EU frameworkGDPRNIS 2DORAAI ActWhistleblowing
Recital 156

Recital 156

Artificial Intelligence Act · UE 2024/1689

(156)

In order to ensure an appropriate and effective enforcement of the requirements and obligations set out by this Regulation, which is Union harmonisation legislation, the system of market surveillance and compliance of products established by Regulation (EU) 2019/1020 should apply in its entirety. Market surveillance authorities designated pursuant to this Regulation should have all enforcement powers laid down in this Regulation and in Regulation (EU) 2019/1020 and should exercise their powers and carry out their duties independently, impartially and without bias. Although the majority of AI systems are not subject to specific requirements and obligations under this Regulation, market surveillance authorities may take measures in relation to all AI systems when they present a risk in accordance with this Regulation. Due to the specific nature of Union institutions, agencies and bodies falling within the scope of this Regulation, it is appropriate to designate the European Data Protection Supervisor as a competent market surveillance authority for them. This should be without prejudice to the designation of national competent authorities by the Member States. Market surveillance activities should not affect the ability of the supervised entities to carry out their tasks independently, when such independence is required by Union law.

Luxembourg specificity
AI Act (UE 2024/1689), articles 70 et 74 ; règlement (UE) 2019/1020 ; désignation nationale luxembourgeoise en attente

In Luxembourg, no AI market surveillance authority has yet been formally designated. ILNAS (the Luxembourg Institute for Standardisation, Accreditation, Safety and Quality of Products and Services) already plays this role for several EU harmonisation regulations and is the natural candidate, without official confirmation. The CNPD remains competent on personal data as soon as an AI system processes personal data, and the EDPS remains the authority for EU institutions based in Luxembourg.

Luxgap practice: do not wait for the official designation to structure your compliance; our teams already prepare a technical file compatible with ILNAS, CNPD and EDPS to cover all future designation scenarios.