I need to bring my Luxembourg organisation into compliance with recital 153 of AI Act (UE 2024/1689). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapRecital 153 signals a tough operational reality: as long as Luxembourg has not formally designated its AI market surveillance authority, providers and deployers operate in institutional uncertainty. In practice, the EU AI Office (Brussels) already supervises general-purpose AI models, and the CNPD retains full competence on the personal data dimension of AI systems. The trap is to wait for the Luxembourg designation before structuring AI governance, while obligations apply on a European timeline that does not pause for any Member State's internal organisation.What this recital changes for your AI governanceThe national single point of contact will centralise notifications, controls and exchanges with the EU AI Office: your compliance files must be ready to be transmitted to an as-yet-unnamed authority.The notifying authority and market surveillance authority may be one and the same entity or two distinct entities: your regulatory mapping must anticipate both scenarios.The CNPD keeps parallel competence over any AI system processing personal data: the same system may be inspected simultaneously by two authorities with different angles.The EU AI Office remains the direct counterpart for GPAI models with systemic risk, regardless of the Luxembourg authority.Any Luxembourg institutional reorganisation (creation of a new authority, attachment to ILR, ILNAS or a dedicated entity) will impact your serious incident notification channels (article 73).How Luxgap automates this riskOur Luxgap AI Authority Radar turns institutional uncertainty into structured, defensible monitoring. The tool continuously watches publications from the Luxembourg Official Journal, the Memorial, EU AI Office, CNPD, ILNAS and ILR websites to detect in real time the effective designation of the Luxembourg AI authority and any change in its material scope.Monitors official sources daily (Memorial, EU Official Journal, EU AI Office, CNPD, ILNAS, European Commission) and alerts by email or Teams as soon as a Luxembourg AI authority is formally designated.Automatically maps the distribution of competences between the notifying authority, the surveillance authority, the single point of contact and the CNPD, and generates your internal notification matrix.Pre-fills templates for serious incident notification (article 73), high-risk system placing on the market and authorisation requests, ready to be sent on effective designation.Maintains a time-stamped registry of consulted sources, usable as evidence of reasonable diligence during an EU AI Office inspection.Cross-references with your AI system inventory to identify which will fall under Luxembourg supervision versus which will remain under direct EU AI Office oversight.Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real AI inventory, with a free 48h blank audit to measure you...

Recital 153 AI Act — Recital 153 · official text + guide

EU frameworkGDPR NIS 2 DORAAI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 153

Artificial Intelligence Act · UE 2024/1689

(153)

Member States hold a key role in the application and enforcement of this Regulation. In that respect, each Member State should designate at least one notifying authority and at least one market surveillance authority as national competent authorities for the purpose of supervising the application and implementation of this Regulation. Member States may decide to appoint any kind of public entity to perform the tasks of the national competent authorities within the meaning of this Regulation, in accordance with their specific national organisational characteristics and needs. In order to increase organisation efficiency on the side of Member States and to set a single point of contact vis-à-vis the public and other counterparts at Member State and Union levels, each Member State should designate a market surveillance authority to act as a single point of contact.

Luxembourg specificity

projet de loi luxembourgeoise de mise en oeuvre du reglement (UE) 2024/1689 (AI Act), en cours

In Luxembourg, the AI market surveillance authority has not yet been formally designated. The transposition bill is under discussion and several institutional scenarios are considered (ILNAS, ILR, dedicated authority, or sectoral split). In the meantime, the CNPD retains competence on the personal data dimension, and the EU AI Office supervises GPAI models directly from Brussels.

Luxgap practice: do not wait for the designation to structure your AI inventory registry, article 6 risk matrix and serious incident notification procedures. The gap between designation and first inspection will be short.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 153 signals a tough operational reality: as long as Luxembourg has not formally designated its AI market surveillance authority, providers and deployers operate in institutional uncertainty. In practice, the EU AI Office (Brussels) already supervises general-purpose AI models, and the CNPD retains full competence on the personal data dimension of AI systems. The trap is to wait for the Luxembourg designation before structuring AI governance, while obligations apply on a European timeline that does not pause for any Member State's internal organisation.

What this recital changes for your AI governance

The national single point of contact will centralise notifications, controls and exchanges with the EU AI Office: your compliance files must be ready to be transmitted to an as-yet-unnamed authority.
The notifying authority and market surveillance authority may be one and the same entity or two distinct entities: your regulatory mapping must anticipate both scenarios.
The CNPD keeps parallel competence over any AI system processing personal data: the same system may be inspected simultaneously by two authorities with different angles.
The EU AI Office remains the direct counterpart for GPAI models with systemic risk, regardless of the Luxembourg authority.
Any Luxembourg institutional reorganisation (creation of a new authority, attachment to ILR, ILNAS or a dedicated entity) will impact your serious incident notification channels (article 73).

How Luxgap automates this risk

Our Luxgap AI Authority Radar turns institutional uncertainty into structured, defensible monitoring. The tool continuously watches publications from the Luxembourg Official Journal, the Memorial, EU AI Office, CNPD, ILNAS and ILR websites to detect in real time the effective designation of the Luxembourg AI authority and any change in its material scope.

Monitors official sources daily (Memorial, EU Official Journal, EU AI Office, CNPD, ILNAS, European Commission) and alerts by email or Teams as soon as a Luxembourg AI authority is formally designated.
Automatically maps the distribution of competences between the notifying authority, the surveillance authority, the single point of contact and the CNPD, and generates your internal notification matrix.
Pre-fills templates for serious incident notification (article 73), high-risk system placing on the market and authorisation requests, ready to be sent on effective designation.
Maintains a time-stamped registry of consulted sources, usable as evidence of reasonable diligence during an EU AI Office inspection.
Cross-references with your AI system inventory to identify which will fall under Luxembourg supervision versus which will remain under direct EU AI Office oversight.

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real AI inventory, with a free 48h blank audit to measure your regulatory exposure before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 153

They trust us

Before we chat