CNPD's Sandkëscht — Luxembourg's Two-Year-Old Data-Protection Sandbox for AI

The Commission nationale pour la protection des données (CNPD), Luxembourg's data-protection authority, launched "Sandkëscht" on 21 May 2024, opening applications from 14 June 2024, ahead of a formal EU AI Act sandbox requirement; participation runs 9 to 18 months across three phases.
CNPD has not published participant or application counts on its own channels. An independent 2026 study for the Austrian Chamber of Commerce (JOANNEUM RESEARCH) identified two publicly mentioned pilots as of July 2025 — AI-assisted speech analysis for customer interaction, and algorithmic risk models in finance — and noted that the sandbox runs from the CNPD's regular €10.3 million annual budget and 67-strong staff rather than dedicated funding.
Each project is meant to conclude with an internal "exit report" (gap analysis), and CNPD announced a systematic review process from autumn 2025, but as of August 2026 no exit reports or aggregate results have been made public; the sandbox also has no dedicated legal basis beyond general GDPR cooperation powers.
As a caution, with only two pilots identified over more than two years, and no self-published throughput or outcome data, this is a longer-running but lower-disclosure sandbox than Latvia's or Colombia's — a useful contrast case on transparency practice.

Read the full analysis: https://cnpd.public.lu/fr/actualites/national/2024/05/lancement-sandkescht.html