	AI Legislative Guide
	Luxembourg
	(Europe) Firm Arendt & Medernach Contributors Astrid Wagner Updated 13 Aug 2025
Has specific legislation, final regulations or other formal regulatory guidance addressing the use of AI in your jurisdiction been implemented (vs reliance on existing legislation around IP, cyber, data privacy, etc.)?	No. However, on 23 December 2024, the Luxembourg government submitted Bill of law n°8476, which is currently still under discussion in Parliament.
Please provide a short summary of the legislation/regulations/guidance and explain how legislators aim to strike the balance between innovation and regulation.	This Bill of law n°8476 is a pivotal step in aligning Luxembourg’s legal framework with the Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence. Its primary objective is to designate the national competent authorities responsible for the enforcement and oversight of the AI Act.
Which agency regulates the use of AI in your jurisdiction?	Under the Bill of Law n°8476, the following market surveillance authorities will be appointed to regulate the use of AI in Luxembourg: The National Commission for Data Protection (CNPD). The CNPD will be the default market surveillance authority and serve as the primary point of contact in Luxembourg. The CNPD will also coordinate activities across the remaining market surveillance authorities in order to facilitate collaboration between sector-specific authorities and EU institutions. The following other market surveillance authorities are designated as exceptions to the CNPD’s jurisdiction: The Judicial Supervisory Authority (JSA): The JSA will monitor compliance of AI systems used by judicial courts, prosecution services, and the administrative order in the performance of its judicial functions. The Financial Sector Supervisory Commission (CSSF): The CSSF will supervise the use of AI systems by entities under its supervision. It will, additionally, be conducting risk assessments and audits to ensure compliance with financial regulations as well as the AI Act. The Supervisory Authority for the Insurance Sector (CAA): The CAA will monitor AI systems used by entities under its supervision and investigate practices involving bias or discrimination in AI-driven insurance decisions. The Luxembourg Institute for Standardization, Accreditation, Safety, and Quality (ILNAS): The ILNAS will oversee AI systems for markets listed in points 1 to 10 of Annex I [9], provided the AI systems meet the conditions of Article 6(1) of the AI Act and point 2 of Annex III, which concerns products used in critical infrastructure. The Luxembourg Institute of Regulation (ILR): The ILR is designated as the market surveillance authority for compliance with Article 26 of the AI Act regarding obligations for deployers of high-risk AI systems. This applies to operators of essential or important services under the future NIS2 implementing law, without prejudice to the CSSF’s role under the same law. The Luxembourg Agency for Medicines and Health Products (ALMPS): ALMPS will supervise the use of AI in medical devices and in vitro diagnostic medical devices (markets listed in points 11 and 12 of Annex 1) provided the AI systems meet the conditions of Article 6(1) of the AI Act. The Luxembourg Independent Audiovisual Authority (ALIA): ALIA will monitor the compliance with article 50 paragraphs 2 and 4 of the AI Act (i.e. transparency obligations of (i) providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated and (ii) deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake, shall disclose that the content has been artificially generated or manipulated).

AI Legislative Guide

Back XLS

Has specific legislation, final regulations or other formal regulatory guidance addressing the use of AI in your jurisdiction been implemented (vs reliance on existing legislation around IP, cyber, data privacy, etc.)?

No. However, on 23 December 2024, the Luxembourg government submitted Bill of law n°8476, which is currently still under discussion in Parliament.

Please provide a short summary of the legislation/regulations/guidance and explain how legislators aim to strike the balance between innovation and regulation.

This Bill of law n°8476 is a pivotal step in aligning Luxembourg’s legal framework with the Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence. Its primary objective is to designate the national competent authorities responsible for the enforcement and oversight of the AI Act.

Which agency regulates the use of AI in your jurisdiction?

Under the Bill of Law n°8476, the following market surveillance authorities will be appointed to regulate the use of AI in Luxembourg:

The National Commission for Data Protection (CNPD). The CNPD will be the default market surveillance authority and serve as the primary point of contact in Luxembourg. The CNPD will also coordinate activities across the remaining market surveillance authorities in order to facilitate collaboration between sector-specific authorities and EU institutions.

The following other market surveillance authorities are designated as exceptions to the CNPD’s jurisdiction:
- The Judicial Supervisory Authority (JSA): The JSA will monitor compliance of AI systems used by judicial courts, prosecution services, and the administrative order in the performance of its judicial functions.
- The Financial Sector Supervisory Commission (CSSF): The CSSF will supervise the use of AI systems by entities under its supervision. It will, additionally, be conducting risk assessments and audits to ensure compliance with financial regulations as well as the AI Act.
- The Supervisory Authority for the Insurance Sector (CAA): The CAA will monitor AI systems used by entities under its supervision and investigate practices involving bias or discrimination in AI-driven insurance decisions.
- The Luxembourg Institute for Standardization, Accreditation, Safety, and Quality (ILNAS): The ILNAS will oversee AI systems for markets listed in points 1 to 10 of Annex I [9], provided the AI systems meet the conditions of Article 6(1) of the AI Act and point 2 of Annex III, which concerns products used in critical infrastructure.
- The Luxembourg Institute of Regulation (ILR): The ILR is designated as the market surveillance authority for compliance with Article 26 of the AI Act regarding obligations for deployers of high-risk AI systems. This applies to operators of essential or important services under the future NIS2 implementing law, without prejudice to the CSSF’s role under the same law.
- The Luxembourg Agency for Medicines and Health Products (ALMPS): ALMPS will supervise the use of AI in medical devices and in vitro diagnostic medical devices (markets listed in points 11 and 12 of Annex 1) provided the AI systems meet the conditions of Article 6(1) of the AI Act.
- The Luxembourg Independent Audiovisual Authority (ALIA): ALIA will monitor the compliance with article 50 paragraphs 2 and 4 of the AI Act (i.e. transparency obligations of (i) providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated and (ii) deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake, shall disclose that the content has been artificially generated or manipulated).