Bill 8476, Luxembourg's AI Act implementation bill

What it is

Bill 8476 (projet de loi n° 8476) is the Luxembourg government’s bill implementing certain provisions of the EU AI Act. It was approved by the government on 29 November 2024 and filed with the Chamber of Deputies on 23 December 2024 by the Minister Delegate for Media and Connectivity. It also amends the organic law of the CNPD, the law establishing the CSSF and the law on the insurance sector.

The AI Act applies directly in Luxembourg. The bill designates who supervises it, sets out their missions and powers, and provides for real-world testing.

Who would supervise what

Under the bill as filed, the National Commission for Data Protection (CNPD) is the default market surveillance authority, and sector bodies take specific areas by derogation.

• CNPD. Default market surveillance authority, coordinator of the other authorities and single point of contact. Also the notified body for high-risk systems intended for law enforcement, immigration and asylum authorities.
• CSSF. AI systems placed on the market, put into service or used by an entity it supervises. For credit institutions in the euro area’s single supervisory mechanism, it passes relevant findings to the European Central Bank.
• Commissariat aux Assurances (CAA). AI systems placed on the market, put into service or used by an entity it supervises.
• ILNAS. AI in products covered by points 1 to 10 of Annex I and AI used in critical infrastructure under Annex III point 2.
• Institut Luxembourgeois de Régulation (ILR). Deployers of critical infrastructure AI that are essential or important entities under Luxembourg’s cybersecurity law, without prejudice to the CSSF’s powers.
• Medicines and health products agency (ALMPS). AI in medical devices and in vitro diagnostic medical devices.
• Autorité luxembourgeoise indépendante de l’audiovisuel (ALIA). The Article 50(2) and 50(4) duties to mark AI-generated content and disclose deepfakes.
• Judicial control authority. AI used by the courts in their judicial functions.

ILNAS, through its accreditation office, and the Government Commissioner for Data Protection would be the notifying authorities, with the ALMPS for medical devices.

What it means for organisations

The bill adds no new obligations for AI systems. Those come from the AI Act. Under it, authorities would have the investigative powers of the EU market surveillance regulation and could each adopt rules on their investigation and complaint procedures. A real-world testing plan would be deemed approved if the authority does not answer within 30 days.

For a Luxembourg organisation the practical point is which authority will ask. For banks, investment firms, payment and e-money institutions and fund managers it would be the CSSF. For insurers it would be the CAA. For most other organisations it would be the CNPD, which already supervises their use of personal data under the GDPR.

The CNPD has been preparing for the role. In January 2026 it brought together the regulators proposed under the bill to discuss supervision, the single point of contact and coordination, and it runs a regulatory sandbox for innovative projects. In September 2026 the government said the CNPD should soon take on its AI Act functions under the bill.

Key dates

• 29 November 2024. Government approves the bill.
• 23 December 2024. Bill filed with the Chamber of Deputies.
• 10 July 2026. Council of State opinion, with a formal objection on how authorities arbitrate shared cases.
• 2 August 2026. General application of the AI Act, including Article 50 transparency.
• 2 December 2027. Annex III high-risk obligations apply, as amended by the Digital Omnibus.

How it relates to other frameworks

Bill 8476 is the national layer on top of the EU AI Act. The GDPR applies alongside it, enforced by the CNPD. For financial entities, DORA’s ICT risk rules also reach AI systems, supervised by the CSSF and the CAA.

Firms that structure their AI governance on ISO/IEC 42001 or the NIST AI RMF will find most of the records the AI Act asks for, such as an inventory, risk assessments and human oversight, already part of that work.

A note on this page

This is Aicura’s reading of bill 8476 as filed. It is not legal advice, and the bill may change before it is adopted. Read the parliamentary file on the Chamber of Deputies website, and take advice on how the AI Act applies to your organisation.