AI governance for Luxembourg banks, funds and financial firms

The short answer

Luxembourg’s banks, investment firms, fund managers and payment institutions do not have an AI rulebook of their own. They govern AI under the governance, risk management and operational resilience rules that already apply, and under the EU AI Act. Bill 8476, still before the Chamber of Deputies, would make the CSSF the AI Act market surveillance authority for the entities it supervises and the Commissariat aux Assurances (CAA) for insurers.

The CSSF and CAA’s proposed AI Act role

Under the bill as filed, the CNPD is the default AI Act authority, and the CSSF and CAA take AI systems placed on the market, put into service or used by the entities they each supervise. For credit institutions in the single supervisory mechanism, the CSSF would pass relevant findings to the European Central Bank. The CNPD remains the GDPR supervisor for every firm.

The AI Act’s prohibited practices and AI literacy duty have applied since February 2025, and its transparency duties since 2 August 2026. For financial firms the high-risk systems that matter most apply from 2 December 2027.

• Credit. AI used to evaluate the creditworthiness of natural persons or establish their credit score, apart from fraud detection (Annex III point 5(b)).
• Insurance. AI used for risk assessment and pricing of natural persons in life and health insurance (point 5(c)).

Deployers of these systems must carry out a fundamental rights impact assessment before use. The high-risk classification guide covers how to decide what is in scope.

What the BCL and CSSF found

The Banque centrale du Luxembourg and the CSSF published their second thematic review on AI in the financial sector on 16 May 2025. The survey ran from June to August 2024 and covered investment firms, fund managers, credit institutions, e-money and payment institutions. 461 institutions answered, an 86 per cent participation rate.

Adoption. 28 per cent of respondents used AI in production or development, and 22 per cent were experimenting or planning to within a year. Among banks, e-money and payment institutions, the scope of the first review, use in production or development rose to 43 per cent from 30 per cent.

Generative AI. 64 per cent of respondents let staff use public generative AI tools such as ChatGPT, Gemini or Claude, while 36 per cent blocked them. Only 40 per cent of firms allowing access had a policy addressing those tools. Of the 402 use cases reported, 61 per cent used generative AI, 94 per cent of generative AI use cases relied on large language models and 75 per cent used commercial models.

Governance. 43 per cent of respondents using or planning AI had a formally approved AI policy, 84 per cent had implemented or planned AI training, and 54 per cent had security measures for AI-specific vulnerabilities.

Trustworthiness. 90 per cent of use cases had a human in the loop, up from 77 per cent. Bias prevention or detection measures were in place for 45 per cent of use cases, with many generative AI use cases marked not applicable on the assumption that bias is the model provider’s responsibility. The review noted that deployers may still need their own measures. Only 56 per cent of use cases reported good or very good auditability, and 54 per cent good or very good explainability, both down from the previous review.

AI Act classification. Only 5 per cent of use cases were rated high-risk, mostly credit scoring, internal ratings based credit risk models and anti-money laundering or fraud detection. The review pointed out that the last two are not high-risk under Annex III, so firms’ ratings reflected their own sense of risk more than the Act’s classification.

A working approach

1. Know what you run. Register every AI system and model, including public generative AI tools staff use and AI inside group or vendor solutions. Much AI in Luxembourg is built or bought at group level, which makes a local inventory more important, not less.
2. Set rules for generative AI. Put a policy in place for public tools, and back it with controls on what data can reach them. The acceptable use policy guide covers what to include.
3. Classify against the Act, not instinct. Decide which systems fall under Annex III points 5(b) and 5(c), and record why others do not.
4. Own bias, explainability and auditability. Assess each use case yourself rather than leaving it to the model provider. The AI bias assessment guide sets out the method.
5. Manage providers. Treat commercial model providers under your outsourcing and DORA third-party arrangements. The vendor AI risk guide covers the steps.

Aicura supports this work with discovery, the AI register, guardrails, vendor management, risk, bias and impact assessments, and monitoring. It assesses against the EU AI Act from the Essentials plan, and ISO/IEC 42001 and the NIST AI RMF from Pro. The decisions, and the dialogue with the CSSF, the CAA and the CNPD, stay with you.