PRR: From shopping to smartness. Project PT Smart Retail redesigned the future of retail

What if buying a snack, grabbing lunch, or doing the weekly groceries didn’t require queues, cashiers, or even a checkout line?

This is not a scene from a sci-fi movie. It is already happening, in Portugal! The world’s largest intelligent retail store— a 1,200 square meter space operated by Continente—opened earlier this year in Leiria, showcasing the very technologies being developed through PT Smart Retail. This PRR-funded mobilizing project will transform the way we shop, consume, and interact with physical retail spaces.

On this project, INESC-ID has a key role in dealing with the privacy and security of this future. Under the internal coordination of researcher Nuno Santos, from Distributed, Parallel and Secure Systems, the initiative brings together 19 partners, from startups to tech providers, universities, and major retailers like Continente and Galp.

At the helm of the consortium is Sensei, a Portuguese tech company already pioneering autonomous retail experiences. But the goal of PT Smart Retail goes far beyond existing proof-of-concept stores. With an investment of over €31 million, the project aspires to deliver a new generation of intelligent, autonomous, and sustainable retail—from futuristic vending machines to fully operational cashierless stores, all powered by national technology.

Launched in 2022 and running through the end of 2024, PT Smart Retail is part of Portugal’s broader Recovery and Resilience Plan (PRR), aiming to build national capacity in high-tech, high-impact sectors. In the retail domain, that means: Designing autonomous and hybrid store formats, developing “pods” that can be deployed in remote or high-traffic areas, introducing Zero Waste Cabinets that reinvent the vending machine experience and creating peripheral technologies to enhance user interaction and sustainability.

Each innovation is based in seamless, contactless, and user-centric shopping experiences—think of walking into a shop, picking up your items, and walking out without scanning a single barcode. The rest is up to the system.

“Our role in the project is very focused. We’re working on the privacy and security side—anticipating problems that might not be critical for the pilot store today but will be essential if this technology is to scale nationally or internationally.” – Nuno Santos

But as this vision moves closer to reality, critical questions arise: How do we ensure customer privacy? Who has access to video data? How secure is the underlying AI? That’s where INESC-ID comes in.

“Our role in the project is very focused,” explains Nuno Santos, Principal Investigator at INESC-ID and Professor at Técnico. “We’re working on the privacy and security side—anticipating problems that might not be critical for the pilot store today but will be essential if this technology is to scale nationally or internationally.”

Indeed, the transition to intelligent retail systems introduces layers of complexity—technically, ethically, and legally. Every sensor, every camera, and every line of code collecting customer behavior must comply with GDPR, safeguard identity, and protect sensitive data from leaks or misuse.

To solve these challenges, the INESC-ID team is developing solutions across five research vectors:

1. Privacy-preserving Video Processing

In smart stores, camera footage is essential for tracking customer movement and product selection. But how can we do this without violating privacy?

INESC-ID’s answer is to transform video feeds into anonymized skeletal models, abstracting individuals into motion paths instead of identities. In some cases, the team goes further—applying visual obfuscation techniques that reduce people to blurred silhouettes, while still enabling operators to debug the system when needed.

2. Trusted Video Stream Processing

The software that powers smart retail—including the AI models for object recognition and movement tracking—runs on edge servers located inside stores. These are valuable intellectual property assets for companies like Sensei. But how can they ensure this code isn’t reverse-engineered or tampered with, especially in international deployments?

INESC-ID is exploring hardware-based secure enclaves that encrypt and shield algorithms from unauthorized access, even when deployed in less trusted environments.

3. Data Provenance and Auditability

With thousands of data points flowing through these systems daily, it’s essential to prove that the algorithms act fairly and legally. INESC-ID is working on cryptographic methods to ensure traceability—demonstrating that a particular transaction was computed using valid data, from legitimate sensors, using trusted code.

This will be crucial for compliance auditing, especially in the context of the AI Act in Europe.

4. Network and Communication Security

A smart retail system involves dozens of sensors communicating in real-time with local servers and cloud backends. This creates vulnerabilities: from spoofing attacks that fake product scans to malicious devices planted in stores.

To address this, INESC-ID is developing secure communication protocols and monitoring tools that can detect anomalies in sensor behavior and network traffic.

5. Web Application Security

The final layer of the stack includes web-based dashboards, APIs, and customer-facing apps. These are often the most visible points of contact—and the most vulnerable to attacks.

INESC-ID’s researchers are conducting code audits and developing automated tools to detect and patch vulnerabilities in retail web applications before they can be exploited.

“The problems we’re solving in PT Smart Retail are not just relevant to retail,” says Nuno Santos. “They apply to surveillance in public spaces, stadiums, smart cities. The anonymization and secure processing of visual data is a broader societal challenge.”

Ultimately, PT Smart Retail is not just about automating shopping. It’s about building trust in an era where technology is everywhere and often invisible. “When we used to shop at a neighborhood store, trust was physical, the shopkeeper knew us. Today, that trust has to be engineered into the system”, Nuno Santos notes.

By combining cutting-edge AI with responsible data practices, PT Smart Retail aims to become a global reference for intelligent, privacy-first retail. And INESC-ID’s work is central to making that happen.

News