Skip to main content

    AI by country · Western Europe

    AI in Luxembourg: the rules, the readiness and where to start

    Last checked: 29 October 2026

    What should a company in Luxembourg know before starting with AI?

    In Luxembourg, AI that uses personal data falls under the GDPR and the Law of 1 August 2018, supervised by the CNPD. The EU AI Act applies in stages, and bill no. 8476 would make the CNPD the default AI Act authority, with the CSSF, the Commissariat aux assurances and other sector bodies covering their own fields. We found no record of the bill being passed as of 29 October 2026.

    At a glance

    Luxembourg at a glance

    Key facts about Luxembourg
    Data protection lawGDPR and the Law of 1 August 2018 on the organisation of the CNPD and the general data protection regime
    RegulatorCommission nationale pour la protection des données (CNPD)
    AI policyEU AI Act applies; implementing bill no. 8476 not yet passed as far as we could check; national AI strategy 'Accelerating Digital Sovereignty 2030' (May 2025)
    Time zoneCET, UTC+1 in winter; CEST, UTC+2 in summer (India is 4.5 or 3.5 hours ahead)
    CurrencyEUR (euro)
    Business languageLuxembourgish, French and German; English is common in finance

    Why now

    Why Luxembourg is worth watching

    Each point links to the document it comes from.

    • A STATEC study estimates that 90% of workers in Luxembourg are exposed to AI, with 55% likely to see their work augmented and 14% at risk of replacement.[6]

    • STATEC data show higher AI adoption among Luxembourg firms in 2025 than the euro area average, and faster growth in service sectors.[6]

    • The government presented its AI strategy, 'Accelerating Digital Sovereignty 2030', in May 2025, alongside strategies for data and quantum technologies.[5]

    • Bill no. 8476, which implements the AI Act, provides for at least one national AI regulatory sandbox, which the AI Act requires each member state to set up.[4]

    • Most of the EU AI Act applies from 2 August 2026, and the AI Omnibus moved high-risk rules for Annex III uses to 2 December 2027.[2]

    The rules

    The rules that matter for AI

    What each law or policy means when you build or buy an AI system.

    GDPR and the Law of 1 August 2018 (CNPD and general data protection regime)

    In force2018This law organises the CNPD and sets national rules alongside the GDPR. Any AI that uses personal data needs a lawful basis, transparency and data minimisation. Bill no. 8476 would amend this law to give the CNPD its AI Act tasks.[3]

    EU AI Act, Regulation (EU) 2024/1689, as amended by the AI Omnibus

    Phased2024Banned practices and AI literacy have applied since 2 February 2025, general-purpose AI rules since 2 August 2025, and most other rules, such as chatbot transparency, from 2 August 2026. The AI Omnibus, in force since 27 July 2026, moved high-risk rules to 2 December 2027 for Annex III uses and 2 August 2028 for AI in regulated products.[2]

    Bill no. 8476 implementing the AI Act

    Draft2024The bill names the CNPD as default horizontal market surveillance authority and single point of contact. Seven sector bodies would supervise their own fields, including the CSSF for finance, the Commissariat aux assurances for insurance, ILR, ILNAS, the medicines agency ALMPS and the media regulator ALIA. The Commission lists the CNPD as contact point with designation pending.[4]

    Where AI fits first

    Where AI fits first

    Banking and investment funds

    Document review for onboarding and fund administration, and drafting reports, with staff checking outputs.

    Under bill 8476 the CSSF would supervise AI in the financial sector. A CSSF thematic review, cited in the business chambers' opinion, found AI use in the sector still at an early stage.[4]

    Insurance

    Claims triage and customer correspondence in several languages.

    The Commissariat aux assurances would be the AI Act authority for insurance under bill 8476.[4]

    Public services and administration

    Search and translation across French, German and Luxembourgish documents.

    STATEC finds administrative support tasks among the most automatable. Where no sector body is named, the CNPD would be the default authority under the bill.[6]

    Start-ups building AI

    Testing a new AI product before launch.

    The bill provides for an AI regulatory sandbox. The business chambers proposed links with the MeluXina supercomputer and a separate CSSF sandbox for finance.[4]

    Your first steps

    Your first steps

    1. List your AI uses and sort each into an AI Act risk category: banned, high-risk, transparency or minimal.
    2. Find out which authority would supervise you under bill 8476, for example the CSSF for financial firms.
    3. Train staff in AI literacy, which the AI Act has required since 2 February 2025.
    4. Run a data protection impact assessment before deploying AI that profiles people or makes decisions about them.
    5. Tell people when they are dealing with a chatbot, as the AI Act requires from August 2026.
    6. If personal data will be accessed from India or another non-EU country, put a GDPR transfer mechanism in place first.
    7. Follow bill 8476 and check whether its regulatory sandbox suits a new AI system you are developing.

    AI services for Luxembourg

    AI consulting and development for teams in Luxembourg

    We work remotely with companies in Luxembourg, in your time zone, and keep your data under the rules described above.

    AI agents and automation

    Agents that finish multi-step work across your tools, with people approving what matters.
    Learn more

    Document Q&A (RAG)

    Answers from your own documents, with the source shown for every answer.
    Learn more

    AI governance and data protection

    Policies, review steps and audit trails that fit your local data law.
    Learn more

    Software and cloud engineering

    Web apps, integrations and cloud platforms built around your AI use case.
    Learn more

    How we work with you

    How we work with you

    We work remotely with clients worldwide, in the client's time zone. India (UTC+5:30) works 9:30 to 18:30, which is 04:00 to 13:00 UTC. In Luxembourg winter (UTC+1) that gives about 5 hours of overlap, 09:00 to 14:00 local time; in summer (UTC+2) about 6 hours, 09:00 to 15:00. India has no EU adequacy decision, so any personal data we access from India needs a GDPR transfer mechanism such as standard contractual clauses.

    Questions

    Common questions about AI in Luxembourg

    Who will enforce the AI Act in Luxembourg?

    Under bill no. 8476, the CNPD would be the default authority and single point of contact, with sector bodies such as the CSSF and the Commissariat aux assurances in their own fields. We found no record of the bill being passed as of 29 October 2026.

    Does the AI Act apply before bill 8476 is passed?

    Yes. The AI Act is an EU regulation and applies directly. The bill sets up supervision, sanctions and sandboxes.

    Will AI replace jobs in Luxembourg?

    STATEC's estimate is that 14% of workers face a replacement risk and 55% are more likely to see their work augmented. It notes such studies have limits, for example they ignore new jobs that AI may create.

    When do the high-risk AI rules start?

    On 2 December 2027 for Annex III uses such as hiring and credit scoring, and 2 August 2028 for AI in regulated products, after the EU AI Omnibus changed the dates.

    Complimentary tools

    Try these first

    Three complimentary tools from our AI Toolkit that suit a team starting out.

    AI readiness score

    Answer a few questions and see where your team stands, in about five minutes.
    Open the tool

    AI use case triage

    Test an idea against data, risk and effort before you spend on it.
    Open the tool

    AI project cost estimator

    Get a rough build and run cost range for a first AI project.
    Open the tool

    Read next

    Sources

    Sources

    Facts checked on 29 October 2026. Numbers in square brackets above match this list.
    1. [1] European Commission, 2026-09-07. Market Surveillance Authorities under the AI Act(digital-strategy.ec.europa.eu)
      Full title and what we used it for

      Market Surveillance Authorities under the AI Act. Primary. Used for the CNPD being listed as Luxembourg's single point of contact with national designation pending.

    2. [2] European Commission, 2026-10-19. AI Act: regulatory framework for AI(digital-strategy.ec.europa.eu)
      Full title and what we used it for

      AI Act: regulatory framework for AI. Primary. Used for the AI Act timeline and the AI Omnibus, which the page says entered into force on 27 July 2026. We could not open EUR-Lex directly.

    3. [3] CNPD, 2025-05-30. Intelligence artificielle (PL 8476): avis de la CNPD(cnpd.public.lu)
      Full title and what we used it for

      Intelligence artificielle (PL 8476): avis de la CNPD. Primary (CNPD opinion, deliberation no. 59/AV3/2025). Used for the bill's full title and the laws it amends, including the Law of 1 August 2018 on the organisation of the CNPD and the general data protection regime.

    4. [4] Chambre des Députés (document 8476/06): joint opinion of the Chambre de Commerce and Chambre des Métiers, 2025-04-02. Projet de loi n° 8476 portant mise en œuvre de certaines dispositions d…(wdocs-pub.chd.lu)
      Full title and what we used it for

      Projet de loi n° 8476 portant mise en œuvre de certaines dispositions du règlement (UE) 2024/1689. Parliamentary document, received 8 April 2025. Used for the bill's designation of the CNPD and seven sector authorities, the sandbox and the cited CSSF review. The chambers' proposals are their views, not the bill. The Chamber's dossier page was unreachable for us; secondary trackers say the Conseil d'État gave an opinion on 10 July 2026 and the bill was not yet voted.

    5. [5] Luxinnovation, 2025-05-19. Government unveils strategic initiative 'Accelerating Digital Sovereign…(luxinnovation.lu)
      Full title and what we used it for

      Government unveils strategic initiative 'Accelerating Digital Sovereignty 2030'. National innovation agency news item. Used for the May 2025 presentation and the three strategies on data, AI and quantum.

    6. [6] STATEC, 2026-03-12. Eléments de cadrage sur l'IA au Luxembourg(statistiques.public.lu)
      Full title and what we used it for

      Eléments de cadrage sur l'IA au Luxembourg. Primary (slides by STATEC's director general). Used for worker exposure estimates (90%, 55%, 14%), the adoption comparison with the euro area and the stated limits of the study. The exact adoption percentage is in a chart we could not read, so we do not state it.

    7. [7] European Commission, 2026-10-29. Adequacy decisions(commission.europa.eu)
      Full title and what we used it for

      Adequacy decisions. Primary, accessed on this date. Used to confirm India has no EU adequacy decision.

    This is general information, not legal advice. Bill 8476 may change before it is passed, and we could not read the Chamber's dossier page directly. Check with a qualified Luxembourg lawyer before you act. Facts checked on 29 October 2026.

    Other country guides

    Starting with AI in Luxembourg?

    Talk to an engineer. The first call is free, and we start with a readiness assessment before any budget is committed.

    Talk to our team Get your AI score