AI laws and regulation in Luxembourg

Medium.

There is no dedicated national legislative act governing AI in Luxembourg. However, Luxembourg is directly subject to the Regulation (EU) 2024/1689 – Artificial Intelligence Act (“EU AI Act”), which establishes harmonised rules for AI across all EU member states. The Act introduces a risk-based approach, banning certain harmful AI practices, and imposes strict obligations on high-risk and general-purpose AI systems.

Bill of law 8476 was submitted to the Parliament on 23 December 2024 and supplements the EU AI Act with the necessary national provisions. These include designating the national authorities responsible for applying and supervising the EU AI Act and establishing administrative penalties.

Other relevant laws that govern AI-related activities are:

• General Product Safety Regulation: Law of 28 February 2025 sets out the rules for the application of Regulation (EU) 2023/988.
• Cybersecurity and operational resilience: Bill of law 8364 transposes (NIS 2).

Among the sectors that govern AI-related activities, the following should be considered:

• AI in the autonomous conduct:  The Luxembourg Government supports the intelligent mobility sector by implementing a strategy for automated and connected driving. It plans to develop a legal framework to regulate the various aspects of the use of vehicles equipped with automation systems and draft grand-ducal regulation 8544 regarding the framework for the deployment of intelligent transport systems in the field of road transport and interfaces with other modes of transport is under discussion.
• IA and online services, platforms, and content: Law of 4 April 2025 sets out rules for the application of Regulation (EU) 2022/2065 on a single market for digital services (DSA) and Law of 29 March 2023 amended the Law of 30 November 2022 on competition with a view to implementing Regulation (EU) 2022/1925 (DMA).

Oversight of AI is shared between several bodies:

• the National Commission for Data Protection (the “CNPD”) is designated as notifying authority.
• Each sectorial authorities are designated as market surveillance authority. However, the CNPD is responsible for coordinating the each sectoral authority, acting as the single point of contact and default market surveillance authority.

There are several publications that are relevant:

• CNPD published several information articles on the interplay between artificial intelligence and data protection.
• The CSSF (financial authority) have launched a dedicated webpage containing thematic review, white papers and Q/As related to AI.

Luxembourg does not currently  reference international AI standards of guidelines locally. 

Bill of law 8476 was submitted to the Parliament on 23 December 2024 and is still under discussion.

The date of its adoption cannot be anticipated at this stage.

• AI and Funds  https://cms.law/en/lux/publication/cms-funds-group-back-to-basics-briefings/ai-and-funds
• AI Internal Governance in the Financial Sector  https://cms.law/en/lux/events/ai-internal-governance-in-the-financial-sector 
• EU AI Act - Questions and Answers