Sovereign AI in the Luxembourg public sector: 5 use cases that meet the compliance bar

In brief

• AI4LUX launched on 4 March 2026 and the Digital Government Strategy 2026-2030 adopted on 17 December 2025 (gouvernement.lu): the State legitimises sovereign AI for the public sector.
• Five AI use cases meet the compliance bar: citizen assistant, consultation analysis, FR/DE/LB/EN translation, back-office, assisted administrative decision.
• AI Act fully applicable on 2 August 2026: Annex III point 5 classifies as high-risk any system assessing eligibility for public benefits (Regulation EU 2024/1689).
• 77% of Luxembourg residents grant fairly high trust to the public administration on AI, against 46% for the private sector (public consultation, 2,383 respondents, gouvernement.lu 2021).

Why AI becomes a public sector question in 2026

Why is 2026 a framing year for a Luxembourg public sector entity? AI4LUX was launched on 4 March 2026, with a sovereign chatbot for civil servants and a citizen chatbot on State websites, deployed on-site in Luxembourg with Mistral AI (gouvernement.lu, 4 March 2026). The Digital Government Strategy 2026-2030 was adopted on 17 December 2025, with an explicit pillar on sovereignty of data, technologies and infrastructures. The AI Act (Regulation EU 2024/1689) becomes fully applicable to high-risk systems on 2 August 2026, and its Annex III point 5 targets essential public services.

Social acceptability is in place: 77% of Luxembourg residents grant fairly high trust to the public administration on AI, against 46% for the private sector (public consultation on AI, 2,383 respondents, gouvernement.lu 2021). Five concrete use cases, each with its Luxembourg context and its safeguard.

1. Citizen administrative response assistant

The law of 24 February 1984 on the language regime requires the administration to reply, as far as possible, in the language of the requester among the three official languages. English is added for non-Luxembourgophone residents and European partners. A citizen often mixes the four languages in a single exchange.

A multilingual AI assistant takes the first contact on the website or the email channel. It detects the language, classifies the request by domain and urgency, proposes a pre-drafted reply for the human agent to validate, or routes to the right service. The State itself deploys this logic via the AI4LUX citizen chatbot on the most visited State websites.

Safeguard: documented European hosting, dedicated instance, no transfer to a US hyperscaler (Cloud Act and Schrems II decision risks). The final reply remains signed by the agent, not by the AI. For the articulation between AI Act, Cloud Act and GDPR, see our sovereignty comparison. The prerequisite is a private AI by design.

💡 Good to know: for the phone side of citizen first contact, see AI phone assistant. For the FAQ chatbot, see AI FAQ chatbot.

2. Public consultation analysis and summary

A public sector entity processes voluminous files: studies, technical reports, public consultations, opinions. The 2021 Luxembourg public consultation on AI illustrates the order of magnitude: 2,383 replies, final report of 67 pages (gouvernement.lu, 2021).

An AI module ingests the corpus (PDF, HTML, docx), extracts themes and positions, then produces a three-level summary: one-page note for management, five-page note for the committee, full report for the teams. Cross-checking with the internal knowledge base is possible.

Safeguard: processing on a dedicated instance, no document leak to a public LLM. Sources are cited and traceable in the output, and the summary is always validated by a human before distribution. See AI knowledge base and AI document processing.

3. Multilingual translation and adaptation FR, DE, LB, EN

Luxembourg administrative trilingualism is not optional. The law of 24 February 1984 sets the language regime, and the law of 20 July 2018 strengthened the institutional use of Luxembourgish. Bilingual or even trilingual communication for any major public document is the rule.

An AI module assists public-domain translation: administrative, legal, technical, pre-editing of press releases and internal materials. Luxembourgish remains the language where human supervision is most critical: a less-resourced language for models, with a specific administrative register.

Safeguard: private instance hosted in Europe, because documents being drafted may contain personal data under the GDPR. Final human proofreading is mandatory for any document with legal or civic reach. See AI document processing.

Administrative translation flow FR DE LB EN via private AI hosted in Europe with human review at the end of the chain

Multilingual administrative translation chain with private European AI and human review.

4. Recurring back-office task automation

Any public sector entity has recurring flows: supplier invoices under public procurement (Directive 2014/24/EU, transposed by the law of 8 April 2018 in Luxembourg, Legilux), weekly reports, deadline tracking, morning briefing of pending files.

An AI module reads and categorises public procurement invoices (amounts, contract reference, control against purchase order), generates weekly report drafts, and produces a consolidated morning briefing for management (files, deadlines, alerts).

Safeguard: internal processing, no sharing with a US SaaS outside the Data Privacy Framework. Public procurement document traceability is already mandatory via the Luxembourg Public Procurement Portal: the AI complies with it. See AI morning briefing and the accountants variant.

5. Assisted administrative decision (AI Act Annex III)

This is the most tightly regulated use case of the panorama. Annex III point 5 of Regulation EU 2024/1689 classifies as high-risk AI systems used by public authorities, or on their behalf, to assess the eligibility of natural persons for essential public benefits and services (including healthcare), and to grant, reduce, revoke or reclaim those benefits (artificialintelligenceact.eu). Full applicability on 2 August 2026.

What the AI does: it prepares the decision. Structured file extraction, completeness check, automatic control of legal criteria, flagging of atypical cases. It does not decide. The agent keeps the hand on final validation. The formula that holds legally is simple: the AI prepares, the agent decides.

Article 22 of the GDPR prohibits in principle fully automated decisions producing legal effects, except under strict exceptions. For a system falling under Annex III, the obligations of Title III of the AI Act apply: risk management, traceability, documentation, human oversight, robustness, cybersecurity. To that are added GDPR DPIA (art. 35), CE marking and declaration of conformity. See our AI Act 100-days guide.

💡 Good to know: a Luxembourg law firm (CF-Avocats, Abilways conference of 27 November 2025) specifically addressed the intersection of public procurement, AI and environmental criteria. The topic becomes a legal matter in its own right in Luxembourg.

The regulatory framework specific to the public sector

The five use cases share a base of four requirements that cannot be negotiated in 2026.

Digital sovereignty. The Digital Government Strategy 2026-2030 (adopted on 17 December 2025) sets the pillar. For a public sector entity: solutions hosted in Europe, legal traceability of subcontracting (protection against the Cloud Act).

AI Act. Regulation EU 2024/1689 becomes fully applicable to high-risk systems on 2 August 2026; Annex III point 5 targets essential public services. Article 4 (AI literacy) has been enforceable since 2 February 2025: agents using an AI system must be trained on its limits.

European public procurement. Directive 2014/24/EU, transposed by the law of 8 April 2018 (Legilux), applies as soon as the entity is a contracting authority. The AI specifications list sovereignty and traceability as non-negotiable criteria, not weighted ones.

Language regime. The law of 24 February 1984 frames the language of the reply to the citizen. AI does not exempt the administration from this obligation: it equips it. For definitions of the cited texts, see our AI business legal glossary.

Four regulatory pillars for Luxembourg public sector AI: sovereignty, AI Act Annex III, EU public procurement, language regime 1984

Four regulatory pillars for a compliant Luxembourg public sector AI project.

FAQ: your questions on AI in the Luxembourg public sector

1. Can a public sector entity deploy a citizen AI assistant without breaching the AI Act?

Yes, as long as the assistant stays in the register of reply and routing, not of decision. This use falls under limited risk (transparency obligation, art. 50 of Regulation EU 2024/1689). If it shifts towards assessing eligibility for a public benefit, it enters Annex III point 5, the high-risk regime fully applicable on 2 August 2026. The rule holds: the AI prepares, the agent decides.

2. What are the 5 priority AI use cases for the Luxembourg public sector in 2026?

Citizen administrative response assistant in FR, DE, LB and EN; public consultation analysis and summary; multilingual translation framed by the 1984 law; back-office task automation; assisted administrative decision under the AI Act Annex III framework. The first four move forward in 2026 under standard compliance. The fifth requires a dedicated high-risk AI Act project.

3. How does AI Act Annex III point 5 apply to a Luxembourg public sector entity?

Annex III point 5 classifies as high-risk any AI system assessing eligibility for essential public benefits and services (artificialintelligenceact.eu). Title III obligations: risk management, documentation, human oversight, robustness, cybersecurity. To that are added GDPR DPIA (art. 35), CE marking and declaration of conformity. Full applicability on 2 August 2026.

4. Do the SME Packages Digital and AI apply to a Luxembourg public sector entity?

No. The SME Packages Digital and AI target private SMEs and require a business permit under the law of 2 September 2011. A public sector entity falls under the European public procurement framework (Directive 2014/24/EU, transposed by the law of 8 April 2018, Legilux). Funding a public sector AI project goes through a regular public procurement tender, not an SME support scheme.

5. Should we wait until 2 August 2026 to launch an AI project in a public sector entity?

No. Uses outside Annex III (citizen assistant, consultation analysis, translation, back-office) move forward in 2026 with a standard framework and sovereign hosting. Only essential decision-support systems fall under Annex III point 5. Preparing the specifications and the AI literacy training (art. 4, enforceable since 2 February 2025) from now on remains the reasonable path.

Where to start before 2 August 2026

Three actions frame a compliant public sector AI project. One: map the flows, separating uses outside Annex III from high-risk ones. Two: prepare a public procurement AI tender that lists sovereignty (European hosting, no Cloud Act) and traceability as non-negotiable criteria, not weighted ones. Three: mobilise AI literacy training (art. 4 AI Act) for the agents concerned before 2 August 2026.

For the global prioritisation approach, see our AI strategy method. For a vertical approach, see public sector solutions.

We have supported a Luxembourg public sector organisation on a complete AI plan. The five use cases presented here are not theoretical: they match the matter we handle in a regulated context.

An AI use case to frame for your entity? Let us talk, with a review of your regulatory perimeter.

📞 Discuss your use case