload sits determines who must do what. Unacceptable-risk systems are banned outright, including social scoring and untargeted facial-recognition database scraping. High-risk systems — covering critical infrastructure safety components, employment and CV-sorting tools, credit scoring, and certain law-enforcement uses — must carry risk assessment, high-quality datasets, activity logging, detailed documentation, human oversight, and robust cybersecurity before they reach the market. Limited-risk systems trigger transparency duties: a deployer must tell users they are interacting with a chatbot, and providers of generative AI must make AI-generated content identifiable. Minimal-risk systems face no additional rules. For a Lisbon team, the common outcome is a transparency duty plus GDPR alignment, but that classification must be documented.

EU Compute and AI Factories

Cost and sovereignty are not only a function of hyperscaler pricing. The European Commission has built an alternative compute layer through AI Factories, linking EuroHPC supercomputing, data, and talent for generative AI. As of 2026, nineteen AI Factories and thirteen Antennas are operational across the EU, prioritizing access for AI startups and SMEs. The InvestAI Facility will provide a new European fund of €20 billion to create up to five AI Gigafactories, large-scale facilities that bring together computing power of over 100,000 advanced AI processors to train next-generation models. The Commission also runs an AI Act Service Desk to support a smooth and effective implementation of the AI Act across the EU, which is the first stop when a classification is unclear. Portuguese researchers and SMEs can apply for EuroHPC computing time through these factories when a workload is too sensitive or too large for commercial cloud regions.

Deployment Checklist Before You Ship

Run through this ordered checklist before moving a cloud AI workload into production:

Classify the model against the four AI Act risk tiers and document the rationale in writing.
Map data sources; keep sensitive data in GDPR-compliant EU regions.
Choose the cheapest path meeting latency and residency needs.
Track per-request cost and GPU utilization from day one — traditional FinOps tooling was not built for token-based billing.
Add oversight and logging for employment, credit, or essential-services use.
Plan checkpointing before relying on spot GPU capacity.