Explainer
Who supervises the AI Act in Luxembourg: CNPD, CSSF, CAA and draft law No. 8476
Draft law No. 8476 makes the CNPD Luxembourg's default AI Act authority, with the CSSF and CAA for their sectors. It was still not adopted in October 2026.
Explainers
Short, evergreen answers to the questions people actually ask.
Explainer
DORA register of information in Luxembourg: reporting to the CSSF and CAA, and the data behind it
Luxembourg financial entities must keep a DORA register of all ICT third-party contracts and file it yearly; the hard part is data quality, not the template.
Explainer
MeluXina-AI and the Luxembourg AI Factory: status in 2026 and how to get access
MeluXina-AI is the AI supercomputer of the Luxembourg AI Factory, contracted on 22 July 2026. Here is what it offers and how firms and public bodies get access.
Explainer
Data owner vs data steward vs data custodian: who is accountable for what
The data owner is accountable, the data steward manages definitions and quality, the custodian runs the systems. How to assign the roles in Luxembourg.
Explainer
LNDS explained: Luxembourg's National Data Service, public data reuse and the health data space
LNDS helps Luxembourg public bodies make protected data reusable for research and innovation; first requests under the law of 19 December 2025 are due in 2026.
Explainer
AI literacy under AI Act Article 4: what Luxembourg organisations must do
Since 2 February 2025, every provider and deployer of AI in Luxembourg must take measures to build AI literacy among staff. What the rule requires after the 2026 Omnibus.
Explainer
EU Data Act in Luxembourg: obligations, key dates and the ILR's planned role
The EU Data Act applies in Luxembourg since 12 September 2025. Bill 8809 would make the ILR the main authority. Obligations, deadlines and who is affected.
Glossary
High-risk AI system: definition under the EU AI Act
A high-risk AI system is one covered by Article 6 of the AI Act, via Annex I products or Annex III use cases; its obligations apply from 2 December 2027.
Explainer
Master data management for mid-sized companies in Luxembourg: where to start
MDM means one trusted, owned version of customer, supplier, product and legal-entity data. What it covers, the warning signs and how a mid-sized company can start.
Explainer
BCBS 239 explained for banks in Luxembourg: risk data aggregation, the ECB guide and the CSSF
BCBS 239 sets 14 principles for aggregating and reporting risk data; for Luxembourg banks the ECB's May 2024 guide and CSSF Circular 12/552 make them concrete.
Explainer
How to assess data governance maturity: models, scoring and a light-weight method for Luxembourg
A data governance maturity assessment scores capabilities on a 0–5 scale against evidence. Here is what to measure, whom to interview and how to build a roadmap.
Explainer
Luxembourg's AI, data and quantum strategies: what 'Accelerating digital sovereignty 2030' contains
Luxembourg presented its AI, data and quantum strategies on 19 May 2025 under 'Accelerating digital sovereignty 2030'. Documents, measures and what they mean for firms.