I need to bring my Luxembourg organisation into compliance with recital 140 of AI Act (UE 2024/1689). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 140 AI Act — Recital 140 · official text + guide

EU frameworkGDPR NIS 2 DORAAI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 140

Artificial Intelligence Act · UE 2024/1689

(140)

This Regulation should provide the legal basis for the providers and prospective providers in the AI regulatory sandbox to use personal data collected for other purposes for developing certain AI systems in the public interest within the AI regulatory sandbox, only under specified conditions, in accordance with Article 6(4) and Article 9(2), point (g), of Regulation (EU) 2016/679, and Articles 5, 6 and 10 of Regulation (EU) 2018/1725, and without prejudice to Article 4(2) and Article 10 of Directive (EU) 2016/680. All other obligations of data controllers and rights of data subjects under Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680 remain applicable. In particular, this Regulation should not provide a legal basis in the meaning of Article 22(2), point (b) of Regulation (EU) 2016/679 and Article 24(2), point (b) of Regulation (EU) 2018/1725. Providers and prospective providers in the AI regulatory sandbox should ensure appropriate safeguards and cooperate with the competent authorities, including by following their guidance and acting expeditiously and in good faith to adequately mitigate any identified significant risks to safety, health, and fundamental rights that may arise during the development, testing and experimentation in that sandbox.

Luxembourg specificity

loi modifiee du 1er aout 2018 relative a la protection des personnes physiques a l'egard du traitement des donnees a caractere personnel

In Luxembourg, the AI market surveillance authority has not yet been formally designated at the time of writing, and no national AI regulatory sandbox is yet operational. The CNPD remains the reference authority to validate the GDPR Article 6(4) and 9(2)(g) legal basis for any reuse of personal data in a future sandbox, and the amended law of 1 August 2018 on the protection of natural persons continues to frame the processing.

Luxgap practice: before any sandbox application (national or cross-border via the EU AI Office), we recommend a prior CNPD consultation under GDPR Article 36 to secure the 9(2)(g) basis, particularly in health and fintech sectors where sensitive data dominate.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 140 opens a narrow legal door: reusing in an AI sandbox personal data collected for other purposes, but only under the strict conditions of GDPR Articles 6(4) and 9(2)(g). The classic trap is to assume that sandbox participation alone legitimises any reuse: it does not. The CNPD remains fully competent on the personal data dimension, and all other GDPR obligations (information, data subject rights, security, DPIA) still apply. Worse, this recital explicitly excludes using the sandbox basis to ground an Article 22 automated decision, which many AI POCs overlook.

The cumulative conditions to document before entering a sandbox

Demonstrate the public interest nature of the AI system (health, environment, security, public services), not a disguised commercial interest.
Run a written GDPR Article 6(4) compatibility test between the original collection purpose and the AI purpose.
Identify the specific legal basis: Article 9(2)(g) for sensitive data, which requires a proportionate EU or national legal act.
Implement technical safeguards (pseudonymisation, isolated environment, access logging, deletion at sandbox end).
Actively cooperate with the sandbox supervisory authority and the CNPD, promptly escalating any significant identified risk.
Exclude any sandbox use that would ground a GDPR Article 22(2)(b) automated decision.
Preserve data subject rights (access, rectification, objection) throughout the sandbox duration.

How Luxgap automates this risk

Our Luxgap Sandbox Compatibility Gate turns the decision to enter an AI sandbox into a cryptographically sealed checkpoint: no dataset crosses the experimental perimeter without passing the seven checks derived from Recital 140. The tool plugs a specialised LLM agent into your records of processing, existing DPIAs and data lake (Azure Data Lake, AWS S3, Snowflake, Databricks) to automatically produce the Article 6(4) compatibility test and the Article 9(2)(g) qualification, without a single Excel form for the data scientist.

Automatically detects personal data candidate sets for the sandbox by scanning Databricks, Snowflake, Azure Purview and Collibra metadata.
Generates the GDPR Article 6(4) compatibility test, drafted and reasoned by an AI agent, ready for DPO and CNPD review.
Technically blocks (via webhook to the MLflow or SageMaker pipeline) any reuse that would result in an Article 22 automated decision, in line with the explicit exclusion in Recital 140.
Applies on the fly the pseudonymisation, minimisation and network isolation required as appropriate safeguards.
Alerts the DPO in real time on Teams or Slack as soon as a significant risk to health, safety or fundamental rights is detected during experimentation.
Produces a timestamped and signed sandbox PDF dossier, enforceable before the CNPD and the future Luxembourg AI regulator, demonstrating cumulative AI Act and GDPR compliance.

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your actual AI pipeline, with a free 48-hour blind audit to measure your exposure before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 140

They trust us

Before we chat