I need to bring my Luxembourg organisation into compliance with article 28 of AI Act (UE 2024/1689). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapArticle 28 is an institutional provision: it addresses Member States, not companies directly. The trap for providers of high-risk AI systems is to assume it does not concern them. In reality it conditions your entire route to market: without a notified body properly designated by an independent notifying authority, you cannot obtain the third-party conformity assessment required by Annex VII. In Luxembourg, the AI market surveillance authority has not yet been formally designated to date, and the EU AI Office (Brussels) coordinates at European level. Providers who invest heavily in development without mapping the notification-body-accreditation chain discover too late that no competent body exists for their product category.What this article imposes on your strategy in practiceThe notifying authority must be independent from conformity assessment bodies: no conflict of interest, no commercial consultancy services (paragraphs 3 and 5).Member States may entrust assessment to a national accreditation body within the meaning of Regulation (EC) 765/2008 (paragraph 2): in Luxembourg, OLAS (Office Luxembourgeois d'Accreditation et de Surveillance) is the reference body.The notification decision must be taken by persons different from those who carried out the assessment (paragraph 4): trace this separation of roles in your files.Personnel must hold expertise in information technologies, AI and law, including the supervision of fundamental rights (paragraph 7).For you as a provider: identify early which notified body covers your category of system, because supply is scarce and assessment lead times are long.How Luxgap automates this riskOur Luxgap Notified Body Navigator makes the blocked-provider scenario impossible. The tool continuously queries the European Commission NANDO database and national accreditation registers (OLAS for Luxembourg, EA for the EU), cross-references your categories of high-risk AI systems (Annex III) with the real notification scopes, and tells you in real time which body can legally assess your product.Scans the NANDO database daily and alerts via Teams or email whenever a notified body is designated, suspended or withdrawn for your system category.Automatically classifies your systems under Annex III of the AI Act and maps each to the applicable assessment procedure (internal control or notified body, Annex VI or VII).Detects potential conflicts of interest by checking that the targeted body does not otherwise provide commercial consultancy to your company, in line with paragraph 5.Generates a pre-filled conformity assessment preparation file, structured according to the requirements of the targeted notified body.Produces a time-stamped PDF report tracing your compliance strategy, enforceable before the market surveillance authority during an inspection.Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will...

EU frameworkGDPR NIS 2 DORAAI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Article 28

Notifying authorities

Artificial Intelligence Act · UE 2024/1689

Notifying authorities

1. Each Member State shall designate or establish at least one notifying authority responsible for setting up and carrying out the necessary procedures for the assessment, designation and notification of conformity assessment bodies and for their monitoring. Those procedures shall be developed in cooperation between the notifying authorities of all Member States.

2. Member States may decide that the assessment and monitoring referred to in paragraph 1 is to be carried out by a national accreditation body within the meaning of, and in accordance with, Regulation (EC) No 765/2008.

3. Notifying authorities shall be established, organised and operated in such a way that no conflict of interest arises with conformity assessment bodies, and that the objectivity and impartiality of their activities are safeguarded.

4. Notifying authorities shall be organised in such a way that decisions relating to the notification of conformity assessment bodies are taken by competent persons different from those who carried out the assessment of those bodies.

5. Notifying authorities shall offer or provide neither any activities that conformity assessment bodies perform, nor any consultancy services on a commercial or competitive basis.

6. Notifying authorities shall safeguard the confidentiality of the information that they obtain, in accordance with Article 78.

7. Notifying authorities shall have an adequate number of competent personnel at their disposal for the proper performance of their tasks. Competent personnel shall have the necessary expertise, where applicable, for their function, in fields such as information technologies, AI and law, including the supervision of fundamental rights.

Luxembourg specificity

Loi du 4 juillet 2014 portant réorganisation de l'ILNAS et règlement (CE) 765/2008

In Luxembourg, OLAS (Office Luxembourgeois d'Accreditation et de Surveillance), attached to ILNAS, is the national accreditation body within the meaning of Regulation (EC) 765/2008. Under paragraph 2 of Article 28 it is positioned to assess and monitor AI conformity assessment bodies. The AI market surveillance authority itself has not yet been formally designated to date.

Luxgap practice: do not rely on a Luxembourg notified body to start; map the notified bodies available across the EU through NANDO now, since none yet covers all Annex III categories.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Article 28 is an institutional provision: it addresses Member States, not companies directly. The trap for providers of high-risk AI systems is to assume it does not concern them. In reality it conditions your entire route to market: without a notified body properly designated by an independent notifying authority, you cannot obtain the third-party conformity assessment required by Annex VII. In Luxembourg, the AI market surveillance authority has not yet been formally designated to date, and the EU AI Office (Brussels) coordinates at European level. Providers who invest heavily in development without mapping the notification-body-accreditation chain discover too late that no competent body exists for their product category.

What this article imposes on your strategy in practice

The notifying authority must be independent from conformity assessment bodies: no conflict of interest, no commercial consultancy services (paragraphs 3 and 5).
Member States may entrust assessment to a national accreditation body within the meaning of Regulation (EC) 765/2008 (paragraph 2): in Luxembourg, OLAS (Office Luxembourgeois d'Accreditation et de Surveillance) is the reference body.
The notification decision must be taken by persons different from those who carried out the assessment (paragraph 4): trace this separation of roles in your files.
Personnel must hold expertise in information technologies, AI and law, including the supervision of fundamental rights (paragraph 7).
For you as a provider: identify early which notified body covers your category of system, because supply is scarce and assessment lead times are long.

How Luxgap automates this risk

Our Luxgap Notified Body Navigator makes the blocked-provider scenario impossible. The tool continuously queries the European Commission NANDO database and national accreditation registers (OLAS for Luxembourg, EA for the EU), cross-references your categories of high-risk AI systems (Annex III) with the real notification scopes, and tells you in real time which body can legally assess your product.

Scans the NANDO database daily and alerts via Teams or email whenever a notified body is designated, suspended or withdrawn for your system category.
Automatically classifies your systems under Annex III of the AI Act and maps each to the applicable assessment procedure (internal control or notified body, Annex VI or VII).
Detects potential conflicts of interest by checking that the targeted body does not otherwise provide commercial consultancy to your company, in line with paragraph 5.
Generates a pre-filled conformity assessment preparation file, structured according to the requirements of the targeted notified body.
Produces a time-stamped PDF report tracing your compliance strategy, enforceable before the market surveillance authority during an inspection.

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real portfolio of AI systems, with a free blank audit within 48h to measure your exposure before any commitment.

Need help?

Our team (lawyers + cyber engineers + developers) supports you. Free quote within 48h.

Notifying authorities

They trust us

Before we chat