Recital 37
Artificial Intelligence Act · UE 2024/1689
| (37) | Furthermore, it is appropriate to provide, within the exhaustive framework set by this Regulation that such use in the territory of a Member State in accordance with this Regulation should only be possible where and in as far as the Member State concerned has decided to expressly provide for the possibility to authorise such use in its detailed rules of national law. Consequently, Member States remain free under this Regulation not to provide for such a possibility at all or to only provide for such a possibility in respect of some of the objectives capable of justifying authorised use identified in this Regulation. Such national rules should be notified to the Commission within 30 days of their adoption. |
In Luxembourg, no national law has, to date, expressly authorised real-time remote biometric identification in public spaces within the meaning of Article 5(1)(h) of the AI Act. The AI market surveillance authority has not yet been formally designated, but the CNPD remains competent on the personal data dimension. As long as no detailed national rule is adopted and notified to the Commission within 30 days, such deployment must be treated as prohibited on Luxembourg territory.
Luxgap practice: before any pilot or POC involving facial recognition in public space, require your integrator to produce a legal note citing the precise national legal basis; in its absence, refuse production rollout and document that refusal in your AI Act Article 71 registry.
