Luxembourg

PARTIAL SANDBOX: NONE STATED

Art. 70 national competent authority
Source: Commission list · AI Office
verified 2026-07-21

COMPETENT AUTHORITY

CNPD as MSA and single point of contact — pending final adoption

Luxembourg's draft law, introduced in December 2024, makes the National Commission for Data Protection (CNPD) the market-surveillance authority and single point of contact. The Commission's notified list carries Luxembourg with the CNPD but flags the designation as pending final adoption. Proposed notifying authorities are the Luxembourg Office of Accreditation and Surveillance, the Agency for Medicines and Health Products, and the Government Commissioner for Data Protection.

OFFICIAL SOURCE Commission AI Office ↗

Member States designate their notifying authority and market-surveillance authority under Article 70; the Commission publishes the consolidated single-point-of-contact list. Designation across the Union remains uneven — we track each state's status rather than presenting a uniform picture that does not exist.

AT A GLANCE

Status: PARTIAL

Sandbox: None stated

Code: LU

Last verified: 2026-07-21

FINE BANDS — ART. 99

Prohibited practices€35M / 7%

Most other breaches€15M / 3%

Misleading information€7.5M / 1%

Higher of the two; SMEs/SMCs pay the lower. Enforceable from Aug 2, 2026.

All 27 Member States → Obligations database → GPAI supervision (AI Office) → Application timeline →