I need to bring my Luxembourg organisation into compliance with recital 170 of AI Act (UE 2024/1689). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 170 AI Act — Recital 170 · official text + guide

EU frameworkGDPR NIS 2 DORAAI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 170

Artificial Intelligence Act · UE 2024/1689

(170)

Union and national law already provide effective remedies to natural and legal persons whose rights and freedoms are adversely affected by the use of AI systems. Without prejudice to those remedies, any natural or legal person that has grounds to consider that there has been an infringement of this Regulation should be entitled to lodge a complaint to the relevant market surveillance authority.

Luxembourg specificity

AI Act article 70 (désignation des autorités nationales compétentes, en cours de transposition au Luxembourg)

In Luxembourg, the AI market surveillance authority has not yet been formally designated at the date of publication. In the meantime, the CNPD remains competent for the personal data dimension of AI systems, and the EU AI Office in Brussels directly supervises general-purpose AI models. A complaint can therefore be filed in parallel with both authorities depending on the alleged infringement.

Luxgap practice: we recommend setting up a single complaint@ entry point and a bilingual FR/EN response template now, as the first complaint typically arrives without warning and the future Luxembourg authority, once designated, will inherit ongoing files.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 170 opens a right to complain that runs in parallel with existing civil remedies. In practice, this means a candidate rejected by automated CV screening, a customer denied by AI scoring, or a competitor suspecting a prohibited use can file with the AI market surveillance authority, on top of suing in court. For the personal data dimension, the CNPD remains competent in parallel. Organisations without traces of their AI decisions (logs, model versions, training datasets) find themselves unable to respond to the authority's adversarial requests within the short instruction deadlines.

What this right to complain changes for your operations

Any natural or legal person can file: this includes your competitors, former employees, rejected customers, and even NGOs acting for third parties.
The threshold is low: grounds to consider an infringement is enough, no need to prove direct harm.
A complaint typically triggers requests for technical documentation (article 11), logs (article 12) and the FRIA where required.
Inability to produce these elements within 30 days is in itself an indicator of non-compliance with article 17 (quality management system).
Cumulation with a CNPD complaint on the data side is frequent: a single HR AI use case can trigger two parallel investigations.
The EU AI Office can intervene directly for general-purpose AI models, alongside the national authority.

How Luxgap automates this risk

Our Luxgap AI Complaint Shield turns every algorithmic decision in your organisation into a pre-built defence file, ready to hand over to the market surveillance authority within the hour following a complaint. The tool intercepts every call to an AI model (OpenAI, Mistral, Anthropic, Azure AI, AWS Bedrock, Hugging Face self-hosted) through a transparent proxy and captures the full decision context in real time, with no business-team input required.

Automatically captures for each inference the prompt, the response, the model version, the referenced training dataset and a cryptographically sealed timestamp (SHA-256 hash anchored daily on an immutable ledger).
Reconstructs on demand the complete file of a contested decision: who decided, on which data, with which model, with what uncertainty margin and which human-review option was offered.
Automatically detects use cases falling under articles 6 (high risk), 5 (prohibited practices) and 50 (transparency) by analysing the actual inference flow, not a declarative form.
Generates the EU AI Office and CNPD standard response pack in one click: article 11 technical documentation, article 12 logs, FRIA where applicable, article 26 register.
Sends a Teams or Slack alert as soon as an inference drifts outside the declared scope (use-case drift, undocumented new model, sensitive prompt).
Produces a timestamped, electronically signed PDF report, demonstrating the end-to-end traceability required by articles 12 and 17.

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS brick depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real AI flows, with a free blank audit within 48h to measure your exposure before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 170

They trust us

Before we chat