I need to bring my Luxembourg organisation into compliance with article 29 of AI Act (UE 2024/1689). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapArticle 29 applies to conformity assessment bodies seeking to become notified bodies authorised to certify high-risk AI systems. The trap is not the initial application, it is paragraph 4: the submitted documentation must be updated whenever relevant changes occur. A body that obtains its notification then lets its documentation drift (a lapsed ISO/IEC 17065 accreditation, departure of experts competent for a given system type, scope change) falls into continuous non-compliance with Article 31. The EU AI Office oversees the coherence of the framework at European level, and the national notifying authority can suspend or withdraw the notification. In Luxembourg, OLAS (the national accreditation body) issues the accreditation certificate referred to in paragraph 2.The practical traps on the notification applicationFiling an application without a valid OLAS accreditation certificate when one could have been obtained: paragraph 3 then requires providing all documentary evidence, a far heavier burden.Over-declaring the scope of competence (modules and AI system types) without being able to demonstrate it through real experts and procedures.Reusing existing designations under other Union harmonisation legislation (medical devices, machinery) without checking that those certificates are valid and relevant to AI.Neglecting continuous file updates: an expired accreditation left unreported amounts to a breach of Article 31.Failing to track internal changes (reorganisation, subcontracting of assessment activities, loss of competence) that should have triggered a notification to the authority.How Luxgap automates this riskOur Luxgap Notified Body Dossier Sentinel makes silent drift of your notification file impossible: it continuously monitors the validity of your accreditations, certificates and declared competencies, and triggers the paragraph 4 update obligation before the notifying authority spots it. The tool connects to your document repository (SharePoint M365, internal EDM), the OLAS register and your HR systems (Workday LU, Sopra Steria HR Suite) to cross-check declared scope against operational reality.Automatically detects every certificate or accreditation nearing expiry and computes an alert lead time aligned with Article 31 requirements.Maps your declared assessment modules and AI system types, then matches that grid against the experts and procedures actually available through your connected HR data.Alerts in real time on any relevant change (departure of a key expert, subcontracting, reorganisation) that must trigger a notification to the notifying authority.Reuses your existing designations under other Union harmonisation legislation and flags certificates that are expired or not transferable to the AI regime.Produces a consolidated, timestamped notification dossier, enforceable before the notifying authority and the EU AI Office, demonstrating continuous Article 29 and 31 compliance.Available as a complement to a Luxgap D...

EU frameworkGDPR NIS 2 DORAAI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Article 29

Application of a conformity assessment body for notification

Artificial Intelligence Act · UE 2024/1689

Application of a conformity assessment body for notification

1. Conformity assessment bodies shall submit an application for notification to the notifying authority of the Member State in which they are established.

2. The application for notification shall be accompanied by a description of the conformity assessment activities, the conformity assessment module or modules and the types of AI systems for which the conformity assessment body claims to be competent, as well as by an accreditation certificate, where one exists, issued by a national accreditation body attesting that the conformity assessment body fulfils the requirements laid down in Article 31.

Any valid document related to existing designations of the applicant notified body under any other Union harmonisation legislation shall be added.

3. Where the conformity assessment body concerned cannot provide an accreditation certificate, it shall provide the notifying authority with all the documentary evidence necessary for the verification, recognition and regular monitoring of its compliance with the requirements laid down in Article 31.

4. For notified bodies which are designated under any other Union harmonisation legislation, all documents and certificates linked to those designations may be used to support their designation procedure under this Regulation, as appropriate. The notified body shall update the documentation referred to in paragraphs 2 and 3 of this Article whenever relevant changes occur, in order to enable the authority responsible for notified bodies to monitor and verify continuous compliance with all the requirements laid down in Article 31.

Luxembourg specificity

loi luxembourgeoise du 4 juillet 2014 portant reorganisation de l'ILNAS

In Luxembourg, the national accreditation body competent to issue the certificate referred to in Article 29(2) is OLAS (Office Luxembourgeois d'Accreditation et de Surveillance), attached to ILNAS. The notifying authority and the AI market surveillance authority have not yet been formally designated at national level to date; at European level, the EU AI Office oversees the framework. The law of 4 July 2014 reorganising ILNAS governs the OLAS accreditation activity underpinning the notification procedure.

Luxgap practice: have your OLAS accreditation validated against the real AI scope (modules and system types) before filing your application, to avoid falling into the heavier evidentiary regime of Article 29(3).

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Article 29 applies to conformity assessment bodies seeking to become notified bodies authorised to certify high-risk AI systems. The trap is not the initial application, it is paragraph 4: the submitted documentation must be updated whenever relevant changes occur. A body that obtains its notification then lets its documentation drift (a lapsed ISO/IEC 17065 accreditation, departure of experts competent for a given system type, scope change) falls into continuous non-compliance with Article 31. The EU AI Office oversees the coherence of the framework at European level, and the national notifying authority can suspend or withdraw the notification. In Luxembourg, OLAS (the national accreditation body) issues the accreditation certificate referred to in paragraph 2.

The practical traps on the notification application

Filing an application without a valid OLAS accreditation certificate when one could have been obtained: paragraph 3 then requires providing all documentary evidence, a far heavier burden.
Over-declaring the scope of competence (modules and AI system types) without being able to demonstrate it through real experts and procedures.
Reusing existing designations under other Union harmonisation legislation (medical devices, machinery) without checking that those certificates are valid and relevant to AI.
Neglecting continuous file updates: an expired accreditation left unreported amounts to a breach of Article 31.
Failing to track internal changes (reorganisation, subcontracting of assessment activities, loss of competence) that should have triggered a notification to the authority.

How Luxgap automates this risk

Our Luxgap Notified Body Dossier Sentinel makes silent drift of your notification file impossible: it continuously monitors the validity of your accreditations, certificates and declared competencies, and triggers the paragraph 4 update obligation before the notifying authority spots it. The tool connects to your document repository (SharePoint M365, internal EDM), the OLAS register and your HR systems (Workday LU, Sopra Steria HR Suite) to cross-check declared scope against operational reality.

Automatically detects every certificate or accreditation nearing expiry and computes an alert lead time aligned with Article 31 requirements.
Maps your declared assessment modules and AI system types, then matches that grid against the experts and procedures actually available through your connected HR data.
Alerts in real time on any relevant change (departure of a key expert, subcontracting, reorganisation) that must trigger a notification to the notifying authority.
Reuses your existing designations under other Union harmonisation legislation and flags certificates that are expired or not transferable to the AI regime.
Produces a consolidated, timestamped notification dossier, enforceable before the notifying authority and the EU AI Office, demonstrating continuous Article 29 and 31 compliance.

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real dossier, with a free blind audit within 48h to measure your exposure before any commitment.

Need help?

Our team (lawyers + cyber engineers + developers) supports you. Free quote within 48h.

Application of a conformity assessment body for notification

They trust us

Before we chat