I need to bring my Luxembourg organisation into compliance with recital 172 of AI Act (UE 2024/1689). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 172 AI Act — Recital 172 · official text + guide

EU frameworkGDPR NIS 2 DORAAI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 172

Artificial Intelligence Act · UE 2024/1689

(172)

Persons acting as whistleblowers on the infringements of this Regulation should be protected under the Union law. Directive (EU) 2019/1937 of the European Parliament and of the Council (54) should therefore apply to the reporting of infringements of this Regulation and the protection of persons reporting such infringements.

Luxembourg specificity

loi luxembourgeoise du 16 mai 2023 portant transposition de la directive (UE) 2019/1937 sur la protection des lanceurs d'alerte

In Luxembourg, the law of 16 May 2023 transposing Directive (EU) 2019/1937 requires an internal reporting channel for any entity with at least 50 employees and establishes the Office des signalements as the competent external authority. For AI Act reports, this Office coexists with the future Luxembourg AI market surveillance authority (not yet designated to date) and with the CNPD for the personal data angle. Protection against retaliation also covers facilitators and the whistleblower's relatives.

Luxgap practice: set up a single internal channel with automatic routing based on qualification (GDPR to DPO, AI to AI Officer, financial to compliance) and keep encrypted traceability enforceable during a joint Office des signalements / CNPD inspection.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 172 explicitly anchors the reporting of AI Act infringements to the protective regime of Directive (EU) 2019/1937, transposed in Luxembourg by the law of 16 May 2023. In practice, what brings organisations down is not the absence of a reporting channel, but disguised retaliation against a data scientist who flagged a model bias, or the leak of the whistleblower's identity during internal investigation. The EU AI Office and, for the personal data angle, the CNPD can be seized in parallel with the Luxembourg Office des signalements, and the burden of proof reverses in favour of the whistleblower.

The concrete pitfalls when the alert concerns an AI system

Confusing the GDPR channel (article 38) and the AI Act channel: a report on discriminatory bias in a high-risk system falls under both regimes simultaneously.
Tracing the whistleblower via the AI system's own logs (who queried the model, who exported the results) is indirect retaliation, which is sanctioned.
Forgetting that subcontractors, interns, former employees and candidates are also protected when they report an AI Act infringement.
Handling the alert without segregation: the AI compliance officer must not be the same person targeted by the alert (typical case of the AI Officer who validated the contested system).
Missing the 7-day acknowledgement deadline and the 3-month deadline to inform the whistleblower of the follow-up.

How Luxgap automates this risk

Our Luxgap Whistleblower Shield for AI is the only Luxembourg reporting channel natively compatible with the AI Act, Directive 2019/1937 and the GDPR, which cryptographically guarantees whistleblower anonymity even against a malicious system administrator. The tool end-to-end encrypts reports with a key held only by the designated officer, hosts evidence on Luxembourg sovereign infrastructure (LuxConnect / eBRC), and automatically triggers handling workflows with eIDAS-qualified timestamps.

Provides a dedicated AI report form that guides the whistleblower to the correct qualification (bias, high-risk non-compliance, undeclared GPAI model, CE marking manipulation).
Automatically detects deanonymisation attempts via metadata correlation (IP, browser, connection times) and alerts the officer when the risk arises.
Segregates investigation into watertight chambers: the AI officer does not access HR alerts and vice versa, with immutable logging of accesses.
Automatically generates the 7-day acknowledgements and 3-month follow-up reports, electronically signed.
Produces an enforceable anonymised register of reports, exportable to the EU AI Office and the Luxembourg Office des signalements in case of inspection.
Continuously scans the logs of declared AI systems to detect any abnormal query targeting the identity of a known whistleblower (automated anti-retaliation protection).

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your perimeter. Request a tailored quote and our teams will prepare a demonstration on your actual AI inventory, with a free 48-hour blind audit to measure the robustness of your current channel before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 172

They trust us

Before we chat