Detailed overview
Luxembourg is regulated by the EU AI Act and has a national AI strategy under the broader initiative Accelerating Digital Sovereignty 2030. The EU AI Act applies directly in Luxembourg and requires AI providers, deployers, importers and distributors to classify AI systems and comply with the relevant obligations.
Under the EU AI Act, prohibited AI practices are banned. High-risk AI systems are allowed only with strict controls, including risk management, data governance, documentation, logging, transparency, human oversight, accuracy, robustness, cybersecurity, conformity assessment and post-market monitoring. AI systems with transparency risks, such as chatbots and certain AI-generated content, must inform users where required. Providers of general-purpose AI models must comply with technical-documentation, information-sharing, copyright-policy and training-content summary obligations.
Luxembourg's national AI strategy is part of a government initiative focused on data, artificial intelligence and quantum technologies. The Government states that these three strategic priorities are intended to stimulate the economy, improve citizens' quality of life, strengthen digital and technological sovereignty and contribute to EU digital sovereignty.
Luxembourg's 2030 AI strategy is human-centred and linked to digital sovereignty. It focuses on infrastructure, research and innovation, talents and skills, governance and regulation, service ecosystems and international collaboration. The strategy also refers to the role of AI in highly regulated and high-value sectors such as finance, health, cybersecurity, public services, culture, space, energy and mobility.
Luxembourg's AI strategy also refers to the national AI Factory and the MeluXina-AI supercomputer as infrastructure intended to support AI development and adoption. These tools are relevant for companies developing AI models, sectoral AI applications, data-driven services or AI products requiring high-performance computing.
AI systems in Luxembourg may also be regulated under GDPR, financial regulation, insurance regulation, healthcare rules, employment law, consumer protection, cybersecurity law and sectoral supervision. This is especially important for AI used in finance, health, insurance, digital identity, public administration, customer profiling or automated decision-making.
Penalties for AI Act breaches follow the EU AI Act. Prohibited AI breaches may lead to fines up to EUR 35 million or 7% of worldwide annual turnover. Other AI Act breaches may lead to fines up to EUR 15 million or 3%. Misleading information to authorities may lead to fines up to EUR 7.5 million or 1%.
Practical requirements & details
Sourced from Regulation (EU) 2024/1689 (the EU AI Act) and Luxembourg's Accelerating Digital Sovereignty 2030 initiative.
EU AI Act classifications
- Prohibited AI — banned outright.
- High-risk AI — strict controls: risk management, data governance, documentation, logging, transparency, human oversight, accuracy, robustness, cybersecurity, conformity assessment and post-market monitoring.
- Transparency-risk AI — chatbots and certain AI-generated content must inform users where required.
- GPAI models — technical-documentation, information-sharing, copyright-policy and training-content summary obligations.
Accelerating Digital Sovereignty 2030
- Three strategic priorities: data, AI and quantum technologies.
- Stimulate the economy, improve citizens' quality of life, strengthen digital and technological sovereignty and contribute to EU digital sovereignty.
2030 AI strategy — focus areas
- Infrastructure, research and innovation, talents and skills, governance and regulation, service ecosystems and international collaboration.
- Highly regulated and high-value sectors: finance, health, cybersecurity, public services, culture, space, energy and mobility.
National infrastructure
- AI Factory — national infrastructure for AI development and adoption.
- MeluXina-AI supercomputer — high-performance computing for AI models and applications.
Overlapping legal regimes
- GDPR, financial regulation, insurance regulation, healthcare rules, employment law, consumer protection, cybersecurity law and sectoral supervision.
Penalties
- EUR 35 million or 7% of worldwide annual turnover — breaches of prohibited AI rules.
- EUR 15 million or 3% of worldwide annual turnover — breaches of many other AI Act operator obligations.
- EUR 7.5 million or 1% of worldwide annual turnover — supplying incorrect, incomplete or misleading information to authorities.
Related entries
See also the European Union entry, which covers the EU AI Act (Regulation (EU) 2024/1689) — the substantive framework that this jurisdiction implements and supervises domestically.