Projet de loi 8476, National Designation of AI Act Authorities and Penalties
Projet de loi 8476 portant mise en oeuvre de certaines dispositions du reglement (UE) 2024/1689 (Luxembourg, depose le 23 decembre 2024, avis du Conseil d'Etat du 10 juillet 2026)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
Proposed: draft date not recorded.
In committee, dated 10 July 2026, as of 12 September 2026.
An AI governance rule binding public and private bodies.
As of 6 September 2026.
Where it has got to
The text described here is Projet de loi n° 8476, dossier complet: the text deposited on 23 December 2024 with the opinions received. That print is 8476, published 10 July 2026.
Locally, this stage is en commission (Commission des Médias et des Communications), avis du Conseil d'État reçu.
The stage above is recorded at wdocs-pub.chd.lu.
The Chambre des Députés lists the dossier as in committee. The Conseil d'État's opinion is the most recent of twelve opinions in the consolidated file of 10 July 2026, and no vote has followed.
What it requires
- Not yet in force, as proposed. Once enacted, expect the Commission nationale pour la protection des donnees (CNPD) to be Luxembourg's default AI Act market surveillance authority and single point of contact, with sector-specific authority instead held by the CSSF, the Commissariat aux assurances, ILNAS, the Institut luxembourgeois de regulation, or the Agence luxembourgeoise des medicaments et produits de sante depending on the sector, and by the Autorite luxembourgeoise independante de l'audiovisuel (ALIA) for the Article 50 bot and synthetic-content disclosure duties specifically.
- As proposed, a breach of the AI Act's Article 5 prohibited-practices ban would draw an administrative fine of up to 35,000,000 euros or 7 percent of worldwide annual turnover, whichever is higher.
If you get it wrong
Private right of actionNo
Penalty structure
As proposed by bill article 16(6), covering a breach of the AI Act Article 5 prohibited-practices ban, the tier this instrument describes. The bill's other tier, article 16(7), would set a lower ceiling of 15,000,000 euros or 3 percent of worldwide annual turnover for a breach of the provider, authorized-representative, importer, distributor, deployer and notified-body obligations it lists (AI Act arts. 16, 22, 23, 24, 26, 31, 33, 34 and 50). Neither tier is yet in force.
- Rule
- Higher of
- As of
- 6 September 2026
- Currency
- EUR
- Fixed cap
- 35,000,000
- Turnover percentage cap
- 7
Who enforces it
Enforcement body
Commission nationale pour la protection des donnees (CNPD), as the bill's proposed default AI Act market surveillance authority and single point of contact, alongside the sector-specific authorities the bill also proposes to designate.
What it reaches
Obligation class
Governance, Reporting
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Not yet in force, as proposed.
The bill would designate the Commission nationale pour la protection des donnees (CNPD) as Luxembourg's default AI Act market surveillance authority and single point of contact, with derogations to the judicial control authority for AI systems used by courts, the Commission de surveillance du secteur financier for AI systems used by supervised financial entities, the Commissariat aux assurances for the insurance sector, the Institut luxembourgeois de la normalisation (ILNAS) for most other high-risk product categories, the Institut luxembourgeois de regulation for AI systems deployed by essential or important cybersecurity entities, the Agence luxembourgeoise des medicaments et produits de sante for medical-device AI, and the Autorite luxembourgeoise independante de l'audiovisuel (ALIA) specifically for the Article 50 bot and synthetic-content disclosure duties.
It would empower each market surveillance authority to impose a warning, a reprimand, or an administrative fine, and would set a fine of up to 35,000,000 euros or 7 percent of worldwide annual turnover for a breach of the Article 5 prohibited-practices ban, and up to 15,000,000 euros or 3 percent for a breach of the other operator and notified-body obligations the bill lists. The bill also requires the CNPD to stand up at least one AI regulatory sandbox by 2 August 2026.
As of the Chambre des Deputes' own consolidated dossier, the Conseil d'Etat delivered its opinion on 10 July 2026 and no vote or adoption is recorded.
When LexLint raises it
high_risk_decisionsgenerates_contentdeploys_chatbotprocesses_biometrics
Read the law
Chambre des Deputes, official consolidated legislative dossier for Projet de loi 8476