The EU AI Act (Regulation 2024/1689) applies directly in Luxembourg as in all EU member states. Unlike the GDPR, which required national implementation laws, the AI Act's core obligations take effect uniformly across the EU.
High-risk AI systems deployed or provided in Luxembourg must complete conformity assessment (Article 43), maintain technical documentation (Article 11), implement risk management (Article 9), and register in the EU database (Article 60). The compliance date for Annex III high-risk systems is 2 December 2027, set by the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27 July 2026; originally 2 August 2026). Article 50 transparency obligations were not postponed and have applied since 2 August 2026.
Commission Nationale pour la Protection des Données (CNPD) will serve as the national market surveillance authority for AI Act enforcement in Luxembourg. This authority will have powers to inspect, audit, and impose penalties on non-compliant AI systems.
Prohibited AI practices under Article 5 (social scoring, subliminal manipulation, real-time biometric identification in public spaces) are banned in Luxembourg as in all EU member states, with limited law enforcement exceptions.
Penalties for non-compliance range up to EUR 35 million or 7% of global annual turnover (whichever is higher) for prohibited practices, and up to EUR 15 million or 3% for other violations (Article 99).