EU AI Act for Luxembourg companies: what SMEs must check in 2026

The EU AI Act is now a practical compliance issue for Luxembourg companies. It entered into force in 2024 and is being phased in, with the general framework fully applicable from 2 August 2026, subject to sector and transition rules.

The law uses a risk-based structure. Some AI practices are banned, including harmful manipulation, social scoring, certain biometric categorisation and emotion recognition in workplaces and education. Those prohibitions already applied from February 2025.

High-risk AI is the main business concern. The European Commission lists uses in critical infrastructure, education, employment, access to essential services, law enforcement, migration and justice. For Luxembourg firms, HR screening, credit scoring, compliance tools and regulated financial workflows are the areas to examine first.

High-risk systems require risk management, high-quality data, logging, technical documentation, clear user information, human oversight, robustness, cybersecurity and accuracy. General-purpose AI model rules became applicable in 2025, while transparency duties such as telling users they interact with a chatbot come into effect in August 2026.

The practical first step for SMEs is an AI inventory: what tools are used, who provides them, what data they process, whether they affect people’s rights or access to services, and whether a human can meaningfully override the output.