Makes employment decisions, in Luxembourg

Regulation (EU) 2016/679, Arts. 13(2)(f), 14(2)(g), 15(1)(h) and 22 · Read the law's page

• Where a decision based solely on automated processing about a person in Luxembourg rests on a contract with them or on their explicit consent, put suitable safeguards in place, at least the right to obtain human intervention, to express their point of view and to contest the decision, under GDPR Article 22(3).
• Do not subject a person in Luxembourg to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, unless the decision is necessary for entering into or performing a contract with them, is authorised by Union or Member State law that also lays down suitable measures to safeguard their rights, or rests on their explicit consent, under GDPR Article 22(1) and (2).
• Do not base a solely automated decision with legal or similarly significant effects on a person in Luxembourg on the special categories of personal data in GDPR Article 9(1), unless they gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, and suitable measures to safeguard their rights are in place, under GDPR Article 22(4).
• If you make solely automated decisions about a person in Luxembourg of the kind GDPR Article 22(1) and (4) describe, including profiling, tell them so and give them meaningful information about the logic involved and the significance and envisaged consequences for them: when you collect their data, within the Article 14(3) period where you obtained it from someone else, and in answering their access request, under GDPR Articles 13(2)(f), 14(2)(g) and 15(1)(h).

Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024

• Do not carry on a prohibited AI practice such as social scoring or real-time biometric surveillance in public spaces.
• If your AI system is high risk, meet the conformity requirements set for it.
• If you provide a general-purpose AI model, publish a summary of the data used to train it.
• If you provide a general-purpose AI model, honour opt-out requests from rights holders.
• If you operate a chatbot, disclose to users that they are interacting with one.
• Disclose to users that AI-generated synthetic media, including a deepfake, is what it is.

Projet de loi 8476 portant mise en oeuvre de certaines dispositions du reglement (UE) 2024/1689 (Luxembourg, depose le 23 decembre 2024, avis du Conseil d'Etat du 10 juillet 2026) · Read the law's page

• As proposed, this bill designates Luxembourg's AI Act authorities and sets national fines; it would create no separate duty on an AI developer or deployer beyond identifying which authority enforces the AI Act against them.