EU frameworkGDPRNIS 2DORAAI ActWhistleblowing
Recital 138

Recital 138

Artificial Intelligence Act · UE 2024/1689

(138)

AI is a rapidly developing family of technologies that requires regulatory oversight and a safe and controlled space for experimentation, while ensuring responsible innovation and integration of appropriate safeguards and risk mitigation measures. To ensure a legal framework that promotes innovation, is future-proof and resilient to disruption, Member States should ensure that their national competent authorities establish at least one AI regulatory sandbox at national level to facilitate the development and testing of innovative AI systems under strict regulatory oversight before these systems are placed on the market or otherwise put into service. Member States could also fulfil this obligation through participating in already existing regulatory sandboxes or establishing jointly a sandbox with one or more Member States’ competent authorities, insofar as this participation provides equivalent level of national coverage for the participating Member States. AI regulatory sandboxes could be established in physical, digital or hybrid form and may accommodate physical as well as digital products. Establishing authorities should also ensure that the AI regulatory sandboxes have the adequate resources for their functioning, including financial and human resources.

Luxembourg specificity
AI Act (UE 2024/1689) articles 57 a 63 ; autorite LU non encore designee a date

In Luxembourg, the national AI market surveillance authority has not yet been formally designated as of today, meaning no national AI regulatory sandbox is operational yet. In practice, Luxembourg companies can anticipate two scenarios: a national sandbox jointly run by ILR, CNPD and possibly CSSF for the financial dimension, or joint participation in a cross-border sandbox (likely with Belgium and France given BENELUX regulatory coherence). The CNPD remains competent for the personal data dimension of any sandbox, and the EU AI Office in Brussels will oversee general-purpose AI models.

Luxgap practice: prepare your sandbox file now with dual GDPR-AI Act compliance, because in Luxembourg the CNPD will be unavoidable and a file ignoring the data protection angle will be rejected before the technical AI review even starts.