AI regulation in Luxembourg: laws & policy (2026)
AI in Luxembourg: comprehensive law.
As an EU member state, Luxembourg is directly bound by the EU AI Act, whose prohibitions on unacceptable-risk AI have applied since 2 February 2025, GPAI rules since 2 August 2025, and the general regime (including high-risk and transparency obligations) since 2 August 2026. National implementing Bill 8476 (deposited 23 December 2024) to designate competent authorities and sanctions remains pending before Parliament following the Conseil d'État's opinion of 10 July 2026, but authorities (notably CNPD, CSSF, CAA, ILR, ILNAS) are already acting under their existing sectoral mandates. Luxembourg complements this with its 2025 National AI Strategy under the 'Accelerating Digital Sovereignty 2030' initiative.
Legal framework
EU AI Act (Regulation (EU) 2024/1689), directly applicable; national implementing Bill 8476 pending before the Chamber of Deputies designates the CNPD as default market surveillance authority and single point of contact, complemented by the National AI Strategy (Accelerating Digital Sovereignty 2030, 2025)
The EU AI Act in Luxembourg
In Luxembourg, artificial intelligence is governed by the EU AI Act, the first comprehensive AI law, which applies directly as an EU regulation.
- Framework
- the EU AI Act (Regulation (EU) 2024/1689)
- Approach
- risk-based: unacceptable-risk AI is banned, high-risk AI faces strict duties, limited-risk AI has transparency rules
- General-purpose AI
- transparency duties for all GPAI models; systemic-risk models add safety and evaluation obligations
- Timeline
- phased: prohibitions from Feb 2025, GPAI rules from Aug 2025, most high-risk obligations from Aug 2026
- Maximum fine
- €35 million or 7% of global annual turnover for prohibited-AI breaches
- Oversight
- national market-surveillance authorities, coordinated by the EU AI Office
The AI Act is an EU regulation applied directly in Luxembourg; national market-surveillance authorities handle enforcement.
Key points: artificial intelligence in Luxembourg
Directly applicable EU AI Act
Regulation (EU) 2024/1689 (AI Act) applies directly in Luxembourg without transposition; its risk-tiered rules (banned practices from Feb 2025, GPAI from Aug 2025, high-risk & transparency from 2 Aug 2026) are already enforceable.
National implementing Bill 8476 (pending)
Bill n°8476 was deposited on 23 December 2024 to designate national competent authorities, create sanctions mirroring EU ceilings, and adjust existing laws; the Conseil d'État delivered its opinion on 10 July 2026 and the bill is still in committee (Médias et Communications) as of October 2026.
CNPD as central AI authority
Under Bill 8476 the Commission nationale pour la protection des données (CNPD) is designated as default market surveillance authority, national single point of contact for the AI Act, authority for fundamental-rights-protection in high-risk AI, and responsible for the regulatory sandbox; it also oversees AI/GDPR interplay via its Sandkëscht sandbox (launched 24 May 2024).
Sectoral competent authorities
The Commission de Surveillance du Secteur Financier (CSSF) supervises AI in regulated financial entities, the Commissariat aux Assurances (CAA) handles the insurance sector, the Institut Luxembourgeois de Régulation (ILR) covers high-risk AI used by NIS2 essential/important entities, and ILNAS is the notifying authority for conformity assessment bodies.
National AI Strategy 2025
On 19 May 2025 the government unveiled 'Accelerating Digital Sovereignty 2030', a triptych of national strategies on data, AI and quantum, with the National AI Strategy aiming to make Luxembourg a European hub for ethical, human-centric AI, backed by dedicated 2025-2030 budget lines.
Horizontal EU framework overlay
AI deployments in Luxembourg must also comply with GDPR (enforced by CNPD), the EU Data Act, DSA, NIS2 and sector-specific EU financial regulation; CNPD's 2024 Annual Report (published Sept 2025) confirms AI compliance is now central to its supervisory agenda.
The EU AI Act in Luxembourg: FAQ
Does the EU AI Act apply in Luxembourg?
Yes. As an EU member, Luxembourg is covered by the EU AI Act (Regulation (EU) 2024/1689), which applies directly.
What does the EU AI Act regulate in Luxembourg?
It uses a risk-based approach: unacceptable-risk AI is banned, high-risk AI faces strict obligations, and general-purpose AI models carry transparency duties.
When does the EU AI Act take effect in Luxembourg?
It is phased: prohibitions applied from February 2025, general-purpose-AI rules from August 2025, and most high-risk obligations from August 2026.
What are the penalties under the EU AI Act in Luxembourg?
Up to €35 million or 7% of global annual turnover for breaching the prohibited-AI rules, with lower tiers for other breaches.
Timeline of decisions
- Guidance · officialGovernment and CNPD host 'AI Act in Action' conference on implementation
Minister Elisabeth Margue and the CNPD convened stakeholders to bridge AI Act policy and practice, signalling the move from legislation to operational enforcement as the national supervisory architecture takes shape. It marks Luxembourg's shift toward active oversight ahead of the high-risk regime in August 2026.
Luxembourg Government (gouvernement.lu)
- Guidance · officialCNPD 2024 annual report puts AI at the heart of its mission
The data protection authority's annual report formalised AI governance as a core supervisory priority, reflecting its expanded mandate as Luxembourg's prospective national AI authority. It documents the regulator's pivot from pure GDPR enforcement toward AI Act readiness.
CNPD
- Law · officialAI Act obligations on general-purpose AI and governance take effect
New EU AI Act obligations (notably for general-purpose AI models) became applicable, the date by which member states had to designate competent authorities. Luxembourg's CNPD is positioned as the default market surveillance authority and single point of contact.
CNPD
- Guidance · officialLuxembourg launches national AI strategy 'Accelerating Digital Sovereignty 2030'
Ministers Margue, Obertin and Delles presented coordinated national strategies on data, AI and quantum, with the AI strategy targeting trustworthy, human-centric AI, a national AI Factory, regulatory sandboxes and sector adoption. It sets Luxembourg's policy roadmap and budget commitments through 2030.
Luxembourg Government (gouvernement.lu)
- Law · officialFirst AI Act bans and AI-literacy duties become applicable in Luxembourg
As an EU member, Luxembourg became bound by the AI Act's prohibitions on 'unacceptable risk' practices (e.g. social scoring, subliminal manipulation) and operator AI-literacy requirements. The CNPD issued thematic guidance on the impact of prohibited systems on data protection.
CNPD
- Law · officialBill 8476 designates the CNPD as national AI authority
The government tabled draft law n°8476 to supplement the EU AI Act, naming the CNPD as default market surveillance authority and coordinator of sectoral regulators, with administrative penalties for non-compliance. It chose to extend existing bodies rather than create a new regulator.
CNPD
- Guidance · officialLuxembourg publishes 'Artificial Intelligence: a strategic vision'
The government released its first national AI strategy, framing a human-centric, ethics-led and data-driven vision aligned with EU values. It laid the foundational policy direction later built upon by the 2025 'Digital Sovereignty 2030' strategy.
Luxembourg Government (gouvernement.lu)
- Guidance · officialLuxembourg adheres to the OECD AI Principles
Luxembourg joined the OECD Recommendation on Artificial Intelligence, committing to trustworthy, human-centric AI principles. This international anchor shaped the country's subsequent alignment with the EU's trustworthy-AI agenda.
OECD
Sources
- eur-lex.europa.eu/eli/reg/2024/1689/oj
- chd.lu/fr/dossier/8476
- cnpd.public.lu/en/actualites/national/2025/09/rapport-annuel-2024.html
- pinsentmasons.com/out-law/news/luxembourg-law-addresses-eu-ai-act-enforcement
- arendt.com/news-insights/news/new-luxembourg-bill-designates-national-authoritie
- loyensloeff.com/insights/news--events/news/ai-act-and-data-act-the-cnpd-at-the-forefr
- bsp.lu/lu/publications/newsletters-newsflashes/ai-i-luxembourg-draft-law-imp
- cs-avocats.lu/corporate/luxembourgs-draft-law-no-8476-implementing-the-eu-ai-act/
- luxinnovation.lu/news/government-unveils-strategic-initiative-accelerating-digital-sov
- innovative-initiatives.public.lu/stories/luxembourgs-ai-strategy-11
- lexology.com/library/detail.aspx?g=55063ceb-3752-4787-94e3-95bae440431b
Next for Luxembourg: Data & PrivacyComprehensive law
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 20 Oct 2026. Methodology & how to cite · State of Technology Regulation 2026