Artificial intelligence is now becoming part of everyday business life in Luxembourg. According to STATEC and CSSF 2026 data, 22% of Luxembourg companies already integrate AI into their business (28% in the financial sector), and 60% of respondents consider generative AI to be an opportunity. In addition, 90% of Luxembourg workers are exposed to AI, with an estimated replacement risk of 14%.
This transformation comes with a dense legal framework that every employer now needs to master.
A multi-layered legal framework
Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR") remains the baseline whenever AI involves the processing of employees' personal data, requiring compliance with the principles of lawfulness, transparency, data minimisation, purpose limitation, security, and the prohibition of automated individual decision-making.
Regulation (EU) 2024/1689 of 13 June 2024 on artificial intelligence (the "AI Act"), the world's first comprehensive AI framework based on a risk-based approach (prohibited, high-risk, limited, minimal), has been progressively applicable since 2 February 2025. All obligations under the AI Act are expected to be in force by the end of 2027.
Under the AI Act, employers most often act as "deployers", bearing obligations of compliant use, human oversight, relevance of input data, log retention and informing employees. Employers must also ensure a sufficient level of AI literacy among their staff, taking into account their technical knowledge and the context of use. This is likely the most significant obligation arising from the AI Act, and the one that will require the most practical adjustments from employers.
Added to these provisions is Directive (EU) 2024/2831 of 23 October 2024 on improving working conditions in platform work (the "Platform Work Directive"), whose transposition into Luxembourg law is the subject of Draft Law No. 8699 of 10 February 2026, to be transposed by 2 December 2026, and which includes strict prohibitions on data processing and the use of AI tools.
Recruitment, monitoring and sanctions: the risk areas
Under the AI Act, AI systems used for recruitment and candidate selection are classified as high-risk systems, while emotion recognition in the workplace is outright prohibited.
In this respect, Luxembourg's Labour Code prohibits discrimination at every stage of the employment relationship, reversing the burden of proof in favour of the employee, which exposes employers to litigation risk in the event of algorithmic bias, even unintentional.
Article 22 of the GDPR also prohibits decisions based solely on automated processing that produce significant legal effects, subject to exceptions, in which case the employee retains a right to meaningful human intervention and to challenge the decision.
On monitoring, employers must have a legal basis, generally legitimate interest, and must inform the staff delegation or, failing that, the Labour and Mines Inspectorate, about the purpose, methods and retention period of the data. Above 150 employees, monitoring of an employee's output or performance requires co-decision with the staff delegation.
The AI Act further classifies as high-risk any systems used to monitor and evaluate employees' performance and behaviour.
On the disciplinary side, using AI to influence working conditions, promotion, dismissal or task allocation is also classified as high-risk under the AI Act, calling for caution before any sanction based, even partially, on an AI tool.
Adapting the business
Employment contracts should include dedicated clauses covering the use of generative AI tools, confidentiality of sensitive data, intellectual property ownership of AI-generated content, transparency on performance-monitoring tools, and a loyalty obligation requiring human review before any official use of AI output.
A dedicated AI policy could also formalise authorised tools, permissible data inputs, verification obligations and applicable sanctions.
Finally, training staff on how AI works and its associated risks forms part of the employer's obligations of AI literacy, information and transparency.
Key takeaways
As part of implementing their obligations under the AI Act, employers are advised to prioritise the following:
- the GDPR applies in full to the use of AI in the workplace;
- employers are subject to "deployer" obligations under the AI Act, particularly for high-risk systems;
- AI use must be governed to avoid "shadow AI" and preserve business confidentiality;
- staff training is essential; and
- AI should remain a support to human decision-making, not a substitute for it.
Share on
