Intelligence artificielle: Luxembourg (2026)
As an EU member state, Luxembourg is directly bound by the EU AI Act, whose prohibitions on unacceptable-risk AI have applied since 2 February 2025, GPAI rules since 2 August 2025, and the general regime (including high-risk and transparency obligations) since 2 August 2026. National implementing Bill 8476 (deposited 23 December 2024) to designate competent authorities and sanctions remains pending before Parliament following the Conseil d'État's opinion of 10 July 2026, but authorities (notably CNPD, CSSF, CAA, ILR, ILNAS) are already acting under their existing sectoral mandates. Luxembourg complements this with its 2025 National AI Strategy under the 'Accelerating Digital Sovereignty 2030' initiative.
Cadre principal
EU AI Act (Regulation (EU) 2024/1689), directly applicable; national implementing Bill 8476 pending before the Chamber of Deputies designates the CNPD as default market surveillance authority and single point of contact, complemented by the National AI Strategy (Accelerating Digital Sovereignty 2030, 2025)
Points clés
Directly applicable EU AI Act
Regulation (EU) 2024/1689 (AI Act) applies directly in Luxembourg without transposition; its risk-tiered rules (banned practices from Feb 2025, GPAI from Aug 2025, high-risk & transparency from 2 Aug 2026) are already enforceable.
National implementing Bill 8476 (pending)
Bill n°8476 was deposited on 23 December 2024 to designate national competent authorities, create sanctions mirroring EU ceilings, and adjust existing laws; the Conseil d'État delivered its opinion on 10 July 2026 and the bill is still in committee (Médias et Communications) as of October 2026.
CNPD as central AI authority
Under Bill 8476 the Commission nationale pour la protection des données (CNPD) is designated as default market surveillance authority, national single point of contact for the AI Act, authority for fundamental-rights-protection in high-risk AI, and responsible for the regulatory sandbox; it also oversees AI/GDPR interplay via its Sandkëscht sandbox (launched 24 May 2024).
Sectoral competent authorities
The Commission de Surveillance du Secteur Financier (CSSF) supervises AI in regulated financial entities, the Commissariat aux Assurances (CAA) handles the insurance sector, the Institut Luxembourgeois de Régulation (ILR) covers high-risk AI used by NIS2 essential/important entities, and ILNAS is the notifying authority for conformity assessment bodies.
National AI Strategy 2025
On 19 May 2025 the government unveiled 'Accelerating Digital Sovereignty 2030', a triptych of national strategies on data, AI and quantum, with the National AI Strategy aiming to make Luxembourg a European hub for ethical, human-centric AI, backed by dedicated 2025-2030 budget lines.
Horizontal EU framework overlay
AI deployments in Luxembourg must also comply with GDPR (enforced by CNPD), the EU Data Act, DSA, NIS2 and sector-specific EU financial regulation; CNPD's 2024 Annual Report (published Sept 2025) confirms AI compliance is now central to its supervisory agenda.
Cette page est une traduction fournie à titre indicatif ; la version anglaise fait foi et ne constitue pas un avis juridique.