AI: A Strategic Vision for Luxembourg

Risk and scope 0 of 4

• Risk classification, not covered
• Prohibited practices, not covered
• Risk management system, not covered
• Impact assessment, not covered

Data and privacy 0 of 4

• Data governance and quality, not covered
• Data subject rights and consent, not covered
• Cross-border data transfer, not covered
• Copyright and training data, not covered

Transparency and records 1 of 4

• Transparency and disclosure to users 1 control
• Labelling of synthetic content, not covered
• Technical documentation, not covered
• Record keeping and logging, not covered

Technical safeguards 2 of 4

• Human oversight 1 control
• Accuracy, robustness and cybersecurity 1 control
• Bias and non-discrimination, not covered
• Testing and evaluation, not covered

Assurance and lifecycle 0 of 4

• Conformity assessment and certification, not covered
• Registration and notification, not covered
• Incident and breach reporting, not covered
• Post-market monitoring and corrective action, not covered

Rights and protected groups 1 of 4

• Automated decision-making rights, not covered
• Children and vulnerable groups 1 control
• Biometric identification and surveillance, not covered
• Whistleblowing, complaints and redress, not covered

Roles and organisation 4 of 6

• Supply chain and provider-deployer duties, not covered
• General purpose and foundation models 1 control
• Accountability and governance roles 2 controls
• Training and AI literacy 1 control
• Public sector use and procurement 1 control
• Innovation support and sandboxes, not covered

Enforcement and sectors 0 of 5

• Enforcement, penalties and regulators, not covered
• Sector rules: health, not covered
• Sector rules: finance and insurance, not covered
• Sector rules: employment, not covered
• Sector rules: education, not covered