Luxembourg

Bill 8476 designates CNPD as Luxembourg's default MSA and SPOC under the EU AI Act, with the bill in parliamentary committee since June 2025 — CNPD is already actively publishing AI Act guidance and positioning itself as the primary compliance reference point

Luxembourg's strategic significance is disproportionate to its size — as home to Amazon Web Services' European headquarters, numerous investment funds, and major financial institutions, AI Act compliance decisions in Luxembourg will affect operations across the entire EU

The CNPD has a strong GDPR enforcement track record and brings data protection expertise directly into AI Act oversight — particularly relevant for Luxembourg's dominant financial services sector where AI in investment management, fraud detection, and compliance automation is widespread

Luxembourg's investment fund industry — the largest in Europe after the US — uses AI extensively in portfolio management, risk assessment, and regulatory reporting, creating concentrated Annex III exposure in one of the world's most AI-intensive financial ecosystems

The Grand Duchy's role as a European headquarters location for US tech and financial firms means CNPD's AI Act enforcement posture will be closely watched by compliance teams across the continent