I need to bring my Luxembourg organisation into compliance with recital 161 of AI Act (UE 2024/1689). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapRecital 161 creates a dual authority that catches providers and deployers off guard: when the same actor provides both the general-purpose AI model (GPAI) AND the system built on top (typically OpenAI with GPT-4 + ChatGPT Enterprise, or Anthropic with Claude + Claude for Work), competence shifts up to the EU AI Office in Brussels. In other cases (you integrate GPT-4 into your business product), the national market surveillance authority supervises but may request assistance from the AI Office to access information about the underlying model. The trap: Luxembourg organisations deploying high-risk systems built on GPAI are unaware they can be jointly audited by the national authority and the AI Office, with cross-border information sharing mutatis mutandis under Regulation 2019/1020.Mapping your GPAI responsibility chainBefore any deployment, you must document which authority is competent for each brick of your AI stack. Questions to settle:Is the underlying model (GPT-4, Claude, Gemini, Mistral Large, Llama) provided by the same actor as the final system you use? If yes, AI Office supervision.Does your use case fall under Annex III (high risk)? Recruitment, credit scoring, education, critical infrastructure, justice: yes.Do you have an identified communication channel with the AI Office to respond to a mutual assistance request triggered by a national authority?Do your contracts with GPAI providers explicitly require transmission of technical information mandated by Article 53 (model technical documentation) in case of investigation?Are your model usage logs retained in a way that supports a cross-jurisdictional request from AI Office + national authority within deadlines?How Luxgap automates this riskOur Luxgap GPAI Supervision Mapper eliminates jurisdictional ambiguity by automatically mapping, for each AI system in your organisation, the actual competent authority (AI Office Brussels or national market surveillance), the underlying model supplier chain, and the associated Article 6 / Annex III risk level. The tool continuously queries your M365 Copilot, Azure OpenAI, AWS Bedrock, Google Vertex AI, Anthropic Console APIs and Hugging Face integrations to reconstruct the real stack, without asking your teams to fill a declarative inventory.Automatically detects each AI system deployed in your IT estate and identifies the underlying GPAI model via API fingerprints, Azure Monitor logs and cloud billing.Determines whether model provider and system provider are the same legal entity, and infers AI Office vs national competence.Classifies each use case against Annex III and flags high-risk systems that will trigger AI Office + national authority cooperation.Generates a pre-filled technical file to respond to an Article 91 mutual assistance request, with automatic extraction of the model documentation required by Article 53.Triggers real-time alerts when a model upgrade (GPT-4 to GPT-4o, Claude 3 to Claude 3.5) changes the responsibil...

Recital 161 AI Act — Recital 161 · official text + guide

EU frameworkGDPR NIS 2 DORAAI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 161

Artificial Intelligence Act · UE 2024/1689

(161)

It is necessary to clarify the responsibilities and competences at Union and national level as regards AI systems that are built on general-purpose AI models. To avoid overlapping competences, where an AI system is based on a general-purpose AI model and the model and system are provided by the same provider, the supervision should take place at Union level through the AI Office, which should have the powers of a market surveillance authority within the meaning of Regulation (EU) 2019/1020 for this purpose. In all other cases, national market surveillance authorities remain responsible for the supervision of AI systems. However, for general-purpose AI systems that can be used directly by deployers for at least one purpose that is classified as high-risk, market surveillance authorities should cooperate with the AI Office to carry out evaluations of compliance and inform the Board and other market surveillance authorities accordingly. Furthermore, market surveillance authorities should be able to request assistance from the AI Office where the market surveillance authority is unable to conclude an investigation on a high-risk AI system because of its inability to access certain information related to the general-purpose AI model on which the high-risk AI system is built. In such cases, the procedure regarding mutual assistance in cross-border cases in Chapter VI of Regulation (EU) 2019/1020 should apply mutatis mutandis.

Luxembourg specificity

loi luxembourgeoise de transposition de l'AI Act (en cours de preparation a date)

In Luxembourg, the national AI market surveillance authority has not yet been formally designated by the national legislator. Pending the transposition law, the Brussels AI Office remains your pivot contact for all systems built on GPAI provided by the same actor, and the CNPD retains competence for the personal data dimension of AI systems (Article 22 GDPR on automated decisions, transfers outside the EU of prompts to OpenAI/Anthropic).

Luxgap practice: document your GPAI chain and your AI Office communication channels today, because the designation of the Luxembourg authority will take immediate effect with no grace period for high-risk systems already in production.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 161 creates a dual authority that catches providers and deployers off guard: when the same actor provides both the general-purpose AI model (GPAI) AND the system built on top (typically OpenAI with GPT-4 + ChatGPT Enterprise, or Anthropic with Claude + Claude for Work), competence shifts up to the EU AI Office in Brussels. In other cases (you integrate GPT-4 into your business product), the national market surveillance authority supervises but may request assistance from the AI Office to access information about the underlying model. The trap: Luxembourg organisations deploying high-risk systems built on GPAI are unaware they can be jointly audited by the national authority and the AI Office, with cross-border information sharing mutatis mutandis under Regulation 2019/1020.

Mapping your GPAI responsibility chain

Before any deployment, you must document which authority is competent for each brick of your AI stack. Questions to settle:

Is the underlying model (GPT-4, Claude, Gemini, Mistral Large, Llama) provided by the same actor as the final system you use? If yes, AI Office supervision.
Does your use case fall under Annex III (high risk)? Recruitment, credit scoring, education, critical infrastructure, justice: yes.
Do you have an identified communication channel with the AI Office to respond to a mutual assistance request triggered by a national authority?
Do your contracts with GPAI providers explicitly require transmission of technical information mandated by Article 53 (model technical documentation) in case of investigation?
Are your model usage logs retained in a way that supports a cross-jurisdictional request from AI Office + national authority within deadlines?

How Luxgap automates this risk

Our Luxgap GPAI Supervision Mapper eliminates jurisdictional ambiguity by automatically mapping, for each AI system in your organisation, the actual competent authority (AI Office Brussels or national market surveillance), the underlying model supplier chain, and the associated Article 6 / Annex III risk level. The tool continuously queries your M365 Copilot, Azure OpenAI, AWS Bedrock, Google Vertex AI, Anthropic Console APIs and Hugging Face integrations to reconstruct the real stack, without asking your teams to fill a declarative inventory.

Automatically detects each AI system deployed in your IT estate and identifies the underlying GPAI model via API fingerprints, Azure Monitor logs and cloud billing.
Determines whether model provider and system provider are the same legal entity, and infers AI Office vs national competence.
Classifies each use case against Annex III and flags high-risk systems that will trigger AI Office + national authority cooperation.
Generates a pre-filled technical file to respond to an Article 91 mutual assistance request, with automatic extraction of the model documentation required by Article 53.
Triggers real-time alerts when a model upgrade (GPT-4 to GPT-4o, Claude 3 to Claude 3.5) changes the responsibility chain.
Produces a timestamped PDF report, admissible during a joint inspection, demonstrating the deployer's Article 26 due diligence.

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real AI stack, with a free 48h blind audit to map your exposure before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 161

They trust us

Before we chat