evidoria

← Back to browse

Good practice Imported

CNPD's Sandkëscht — Luxembourg's Two-Year-Old Data-Protection Sandbox for AI

Luxembourg · Luxembourg City · See the Luxembourg profile · See the Luxembourg City profile

Evidence: Descriptive / self-reported Top 74% 47/100 · Ask Evidence Copilot about this practice

Luxembourg's data-protection authority CNPD has run 'Sandkëscht,' a rolling AI sandbox, since May 2024. Independent research found 2 public pilots by mid-2025, but the CNPD itself has disclosed no participant counts or exit reports.

€10.3M
CNPD annual budget
67
CNPD staff
2
Publicly identified pilots (as of July 2025)
CNPD's Sandkëscht — Luxembourg's Two-Year-Old Data-Protection Sandbox for AI

Details

Maturity
Pilot
Promoter
Commission nationale pour la protection des données (CNPD)
Period
2024–2026 (ongoing rolling intake)
Region (NUTS)
LU00
Keywords
data protection, AI compliance, regulatory sandbox

Context

Luxembourg's data-protection authority CNPD sought to give AI developers a regulatory sandbox ahead of the EU AI Act's formal sandbox requirement.

Activities

CNPD launched 'Sandkëscht' on 21 May 2024, opening applications from 14 June 2024; participation runs 9 to 18 months across three phases, run from the CNPD's regular €10.3M annual budget and 67-strong staff rather than dedicated funding.

Results

CNPD has not published participant or application counts on its own channels. An independent 2026 study for the Austrian Chamber of Commerce (JOANNEUM RESEARCH) identified two publicly mentioned pilots as of July 2025 — AI-assisted speech analysis for customer interaction, and algorithmic risk models in finance.

Conclusions

Each project is meant to conclude with an internal 'exit report', and CNPD announced a systematic review process from autumn 2025, but as of August 2026 no exit reports or aggregate results have been made public; with only two pilots identified over more than two years and no self-published throughput data, this is a longer-running but lower-disclosure sandbox than comparable Latvia/Colombia programmes.

Implementation
Indicative cost
Low (< €50k)
Time to results
Medium (1–3 years)
Staffing & skills
CNPD regulatory staff (67-strong authority)

Conditions for success

  • Runs ahead of the EU AI Act's formal sandbox requirement, giving early regulatory experience
  • Three-phase, 9-18 month participation structure with a planned internal 'exit report' per project

Common failure modes

  • No participant counts, exit reports, or aggregate outcome data published by CNPD itself after more than two years

Commonly funded by

National / regional programmes

Indicative funding routes for practices of this type — always check each programme's current calls and eligibility rules.

Do you run this practice? Claim it — verified implementers get a public contact pathway and can propose corrections.

Data sources

Where this practice's information was retrieved from, and when.

Attachments

Similar practices you may find useful