Luxembourg IT assessment: what 87% of AI projects miss

Why enterprise IT assessment matters before AI implementation

Most AI projects fail not because of bad algorithms, but because of unprepared infrastructure. A McKinsey study found that 87% of AI projects never make it to production, with infrastructure and data issues cited as the primary blockers. For Luxembourg enterprises considering AI adoption, a thorough IT assessment is the essential first step.

An enterprise IT assessment evaluates your current technology infrastructure, data architecture, security posture, and operational readiness for AI workloads. Without this foundation, even the most sophisticated AI solutions will underperform or fail entirely.

Luxembourg businesses face unique challenges: multilingual data, strict EU regulatory requirements, and integration with legacy systems common in the financial services sector. A proper assessment identifies these challenges before they derail your AI investment.

The five pillars of AI readiness assessment

1. Data infrastructure evaluation

AI systems are only as good as their data. This pillar assesses:

• Data availability: Do you have the historical data AI models need for training?
• Data quality: How clean, consistent, and complete is your data?
• Data accessibility: Can data flow between systems, or is it siloed?
• Data governance: Who owns the data? What are the access controls?

Common gaps we find in Luxembourg enterprises:

• Customer data scattered across CRM, billing, and support systems with no unified view
• Document repositories with inconsistent naming and metadata
• Legacy databases with poor documentation or missing field definitions

2. Technical infrastructure capacity

AI workloads have different requirements than traditional business applications:

• Compute capacity: Do you have GPU resources for model training, or will you use cloud services?
• Storage scalability: Can your systems handle the data volumes AI requires?
• Network bandwidth: Is your infrastructure ready for real-time AI inference?
• Integration capabilities: Do you have APIs that allow AI systems to connect with existing tools?

For Luxembourg SMEs, cloud solutions like AWS, Azure, or the upcoming MeluXina-AI supercomputer (launching mid-2026) often provide more cost-effective compute than on-premise infrastructure.

3. Security and compliance posture

Luxembourg's position as a financial hub means strict security requirements:

• Data residency: Where is sensitive data stored? Does it comply with GDPR and Luxembourg regulations?
• Access controls: Are role-based permissions properly configured?
• Encryption: Is data encrypted at rest and in transit?
• Audit trails: Can you demonstrate compliance with CSSF and CNPD requirements?

Under the EU AI Act, high-risk AI systems (including those in financial services and HR) require documented risk assessments and oversight mechanisms from 2 December 2027 — the date the Digital Omnibus, Regulation (EU) 2026/1744, moved them to. The Article 50 transparency duties on chatbots, voice agents and AI-generated content already apply, since 2 August 2026.

4. Operational readiness

Technology alone doesn't guarantee AI success. Operational factors include:

• Team skills: Do your IT staff understand AI/ML concepts?
• Change management: Is leadership committed to AI adoption?
• Process documentation: Are current workflows documented for automation?
• Support structure: Who will maintain AI systems post-deployment?

5. Vendor and integration landscape

Most enterprises don't build AI from scratch. This pillar evaluates:

• Current vendor ecosystem: Which existing tools have AI capabilities you're not using?
• Integration complexity: How difficult is it to connect new AI tools with existing systems?
• Vendor lock-in risks: Are you dependent on proprietary formats or platforms?
• Build vs. buy decisions: Which AI capabilities should be custom-built vs. purchased?

The enterprise IT assessment process

Phase 1: discovery (1-2 weeks)

• Stakeholder interviews with IT, operations, and business leaders
• Documentation review of existing architecture
• Data inventory across all systems
• Security audit of current controls

Phase 2: technical analysis (2-3 weeks)

• Infrastructure capacity testing
• Data quality assessment with sample datasets
• Integration testing with key systems
• Performance benchmarking

Phase 3: gap analysis (1 week)

• Compare current state to AI requirements
• Prioritize gaps by impact and effort
• Identify quick wins vs. strategic investments
• Estimate remediation costs and timelines

Phase 4: roadmap development (1 week)

• Create phased implementation plan
• Define success metrics
• Assign ownership and accountability
• Establish review cadences

Common assessment findings in Luxembourg enterprises

Based on our work with Luxembourg businesses, these are the most frequent gaps:

Data layer issues (found in 85% of assessments):

• No single customer view across systems
• Inconsistent data formats between departments
• Missing metadata and data lineage documentation

Infrastructure gaps (found in 60% of assessments):

• Insufficient compute resources for AI training
• Legacy systems without API access
• Network bottlenecks limiting real-time AI inference

Governance gaps (found in 75% of assessments):

• No formal data ownership framework
• Incomplete access control documentation
• Missing AI ethics guidelines

Skills gaps (found in 90% of assessments):

• Limited in-house ML/AI expertise
• IT team focused on maintenance, not innovation
• No designated AI product owner

Quick self-assessment checklist

Before engaging consultants, Luxembourg businesses can evaluate their basic readiness:

Data readiness:

• We have at least 12 months of historical data in the processes we want to automate
• Our data is stored in structured, accessible formats
• We have documented our data sources and their relationships

Technical readiness:

• Our systems have APIs or can export data programmatically
• We have cloud infrastructure or budget for AI compute resources
• Our network can handle additional data transfer loads

Organizational readiness:

• Leadership has allocated budget for AI initiatives
• We have identified specific processes for AI automation
• Staff are willing to adopt new AI-powered tools

Compliance readiness:

• We understand which AI use cases are high-risk under EU AI Act
• Our data practices comply with GDPR
• We have documented our current IT security controls

If you checked fewer than 8 of these 12 items, a formal assessment is strongly recommended before AI investment.

Luxembourg-specific considerations

Financial services requirements

CSSF-regulated entities must consider additional factors:

• AI systems affecting customer decisions require documented oversight
• Model risk management frameworks apply to AI models
• Outsourcing AI to third parties triggers notification requirements

Multilingual data challenges

Luxembourg's trilingual environment creates unique data issues:

• Customer communications in French, German, and English
• Legal documents in multiple languages
• AI systems must handle language detection and translation

EU AI Act compliance

Two dates matter, and they are not the one most people quote. The Digital Omnibus on AI — Regulation (EU) 2026/1744, in force since 27 July 2026 — moved the high-risk obligations for stand-alone Annex III systems to 2 December 2027 and for AI embedded in regulated products to 2 August 2028. What did take effect on 2 August 2026 is the Article 50 transparency regime, which was not deferred.

Already binding today:

• Tell people they are talking to an AI. Chatbots and voice agents need a clear disclosure at first contact — in FR, DE and EN, not English only.
• Label deepfakes and mark generative output as machine-readable. Systems already on the market on 2 August 2026 have until 2 December 2026 for the Article 50(2) marking.
• Penalties are live. The Article 99 regime has applied since 2 August 2025: up to €35M/7% for prohibited practices, €15M/3% for most other obligations including Article 50, €7.5M/1% for supplying incorrect information — with lower caps for SMEs and small mid-caps.

Due by 2 December 2027 for stand-alone high-risk systems: documented risk management across the lifecycle, data governance and bias examination, Annex IV technical documentation, automatic logging with retention, human oversight design, and evidence on accuracy, robustness and cybersecurity. Registration happens in the EU database established under Article 71, with the obligation in Article 49 — there is no Luxembourg national registry and no "Luxembourg Digital Authority". Only high-risk systems in the critical-infrastructure area register at national level.

Luxembourg's own designation is not finished: bill of law n°8476, deposited on 23 December 2024, would make the CNPD the national competent authority and single point of contact, with ILNAS as notifying authority only. It was still in the parliamentary process at the time of writing. The obligations bind regardless — the AI Act is a regulation.

An IT assessment conducted now can identify which planned AI uses fall into high-risk categories and which already owe an Article 50 disclosure, giving you time to build compliant systems.

Next steps after assessment

A completed assessment should deliver:

1. Current state documentation — A clear picture of your IT landscape
2. Gap analysis — Specific issues blocking AI adoption
3. Prioritized roadmap — Phased plan addressing gaps in order of impact
4. Budget estimates — Realistic costs for infrastructure and implementation
5. Success metrics — Measurable KPIs to track progress

At 20 More, we conduct enterprise IT assessments specifically designed for AI readiness. Our assessments cover data, infrastructure, security, and organizational factors, delivering actionable roadmaps within 4-6 weeks.

Schedule a 30-minute consultation to discuss your enterprise IT assessment needs.