AI disclosure requirements in Luxembourg: what applies from 2 August 2026

The EU AI Act's transparency obligations are a Union-wide regulation, so the substance is the same in Luxembourg as everywhere in the EU: from 2 August 2026, AI systems that interact with people must disclose they're AI, synthetic media must carry machine-readable marking, and deepfakes and certain AI-generated public-interest text must be labeled. What differs country by country is who enforces it, in what language your users encounter it, and how quickly complaints turn into questions — which is what this page covers for Luxembourg.

Enforcement in Luxembourg

Luxembourg's government submitted bill n°8476 on 23 December 2024 to designate its national AI Act authorities; at the time of review it remained before parliament rather than enacted. The bill names the National Commission for Data Protection (CNPD) as the default market surveillance authority and single point of contact, coordinating the other sectoral market surveillance authorities. The CNPD has moved ahead of formal enactment in practice — running the "AI Act in Action" conference in January 2026, the "Regulation Meets Innovation" (ReMI) initiative with the AI Factory, its own AI regulatory sandbox, and engaging with the AI Experience Center at the Luxembourg House of Financial Technology (LHoFT). Article 50 itself applies from 2 August 2026 regardless of the designation bill's progress, with the EU's penalty ceiling of €15 million or 3% of worldwide turnover.

The four duties, as they show up on your site

• Article 50(1) — chatbot disclosure. Any AI system interacting with visitors must make that clear no later than the first interaction, in a clear and distinguishable way. A line in your terms doesn't satisfy it.
• Article 50(2) — machine-readable marking. AI-generated audio, images, video, and text must be marked in a machine-readable, detectable format. For generative systems already on the market before 2 Aug 2026, this specific duty has a transition until 2 Dec 2026 — the rest does not.
• Article 50(3) — emotion recognition & biometric categorisation. People exposed must be informed the system is operating.
• Article 50(4) — deepfake and AI-text labels. Visible disclosure for deepfakes, and for AI-generated or manipulated text published to inform the public on matters of public interest.

Luxembourg-specific practicalities

• The CNPD is already the most active AI-Act-adjacent regulator in Luxembourg in practice — its guidance, sandbox, and conference materials are the closest thing to an official preview even before the designation bill passes
• Luxembourg's financial-sector density means AI features inside regulated financial products should expect sector-specific attention alongside CNPD's general role
• The LHoFT's AI Experience Center signals an innovation-friendly, sandbox-first regulatory culture — useful context if you want to test a disclosure approach before relying on it live
• Luxembourg is officially trilingual; match your disclosure to the language of the storefront (French, German, or Luxembourgish) rather than defaulting to English alone

Disclosure language should match your user-facing language. Luxembourg commonly runs commerce in French and German (with Luxembourgish also official): "Vous discutez avec un assistant IA" for French-language pages, or "Sie chatten mit einem KI-Assistenten" for German-language ones — each at first interaction.

Common questions