I need to bring my Luxembourg organisation into compliance with recital 45 of AI Act (UE 2024/1689). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 45 AI Act — Recital 45 · official text + guide

EU frameworkGDPR NIS 2 DORAAI ActWhistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 45

Artificial Intelligence Act · UE 2024/1689

(45)	Practices that are prohibited by Union law, including data protection law, non-discrimination law, consumer protection law, and competition law, should not be affected by this Regulation.

Luxembourg specificity

AI Act (UE 2024/1689) articule avec loi du 1er aout 2018 (CNPD) et circulaires CSSF 22/806 outsourcing

In Luxembourg, the AI market surveillance authority has not yet been formally designated, but the CNPD remains fully competent on the GDPR dimension of any AI system processing personal data, and the CSSF retains its sectoral sanction powers over AI systems operated by regulated financial entities (GDPR art. 22 combined with CSSF circulars on IT outsourcing and cloud). The Centre pour l'egalite de traitement can be seized on discriminatory algorithmic bias, and the Union luxembourgeoise des consommateurs (ULC) on generative dark patterns.

Luxgap practice: for any fintech or PSF deploying an AI model, we systematically trigger a cross-analysis CNPD + CSSF + AI Act + competition before go-live, because the CSSF treats any decision-making model as a material governance component.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Many organisations believe that complying with the AI Act is enough to secure an AI system. It is not. Recital 45 makes clear that the AI Act stacks on top of the GDPR, consumer law, competition law and anti-discrimination law. The CNPD can therefore sanction on GDPR grounds an AI system that is fully AI Act compliant, and Luxembourg's competition authority can attack a pricing algorithm under article 101 TFEU even if the system is not classified as high-risk.

The four layers of law that apply to any AI system

GDPR: legal basis, minimisation, automated decision-making (art. 22), DPIA, transfers outside the EU. The CNPD remains fully competent on the personal data dimension.
Anti-discrimination law: a biased credit, HR or insurance scoring system remains actionable before Luxembourg civil courts and the Centre pour l'egalite de traitement, regardless of CE marking under the AI Act.
Consumer law: misleading commercial practices, generative dark patterns, chatbot manipulation and abusive targeted advertising fall under ULC and the Consumer Code.
Competition law: collusive pricing algorithms, abuse of dominance via recommendation systems, refusal to grant access to training data.

In practice: your AI Act compliance must be cross-checked with your GDPR compliance, and each AI use case must be analysed under multiple frameworks before deployment.

How Luxgap automates this risk

Our Luxgap AI Multi-Compliance Mapper eliminates the most dangerous blind spot of the AI Act: the belief that one single law is enough. The tool deploys an LLM agent that reads the technical sheet of each production AI system (model, training data, purpose, affected populations, delivery channel) and confronts it simultaneously with the four legal corpora cited by recital 45, integrating natively with your internal sources (Confluence, Azure ML, AWS Bedrock, Odoo GDPR register, vendor contracts).

Classifies each AI use case across the four dimensions of recital 45 and flags risk-cumulation zones (e.g. HR scoring = GDPR art. 22 + anti-discrimination + AI Act Annex III).
Automatically detects practices already prohibited by other EU texts (political profiling, behavioural manipulation, private social scoring) before they reach production.
Generates a cross-compliance matrix AI Act / GDPR / consumer / competition, continuously updated against EU AI Office and EDPB guidance.
Alerts via Teams or email as soon as a new model or pipeline detected by Azure ML or AWS Bedrock scans goes live without multi-framework validation.
Produces a time-stamped PDF report, enforceable before the CNPD and the EU AI Office, demonstrating that each system has been assessed under every applicable legal corpus.

Available as part of a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real AI use cases, with a free 48h white audit to map your multi-framework exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 45

They trust us

Before we chat