Get EU AI Act ready in one week
Two AI Act duties bind your business right now: Article 4 AI literacy, in force since 2 February 2025, and Article 50 content marking, whose grace period ends on 2 December 2026. Our fixed-scope one-week sprint gives your Luxembourg SME a signed-off AI system register, per-system risk classification and an Article 4 AI-literacy plan — before the regulator, an auditor or a client asks for it.
Why Luxembourg businesses choose AI Act Readiness Sprint
Built around the deadline that is actually live
The high-risk regime moved to 2 December 2027 under the Digital Omnibus, but Article 50 did not move: from 2 December 2026 AI-generated or manipulated content must be machine-readable and labelled. Article 4 AI literacy has bound every deployer since 2 February 2025. We compress that work into one fixed week.
Built for 20–200-person firms
No enterprise GRC programme. A pragmatic, proportionate register and evidence pack sized for SMEs that use AI tools — ChatGPT, Copilot, chatbots, screening software — rather than build them with an in-house legal department.
Evidence, not opinions
You end the week with a signed-off per-system register and an evidence pack you can hand to a client, auditor or regulator — plus a prioritized list of any remaining obligations with owners and dates.
How it works
System inventory (days 1–2)
We interview team leads and scan your tool stack to list every AI system actually in use — including the shadow-IT tools nobody registered.
Classification & risk mapping (days 2–3)
For each system we determine whether you act as provider or deployer, then map it to the AI Act risk tiers: prohibited, high-risk, limited-risk transparency, or minimal risk.
AI-literacy plan (day 4)
Article 4 has required AI literacy for staff since February 2025. We draft a proportionate training plan matched to how each team actually uses AI.
Register & evidence pack (day 5)
We consolidate everything into a per-system register with evidence attached, walk your management through it, and get it formally signed off.
Use cases in Luxembourg
Fiduciaire using AI screening
A 40-person fiduciaire uses AI tools for KYC screening and document checks. The sprint classifies each system on the deployer side, flags the ones carrying transparency duties, and produces the register its CSSF-supervised clients now ask to see.
Recruiter with CV-screening AI
CV screening is a high-risk use case under Annex III. We document the deployer obligations — human oversight, logging, informing candidates — before an audit or a complaint forces the issue on someone else’s timeline.
SME rolling out ChatGPT & Copilot
A 120-person firm rolls out generative AI assistants company-wide. The sprint delivers the usage policy, the transparency notices and the Article 4 literacy plan in a single pass.
Who enforces the AI Act on you in Luxembourg
Luxembourg supervises the AI Act through a coordinated model rather than a single new regulator. The CNPD is the default market surveillance authority and your primary national contact; sector regulators keep their own remit and coordinate with it.
CNPD
National Commission for Data Protection — default market surveillance authority and the primary contact point for AI Act matters. Coordinates the authorities below.
CSSF
Financial sector. AI used by banks, investment firms, fund administrators and other supervised entities.
CAA
Insurance sector. AI in underwriting, pricing and claims handling.
ILNAS
Product safety and standardisation. Relevant to Annex I high-risk AI embedded in regulated products.
ILR
Critical infrastructure and regulated network sectors.
ALIA
Audiovisual media. Synthetic media and transparency for AI-generated or manipulated content.
ALMPS
Medical devices. AI functioning as, or inside, a regulated medical device.
JSA
Judicial and law enforcement processing oversight.
Bill 8476, which sets up the national implementation framework, was filed on 23 December 2024. Confirm its current parliamentary status before relying on it as law — this page describes the coordination model as designed, not a completed transposition.
EU AI Act & GDPR compliance
Every AI system we deploy follows EU AI Act obligations (risk classification, transparency, human oversight, logging) and GDPR principles (data minimisation, purpose limitation, EU data residency). We document conformity assessments, keep audit-ready logs, and deploy in EU-hosted or on-premise environments so your Luxembourg business stays compliant through the August 2026 enforcement milestone.
Transparent pricing
Fixed price: €4,800 for the one-week sprint — 70% Fit4Digital funding eligible
Luxembourg SMEs may be eligible for up to 70% co-funding through the Fit4Digital / SME Packages AI programme (up to €17,500).
Frequently asked questions
What is the fine risk if we do nothing?
Headline penalties reach €35 million or 7% of global turnover for prohibited practices, and lower tiers apply to other violations. In practice, enforcement against SMEs is expected to be proportionate — the AI Act explicitly moderates fines for SMEs — but “we didn’t know we used AI” is not a defence. A basic, signed-off register is the cheapest insurance available.
Are we a provider or a deployer?
Most SMEs are deployers: you use AI systems under your authority but do not develop them. You take on provider-like obligations if you put your own name on an AI system, substantially modify one, or fine-tune a model and offer it onward. The distinction drives your duties, which is why the sprint settles it per system, in writing.
Which AI Act deadlines are actually live right now?
Three things already bind you: prohibited practices and Article 4 AI literacy since 2 February 2025, GPAI obligations, governance and penalties since 2 August 2025, and general application plus Article 50 transparency since 2 August 2026. The next hard date is 2 December 2026, when the Article 50(2) grace period ends and AI-generated or manipulated content must be machine-readable and labelled. Regulation (EU) 2026/1744 — the Digital Omnibus on AI, in force since 27 July 2026 — moved the stand-alone Annex III high-risk regime from 2 August 2026 to 2 December 2027, and Annex I high-risk from 2 August 2027 to 2 August 2028.
We only use ChatGPT and a few SaaS tools — does this apply to us?
Almost certainly yes, at a proportionate level. AI-literacy obligations apply to any company using AI professionally, and transparency duties apply when customers interact with AI or see AI-generated content. The sprint typically surfaces 5–20 AI systems in an SME stack once SaaS features are counted.
What exactly do we get at the end of the week?
A per-system AI register (inventory, provider/deployer role, risk tier, obligations), an evidence pack backing each entry, an Article 4 AI-literacy plan, and a prioritized follow-up list. Documents are delivered in English, French or German and signed off with management in the closing session.
Can the sprint be co-funded?
Yes. Luxembourg SMEs can typically claim up to 70% co-funding through the Fit4Digital / SME Packages programmes, and we structure the engagement to qualify. With co-funding, the net cost of the €4,800 sprint can drop to roughly €1,440.
Related reading
Other services
AI Automation
Automate repetitive, high-volume work — invoicing, reporting, data entry.
AI Agents
Custom agents that complete multi-step tasks in your own tools and data.
AI Chatbots
Multilingual FR/DE/EN assistants grounded in your knowledge base.
Document Processing
Extract and validate data from invoices, contracts and KYC files.
AI Voice Agents
24/7 multilingual phone coverage with real-time appointment booking.
Ready to get started?
Book a free 30-minute audit. We will scope your project, map it to Luxembourg funding, and share a fixed-price proposal within 5 working days.
Book a Free AI Audit