I need to bring my Luxembourg organisation into compliance with article 87 of AI Act (UE 2024/1689). What are the concrete requirements, the sanctions, and how can Luxgap support me?

EU frameworkGDPR NIS 2 DORAAI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Article 87

Reporting of infringements and protection of reporting persons

Artificial Intelligence Act · UE 2024/1689

Reporting of infringements and protection of reporting persons

Directive (EU) 2019/1937 shall apply to the reporting of infringements of this Regulation and the protection of persons reporting such infringements.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 portant transposition de la directive (UE) 2019/1937 sur la protection des personnes qui signalent des violations du droit de l'Union

In Luxembourg, whistleblower protection transposing Directive (EU) 2019/1937 falls under the law of 16 May 2023, which requires an internal reporting channel for entities with at least 50 employees and gives a support role to the Office des signalements. For AI Act infringements, this national framework governs the 7-day acknowledgement, the 3-month feedback and the prohibition of retaliation, with a reversed burden of proof on the employer.

Luxgap practice: align your existing internal procedure with the "AI Act infringement" ground and keep timestamped, admissible logs, since the Luxembourg AI market surveillance authority is not yet formally designated and your documentary traceability will prevail in an inspection.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Article 87 plugs the AI Act into the whistleblowing Directive (EU) 2019/1937. In practice, your employees, subcontractors, model providers and even interns can report an AI Act infringement (non-compliant high-risk system, missing CE marking, circumvented transparency) through a protected internal channel, then to the authorities. The trap is not the report itself, it is the absence of a secure internal channel and above all retaliation: demotion, non-renewal, isolation of the whistleblower. In Luxembourg this falls under the law of 16 May 2023, and retaliation exposes the organisation to civil and criminal sanctions independent of AI Act fines (up to 35 M EUR or 7% of worldwide turnover for prohibited practices).

The traps in practice

Assuming GDPR or NIS 2 already covers it: AI Act reporting adds a standalone material ground that your procedure must explicitly integrate.
Failing to log the acknowledgement within 7 days and the feedback within 3 months required by Directive 2019/1937.
Confusing confidentiality with anonymity: the whistleblower identity must stay protected even internally, including from HR and the implicated hierarchy.
Overlooking the reversed burden of proof: when retaliation is alleged, the employer must prove the absence of a link with the report.
Omitting AI subcontractors and general-purpose model providers, who are also protected.

How Luxgap automates this risk

Our Luxgap Whistleblower Shield makes it impossible to lose a report or to retaliate silently: it provides an encrypted internal channel compliant with Directive 2019/1937 and the AI Act, with tamper-proof timestamps at every step. The tool integrates with your M365, Active Directory and Sage BOB 50 to detect retaliation signals (sudden manager change, salary freeze, access revocation) occurring after a report, without any HR staff accessing the whistleblower identity.

Generates an end-to-end encrypted reporting portal open to employees, AI subcontractors and model providers, with a dedicated "AI Act infringement" ground.
Automatically triggers the acknowledgement within 7 days and alerts the officer before the 3-month feedback deadline set by Directive 2019/1937.
Compartmentalises the whistleblower identity in a restricted-access vault, logs every consultation and blocks any unauthorised access.
Detects retaliation indicators by correlating M365 and BOB 50 HR events occurring after a report, and alerts the DPO or CISO in real time on Teams.
Produces a timestamped, sealed PDF file, admissible during an inspection, demonstrating the compliance of the scheme and a controlled burden of proof.

Available alongside a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real perimeter, with a free blind audit within 48h to measure your exposure before any commitment.

Need help?

Our team (lawyers + cyber engineers + developers) supports you. Free quote within 48h.

Reporting of infringements and protection of reporting persons

They trust us

Before we chat