AI Act And Data Act: The CNPD At The Forefront

The European Union’s digital transformation comes with strengthened regulation. The AI Act and the Data Act establish a governance framework built on transparency and accountability. In Luxembourg, the CNPD is expected to play a central role in their implementation.

AI Act

Under the AI Act, EU Member States were required to designate their competent authorities by 2 August 2025 and notify the European Commission of this information. In Luxembourg, Draft Bill No. 8476 proposes to assign this key responsibility to the CNPD, which would become the country's national supervisory authority for AI.

The AI Act – the first comprehensive regulatory framework on artificial intelligence worldwide – will be phased in gradually. It prohibits certain "unacceptable risk" practices such as social scoring from February 2025, imposes specific requirements for general-purpose AI (GPAI) models from August 2025, and applies fully from August 2026 to high-risk AI systems (for