LuxembourgProjet de loi 8476, National Designation of AI Act Authorities and Penalties
Projet de loi 8476 portant mise en oeuvre de certaines dispositions du reglement (UE) 2024/1689 (Luxembourg, depose le 23 decembre 2024, avis du Conseil d'Etat du 10 juillet 2026)
In committee, dated , as of .
An AI governance rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
Where it has got to
The text described here is Projet de loi n° 8476, dossier complet: the text deposited on with the opinions received. That print is 8476, published .
Locally, this stage is en commission (Commission des Médias et des Communications), avis du Conseil d'État reçu.
The stage above is recorded at wdocs-pub.chd.lu.
The Chambre des Députés lists the dossier as in committee. The Conseil d'État's opinion is the most recent of twelve opinions in the consolidated file of , and no vote has followed.
What it requires
- As proposed, this bill designates Luxembourg's AI Act authorities and sets national fines; it would create no separate duty on an AI developer or deployer beyond identifying which authority enforces the AI Act against them.
These lines are LexLint's reading of the law's text.
If you get it wrong
Private right of actionNo
Penalty structure
As proposed by bill article 16(6), covering a breach of the AI Act Article 5 prohibited-practices ban, the tier this instrument describes. The bill's lower tiers are article 16(7), a ceiling of 15,000,000 euros or 3 percent of worldwide annual turnover for a breach of the provider, authorized-representative, importer, distributor, deployer and notified-body obligations it lists (AI Act arts. 16, 22, 23, 24, 26, 31, 33, 34 and 50), and article 16(8), a ceiling of 7,500,000 euros or 1 percent for supplying incorrect, incomplete or misleading information to a notified body or national authority.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 35,000,000
- Turnover percentage cap
- 7
Who enforces it
Enforcement body
Commission nationale pour la protection des donnees (CNPD), as the bill's proposed default AI Act market surveillance authority and single point of contact, alongside the sector-specific authorities the bill also proposes to designate.
Settledness
This is a bill. The Conseil d'État gave its opinion on , and the questions above are the ones it raised on the bill's text; the bill records no vote or adoption.
- As of
- Open questions
- Must Article 7, paragraph 3 limit the Commission de surveillance du secteur financier's competence to AI systems whose placing on the market, putting into service or use is 'directement liée à la fourniture de ces services financiers', as the Conseil d'État requires on pain of formal opposition under Article 74(6) of Regulation (EU) 2024/1689?
- Can Article 9, paragraphs 2 and 3 give a market surveillance authority that is not a public establishment a power to make regulations, which the Conseil d'État says neither Article 45 nor Article 129 of the Constitution allows?
- Which authority handles the complaints when several complaints about the same AI system or the same operator reach different market surveillance authorities, a case the Conseil d'État says the bill does not settle?
What it makes you log
Who may demand the log
Regulator
Log retention
The documents are kept until ten years after the high-risk AI system is placed on the market or put into service, by the receiver or liquidator when the provider or its representative is bankrupt or stops its activities.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 10
Logging duty
The bill's only record-keeping clause applies Article 18(2) of Regulation (EU) 2024/1689: when the provider of a high-risk AI system, or its authorised representative established in Luxembourg, is declared bankrupt or ceases its activities during the ten years after the system is placed on the market, the receiver or liquidator keeps the documents named in Article 18(1) of the Regulation for the rest of that period. The bill does not list what the documents hold.
- Kind
- Explicit
- As of
- Provision
- Article 18 of the bill (Conservation des documents)
- Trigger
- high_risk_systems
Why the legislator wanted it
- As of
- Quote
- Il appartient au curateur, respectivement au liquidateur, de se charger de la conservation des documents visés et, le cas échéant, de les mettre à disposition des autorités nationales compétentes.
- Source link
- https://wdocs-pub.chd.lu/docs/compilation/docpa/pdf/8476_Dossier_Complet.pdf
- Source kind
- Explanatory memorandum
- Purpose
- regulator_supervision
What this law does
The bill would designate the Commission nationale pour la protection des donnees (CNPD) as Luxembourg's default AI Act market surveillance authority and single point of contact, with derogations to the judicial control authority for AI systems used by the courts, the Commission de surveillance du secteur financier and the Commissariat aux assurances for AI systems placed on the market, put into service or used by an entity each of them supervises, the Institut luxembourgeois de la normalisation (ILNAS) for the product markets in points 1 to 10 of Annex I and for point 2 of Annex III, the Institut luxembourgeois de regulation for deployers of point 2 Annex III systems that are essential or important entities under the cybersecurity law, the Agence luxembourgeoise des medicaments et produits de sante for the medical-device markets in points 11 and 12 of Annex I, and the Autorite luxembourgeoise independante de l'audiovisuel (ALIA) for the synthetic-content marking and disclosure duties of Article 50(2) and Article 50(4).
It would empower each market surveillance authority to impose a warning, a reprimand, or an administrative fine, and would set a fine of up to 35,000,000 euros or 7 percent of worldwide annual turnover for a breach of the Article 5 prohibited-practices ban, up to 15,000,000 euros or 3 percent for a breach of the other operator and notified-body obligations the bill lists, and up to 7,500,000 euros or 1 percent for supplying incorrect, incomplete or misleading information to a notified body or national authority.
The bill also requires the CNPD to stand up at least one AI regulatory sandbox by . As of the Chambre des Deputes' own consolidated dossier, the Conseil d'Etat delivered its opinion on and no vote or adoption is recorded.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions, generates content with AI, deploys a chatbot or processes biometric data.
Back to the example · Lint your app
Page updated .