The EU AI Act in Luxembourg

Per Luxembourg - AI in Schools Guidelines

• Ministry of Education, Childhood and Youth (MEN) — Policy sponsor; published the KI Kompass proposal and leads consultation and rollout.
• SCRIPT (Service for coordination of pedagogical and technological research and innovation) — Operational coordination and platform manager; supports teacher training and piloting.
• Commission nationale pour la protection des données (CNPD) — National data protection authority; provides guidance on data protection and RIA obligations; potential national supervisory role under the AI Act.

Per Luxembourg - National AI Strategy (2025)

• Ministry for Digitalisation (MinDigital) - Government of Luxembourg — Policy lead and coordination for digital strategy implementation
• Ministry of the Economy (MECO) — Economic policy, industry partnerships and support for private-sector adoption
• Ministry for Research and Higher Education (MESR) — Research policy, R&D funding and university coordination
• Centre des technologies de l'information de l'État (CTIE) — Operates sovereign IT infrastructures and supports public sector deployments
• Commission Nationale pour la Protection des Données (CNPD) — Data protection oversight, DPIA guidance and participation in regulatory sandboxes
• Institut luxembourgeois de la normalisation, de l'accréditation et de la sécurité (ILNAS) — Standards and conformity coordination for certification pathways

Per Luxembourg - National Data Strategy

• Centre des technologies de l'information de l'État (CTIE) — Operational implementation, secure infrastructure and technical standards lead
• Service des médias, de la connectivité et de la politique numérique (SMC) — Policy coordination and representation at EU level (Digital Decade)
• Commission Nationale pour la Protection des Données (CNPD) — Data protection authority; enforcement of GDPR and privacy oversight
• Ministry of the Economy (Ministère de l'Économie) — Economic policy, support for industry participation and funding alignment

Per Luxembourg - AI Act Implementation (Bill No. 8476)

• Commission nationale pour la protection des données (CNPD) — Proposed central market surveillance authority and single point of contact; coordinating authority for AI oversight and data protection interface.
• Commission de Surveillance du Secteur Financier (CSSF) — Sectoral market surveillance for supervised financial entities and AI used in financial services.
• Commissariat aux Assurances (CAA) — Sectoral market surveillance for AI used by insurance undertakings.
• Office Luxembourgeois de l'Accréditation et de la Surveillance / ILNAS / OLAS — Accreditation and oversight of conformity assessment bodies and technical standards.
• Luxembourg Agency for Medicines and Health Products (future ALMPS) — Notifying authority / market surveillance for AI systems qualifying as medical devices or medical software.

Per Luxembourg - AI Strategic Vision

• Ministry for Digitalisation (Office of the Prime Minister) — Lead coordinator of the national AI strategic vision and inter-ministerial governance.
• Ministry of the Economy — Responsible for economic policy, support measures, funding channels and infrastructure investments for AI.
• Luxembourg National Research Fund (FNR) — Research funding body supporting AI and data-driven research priorities.
• Digital Lëtzebuerg (Digital Luxembourg initiative) — Policy programme coordinating digital and AI-related initiatives across government and stakeholders.

Per Luxembourg - AI in Schools Guidelines

• Internal disciplinary measures for breaches of school academic-integrity policies (e.g., warnings, grade sanctions) as specified in local guidance.
• Administrative referral to national authorities for statutory breaches (data protection violations to CNPD; possible sanctions under the AI Act / RIA where applicable).
• Potential delisting of non-compliant tools from the KI Kompass validation registry and removal from the national platform.
• Contractual remedies against third-party providers in procurement (penalties, termination, liability claims) for breaches of SLAs or data-handling obligations.

Per Luxembourg - National AI Strategy (2025)

• The strategy itself does not create new criminal sanctions; enforcement will use existing national laws and EU measures (notably the GDPR and the EU AI Act when applicable).
• Administrative sanctions and orders (e.g., remediation requirements) applied by competent authorities such as the CNPD for data protection breaches.
• Exclusion from public procurement opportunities and suspension of contracts for non-compliant AI suppliers.
• Mandatory withdrawal or suspension of non-compliant high-risk systems pending remediation where legal frameworks permit.
• Reputational and market measures including public disclosure of compliance failures where permitted by law.

Per Luxembourg - National Data Strategy

• GDPR administrative fines for personal data breaches (applied by CNPD where applicable)
• Administrative sanctions to be defined in implementing regulations for breaches of access protocols or misuse of secure processing environments
• Contractual remedies and liquidated damages for failure to comply with Data Factory participation agreements
• Removal or suspension of access to national data services in case of non-compliance or security incidents

Per Luxembourg - AI Act Implementation (Bill No. 8476)

• Fines up to EUR 35,000,000 or 7% of total worldwide annual turnover for infringements relating to prohibited AI practices.
• Fines up to EUR 15,000,000 or 3% of total worldwide annual turnover for breaches of high-risk obligations.
• Fines up to EUR 7,500,000 or 1% of total worldwide annual turnover for providing incorrect or misleading information to authorities.
• Proportionality safeguards and special caps/exemptions for SMEs and start-ups as foreseen in national implementing measures.
• Publication of sanctions decisions and remedial orders; powers to issue warnings, corrective measures, and temporary market restrictions.
• Sanctions do not exclude civil liability or other national criminal sanctions where applicable.

Per Luxembourg - AI Strategic Vision

• The strategy itself contains no statutory penalties; it is non-binding guidance.
• Compliance expectations are enforced via existing sectoral laws (e.g., GDPR) which carry statutory penalties for data protection breaches.
• Future sectoral regulation (including anticipated EU-level rules such as the EU AI Act) may introduce mandatory obligations, conformity assessment requirements and penalties.