Lagging LU Verified 21 Oct 2026

Luxembourg

EU AI Act implementation, 2026

Luxembourg's AI Act implementing bill (projet de loi 8476, filed 23 December 2024) that would make the CNPD the general market surveillance authority and single point of contact is still in committee after a second Council of State opinion on 10 July 2026 raising formal objections; no authority, penalty regime or sandbox is legally in place as of October 2026.

Implementing law
Draft billDec 2024
Penalty regime (Art. 99)
Not adopted
Regulatory sandbox
Planned
Readiness rank
17 of 27score 40 / 100

Key findings

  • No Luxembourg authority is legally designated under the AI Act as of 21 October 2026; bill 8476 has been pending since 23 December 2024 and was still in committee after the Council of State's second opinion of 10 July 2026.
  • The proposed model centres on the CNPD as default market surveillance authority, coordinator, single point of contact and sandbox operator, with CSSF, CAA, ILNAS, ILR, ALIA and the judicial control authority in sectoral roles.
  • The bill's Article 16 penalty regime mirrors Article 99 ceilings (EUR 35m/7%, 15m/3%, 7.5m/1%) and drew no objection from the Council of State, but is not in force.
  • The Council of State raised formal oppositions on the CSSF's scope, on regulatory powers for non-public-establishment authorities (Article 9) and on inexact cross-references, and reserved dispensation from the second constitutional vote pending the medicines-agency law; these must be resolved before a vote with dispensation.
  • Luxembourg has a 2025 national AI strategy and major compute investments (MeluXina-AI, AI Factory) but no regulatory sandbox, because the enabling law is not adopted.

National authorities

Market surveillance

Commission nationale pour la protection des données (CNPD)

Proposed general (default) market surveillance authority, coordinator of the other authorities, single point of contact and operator of the mandatory national AI sandbox. Not yet enacted; the Commission lists it as 'pending'.

chd.lu (opens in new tab)
Market surveillance

Commission de surveillance du secteur financier (CSSF) and Commissariat aux assurances (CAA)

Proposed market surveillance for AI systems directly linked to the financial and insurance services of their supervised entities (Art. 74(6)); the Council of State demanded the CSSF scope be narrowed to match Article 74(6) on pain of formal opposition.

wdocs-pub.chd.lu (opens in new tab)
Market surveillance

ILNAS, Institut luxembourgeois de régulation (ILR), ALIA, Autorité de contrôle judiciaire, future Agence luxembourgeoise des médicaments et produits de santé

Proposed sectoral market surveillance: ILNAS for certain Annex I product categories and critical infrastructure, ILR for essential/important entities' obligations, ALIA for certain transparency rules including deepfakes, the judicial control authority for court AI systems, the medicines agency for its domain.

paperjam.lu (opens in new tab)
Notifying authority

Proposed: ILNAS (Office luxembourgeois d'accréditation et de surveillance), the Agence luxembourgeoise des médicaments et produits de santé, and the Commissariat du Gouvernement à la protection des données auprès de l'État – not enacted

artificialintelligenceact.eu (opens in new tab)
Single point of contact (Art. 70(2))

CNPD (proposed; marked 'pending' on the European Commission's list as of 7 September 2026)

Implementing law, penalties and sandbox

Implementing law Draft bill

Projet de loi n° 8476 portant mise en œuvre de certaines dispositions du règlement (UE) 2024/1689 (règlement sur l'intelligence artificielle) et portant modification de la loi du 1er août 2018 (CNPD), de la loi du 23 décembre 1998 (CSSF) et de la loi du 7 décembre 2015 (secteur des assurances)

Dec 2024

chd.lu (opens in new tab)
Penalty regime Not adopted

No national penalty rules under Article 99 are in force; regulators rely on existing powers.

Regulatory sandbox Planned

Article 12 of bill 8476 would allow national authorities to set up AI regulatory sandboxes and oblige the CNPD to run at least one; the Council of State's 10 July 2026 opinion notes the 2 August 2026 Article 57 deadline (since moved to 2 August 2027 by the Digital Omnibus). No sandbox is operational because the enabling law is not adopted.

wdocs-pub.chd.lu (opens in new tab)
National AI strategy

Luxembourg's Artificial Intelligence Strategy (Accelerating Digital Sovereignty 2030)

2025

gouvernement.lu (opens in new tab)

Notable developments

  1. Bill 8476 filed with the Chamber of Deputies

    The government deposited the AI Act implementing bill on 23 December 2024, designating the CNPD as default market surveillance authority, coordinator and single point of contact, with CSSF, CAA, ILNAS, ILR, ALIA and others in sectoral roles and a penalty regime mirroring Article 99 ceilings.

    arendt.com (opens in new tab)

  2. National AI strategy published

    The government published its AI strategy in May 2025 as part of 'Accelerating Digital Sovereignty 2030', built on six enablers (skills, infrastructure, service ecosystem, R&D, governance, international collaboration) with flagship projects including the AI Factory and MeluXina-AI.

    gouvernement.lu (opens in new tab)

  3. Council of State issues second opinion with formal objections

    On 10 July 2026 the Conseil d'État (no. CE 62.024) opined on the bill as amended. Under threat of formal opposition it demanded that the CSSF's competence be limited to AI systems directly linked to financial services (Art. 74(6)) and that cross-references in Article 14 be exact; it formally opposed Article 9(2)-(3) conferring regulatory power on administrations that are not public establishments; it asked that the sandbox provision (Article 12) name the notifying and market surveillance authorities of Articles 2 and 7; and it reserved its dispensation from the second constitutional vote pending the law creating the medicines agency. It found Article 16(1)-(2) implementing Article 99(1) unobjectionable and the remaining Article 16 paragraphs superfluous.

    wdocs-pub.chd.lu (opens in new tab)

  4. Luxembourg enters 2 August 2026 without a designated AI supervisor

    Paperjam reported on 30 July 2026 that, three days before the AI Act's governance and penalty provisions applied, bill 8476 was still 'en commission', the sandbox law was not adopted, and Luxembourg had no AI 'gendarme', in contrast to Ireland's newly created AI Office.

    paperjam.lu (opens in new tab)

  5. Commission list still shows CNPD as pending

    The Commission's market surveillance authorities page (updated 7 September 2026) lists the CNPD for Luxembourg with the designation marked pending.

    digital-strategy.ec.europa.eu (opens in new tab)

Analysis

Luxembourg drafted early and legislated slowly. The government filed bill 8476 in December 2024, before most member states had a text, and its design is clean: the data protection authority (CNPD) becomes the default AI market surveillance authority, coordinator and European contact point, while the financial, insurance, product, telecoms, media and judicial regulators keep AI systems in their domains. The Council of State's first opinion in 2025 and a second opinion on government amendments on 10 July 2026 show the text has been reworked, but twenty-two months after filing it remains in committee.

The second opinion matters because Luxembourg's constitutional procedure effectively requires the Council of State to lift its formal oppositions before the Chamber can vote with dispensation from the second vote. The July 2026 opinion still contains formal oppositions, notably that the CSSF's competence must be narrowed to AI systems directly linked to financial services, as Article 74(6) requires, and that cross-references be exact. These are technical rather than political, which suggests the delay is capacity and sequencing rather than disagreement, but they still block enactment.

The consequence is that a financial centre whose banks, funds and insurers are squarely within the AI Act's high-risk scope entered 2 August 2026 with no national authority empowered to receive complaints, no national fine schedule and no sandbox, as Paperjam's 'Luxembourg cherche son gendarme' headline put it. The Digital Omnibus deferral of high-risk obligations to December 2027 and of the sandbox deadline to August 2027 gives Parliament breathing room, and the CNPD already supervises AI through the GDPR, but on the schema's measures Luxembourg remains at the draft stage.

PDF edition

EU AI Act 2026 Q3 Report

All 27 member-state profiles including Luxembourg, the readiness ranking, the Omnibus timeline and every source, as one print-ready PDF.

* You will also be subscribed to my newsletter. No spam, unsubscribe any time.

Sources

  1. Commission nationale pour la protection des données (CNPD) (opens in new tab) chd.lu
  2. Commission de surveillance du secteur financier (CSSF) and Commissariat aux assurances (CAA) (opens in new tab) wdocs-pub.chd.lu
  3. ILNAS, Institut luxembourgeois de régulation (ILR), ALIA, Autorité de contrôle judiciaire, future Agence luxembourgeoise des médicaments et produits de santé (opens in new tab) paperjam.lu
  4. Notifying authority: Proposed: ILNAS (Office luxembourgeois d'accréditation et de surveillance), the Agence luxembourgeoise des médicaments et produits de santé, and the Commissariat du Gouvernement à la protection des données auprès de l'État – not enacted (opens in new tab) artificialintelligenceact.eu
  5. Luxembourg's Artificial Intelligence Strategy (Accelerating Digital Sovereignty 2030) (opens in new tab) gouvernement.lu
  6. Bill 8476 filed with the Chamber of Deputies (opens in new tab) arendt.com
  7. Commission list still shows CNPD as pending (opens in new tab) digital-strategy.ec.europa.eu