I need to bring my Luxembourg organisation into compliance with recital 158 of AI Act (UE 2024/1689). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapRecital 158 acknowledges an operational reality: for regulated financial institutions (banks, insurers, insurance intermediaries), the AI market surveillance authority is the same as the prudential supervisor, meaning CSSF in Luxembourg (and CAA for insurance). The classic trap is to treat the AI Act as a chantier isolated from the CRD internal governance and Solvency II framework: providers and deployers in finance who build a parallel AI risk management system next to their RAF (Risk Appetite Framework) get flagged for documentary inconsistency at the next SREP. CSSF expects native integration, not an AI silo.How to read this recital in practiceYour AI risk policy must be an annex or a section of your existing risk management policy (CSSF circular 12/552 as amended, or insurance equivalent), not an orphan document.The post-market monitoring under article 72 AI Act plugs into your existing model monitoring processes (independent validation, backtesting, TRIM/EBA model risk management).The quality management system under article 17 AI Act benefits from limited derogations for CRD credit institutions: do not duplicate, but map the overlaps with your ICAAP, RCSA and continuity plan.For banks under SSM, any information collected by CSSF during AI surveillance flows without delay to the ECB if relevant for prudential supervision. Anticipate that every material AI incident becomes visible in Frankfurt.The technical documentation in annex IV AI Act must be referenced in your model inventory and linked to the vendor file in your outsourcing register (CSSF circular 22/806).How Luxgap automates this riskOur Luxgap Financial AI Convergence Hub eliminates the dual workstream of AI Act vs CSSF by merging your AI model register, your 22/806 outsourcing map and your CRD/Solvency II risk management framework into one auditable source of truth. A specialised LLM agent reads your existing internal policies (governance, model risk, outsourcing, DORA), maps them onto articles 9, 10, 17 and 72 of the AI Act, and identifies the clauses to add rather than to rewrite.Connects your model inventory (SAS Model Manager, Dataiku, Databricks, MLflow) to your AI Act register and avoids double entry at each deployment.Detects overlaps between your article 17 QMS and your existing ICAAP/ORSA framework, and proposes applicable derogations under CRD or Solvency II.Generates post-market monitoring reports under article 72 in the format expected by CSSF, pre-integrated into your prudential reportings.Automatically alerts your compliance function when a material AI incident must be escalated to the ECB via the SSM.Produces a timestamped inspection file, defensible during a CSSF on-site or an ECB JST inspection, demonstrating consistency between AI Act, DORA, CRD, NIS 2 and GDPR on the same AI perimeter.Cross-references your AI vendor register with DORA chapter V requirements and circular 22/806 to prevent the same provider being classified differently across silos...

Recital 158 AI Act — Recital 158 · official text + guide

EU frameworkGDPR NIS 2 DORAAI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 158

Artificial Intelligence Act · UE 2024/1689

(158)

Union financial services law includes internal governance and risk-management rules and requirements which are applicable to regulated financial institutions in the course of provision of those services, including when they make use of AI systems. In order to ensure coherent application and enforcement of the obligations under this Regulation and relevant rules and requirements of the Union financial services legal acts, the competent authorities for the supervision and enforcement of those legal acts, in particular competent authorities as defined in Regulation (EU) No 575/2013 of the European Parliament and of the Council (46) and Directives 2008/48/EC (47), 2009/138/EC (48), 2013/36/EU (49), 2014/17/EU (50) and (EU) 2016/97 (51) of the European Parliament and of the Council, should be designated, within their respective competences, as competent authorities for the purpose of supervising the implementation of this Regulation, including for market surveillance activities, as regards AI systems provided or used by regulated and supervised financial institutions unless Member States decide to designate another authority to fulfil these market surveillance tasks. Those competent authorities should have all powers under this Regulation and Regulation (EU) 2019/1020 to enforce the requirements and obligations of this Regulation, including powers to carry our ex post market surveillance activities that can be integrated, as appropriate, into their existing supervisory mechanisms and procedures under the relevant Union financial services law. It is appropriate to envisage that, when acting as market surveillance authorities under this Regulation, the national authorities responsible for the supervision of credit institutions regulated under Directive 2013/36/EU, which are participating in the Single Supervisory Mechanism established by Council Regulation (EU) No 1024/2013 (52), should report, without delay, to the European Central Bank any information identified in the course of their market surveillance activities that may be of potential interest for the European Central Bank’s prudential supervisory tasks as specified in that Regulation. To further enhance the consistency between this Regulation and the rules applicable to credit institutions regulated under Directive 2013/36/EU, it is also appropriate to integrate some of the providers’ procedural obligations in relation to risk management, post marketing monitoring and documentation into the existing obligations and procedures under Directive 2013/36/EU. In order to avoid overlaps, limited derogations should also be envisaged in relation to the quality management system of providers and the monitoring obligation placed on deployers of high-risk AI systems to the extent that these apply to credit institutions regulated by Directive 2013/36/EU. The same regime should apply to insurance and re-insurance undertakings and insurance holding companies under Directive 2009/138/EC and the insurance intermediaries under Directive (EU) 2016/97 and other types of financial institutions subject to requirements regarding internal governance, arrangements or processes established pursuant to the relevant Union financial services law to ensure consistency and equal treatment in the financial sector.

Luxembourg specificity

circulaire CSSF 22/806 du 22 avril 2022 sur l'externalisation et reglement (UE) 2022/2554 (DORA)

In Luxembourg, the CSSF is the competent authority for prudential supervision of credit institutions, PFS and fund managers, and the Commissariat aux Assurances (CAA) for insurance and reinsurance undertakings. Pursuant to recital 158, both authorities are expected to be designated as AI market surveillance authorities for their respective scope, unless the Luxembourg legislator decides otherwise. CSSF circular 22/806 on outsourcing and Regulation (EU) 2022/2554 (DORA), applicable since 17 January 2025, already govern your third-party AI providers: the AI Act adds a layer but does not replace these obligations.

Luxgap practice: we map each AI model simultaneously under AI Act, DORA, 22/806 and GDPR to prevent the same provider (for example Microsoft Azure OpenAI or AWS Bedrock) being classified differently across three separate files submitted to CSSF.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 158 acknowledges an operational reality: for regulated financial institutions (banks, insurers, insurance intermediaries), the AI market surveillance authority is the same as the prudential supervisor, meaning CSSF in Luxembourg (and CAA for insurance). The classic trap is to treat the AI Act as a chantier isolated from the CRD internal governance and Solvency II framework: providers and deployers in finance who build a parallel AI risk management system next to their RAF (Risk Appetite Framework) get flagged for documentary inconsistency at the next SREP. CSSF expects native integration, not an AI silo.

How to read this recital in practice

Your AI risk policy must be an annex or a section of your existing risk management policy (CSSF circular 12/552 as amended, or insurance equivalent), not an orphan document.
The post-market monitoring under article 72 AI Act plugs into your existing model monitoring processes (independent validation, backtesting, TRIM/EBA model risk management).
The quality management system under article 17 AI Act benefits from limited derogations for CRD credit institutions: do not duplicate, but map the overlaps with your ICAAP, RCSA and continuity plan.
For banks under SSM, any information collected by CSSF during AI surveillance flows without delay to the ECB if relevant for prudential supervision. Anticipate that every material AI incident becomes visible in Frankfurt.
The technical documentation in annex IV AI Act must be referenced in your model inventory and linked to the vendor file in your outsourcing register (CSSF circular 22/806).

How Luxgap automates this risk

Our Luxgap Financial AI Convergence Hub eliminates the dual workstream of AI Act vs CSSF by merging your AI model register, your 22/806 outsourcing map and your CRD/Solvency II risk management framework into one auditable source of truth. A specialised LLM agent reads your existing internal policies (governance, model risk, outsourcing, DORA), maps them onto articles 9, 10, 17 and 72 of the AI Act, and identifies the clauses to add rather than to rewrite.

Connects your model inventory (SAS Model Manager, Dataiku, Databricks, MLflow) to your AI Act register and avoids double entry at each deployment.
Detects overlaps between your article 17 QMS and your existing ICAAP/ORSA framework, and proposes applicable derogations under CRD or Solvency II.
Generates post-market monitoring reports under article 72 in the format expected by CSSF, pre-integrated into your prudential reportings.
Automatically alerts your compliance function when a material AI incident must be escalated to the ECB via the SSM.
Produces a timestamped inspection file, defensible during a CSSF on-site or an ECB JST inspection, demonstrating consistency between AI Act, DORA, CRD, NIS 2 and GDPR on the same AI perimeter.
Cross-references your AI vendor register with DORA chapter V requirements and circular 22/806 to prevent the same provider being classified differently across silos.

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams prepare a demonstration on your real AI models, with a free 48-hour blank audit to measure the overlap between your existing frameworks and the AI Act before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 158

They trust us

Before we chat