The CNPD is not only set to change its chairmanship; it is also set to expand its remit. In addition to overseeing the processing of personal data, it may soon take on the role of coordinating the supervision of artificial intelligence systems in Luxembourg.

Philippe Ney and Andreea Monnat have been appointed as members of the National Data Protection Commission (CNPD) following a public call for applications. Philippe Ney will take on the role of Chair. Their terms of office will begin on 1 November 2026 for six years and may be renewed once. They will replace Tine A. Larsen and Thierry Lallemang respectively, who have completed two terms of office and 12 years on the Board. The two new commissioners will join Alain Herrmann and Florent Kling in leading the authority, which has a staff of around 85.

Partner at the law firm Kleyr Grasso, Philippe Ney has been a member of the Luxembourg Bar since 2007. He advises companies on employment law and data protection matters, particularly in relation to inspections by the CNPD, personal data breaches or requests for access made by third parties. This appointment therefore places at the helm of the regulator a practitioner who, until now, had been advising the organisations subject to its supervision.

Andreea Monnat brings a more technology- and institution-focused background. She holds a PhD in computer science and an Executive MBA from Insead, and is Deputy Secretary-General of the National Research Fund. She served as its acting Chief Executive between December 2023 and December 2025. Her career spans public research funding, partnerships between businesses and universities, technology transfer and innovation policy.

New tasks currently being organised

This move comes at a time when the scope of the CNPD is set to extend beyond data protection alone. Bill 8476, which sets out the Luxembourg implementation of the European AI Act, provides for the Commission to be designated as the default horizontal market surveillance authority. It would also become the single point of contact and ensure coordination between the relevant sectoral regulators.

These specialist authorities would include, in particular, the Financial Sector Supervisory Commission, the Commissariat aux assurances, the Luxembourg Regulatory Institute, the Luxembourg Independent Audiovisual Authority and the Luxembourg Agency for Medicines and Health Products. The CNPD is also expected to set up a regulatory sandbox to enable companies and public bodies to test AI systems under the supervision of the authorities.

This framework has not yet been finalised, as the text remains a draft bill. It has also given rise to reservations. In its opinion, Fedil considered that artificial intelligence was ‘not primarily a matter of data protection’. The employers’ organisation feared that the designation of the CNPD and the proliferation of sector-specific regulators would lead to differing interpretations and give the impression of a framework that is not conducive to the establishment of AI companies.

The choice of the two new commissioners partly addresses this challenge: combining legal expertise in data protection with experience in research, innovation and digital technologies. “These appointments come at a pivotal moment for the CNPD,” emphasised the Minister Delegate for Media and Connectivity, Elisabeth Margue. It assigns the authority a dual remit: to protect fundamental rights whilst supporting innovation and competitiveness.

This tension will shape Philippe Ney’s term of office. Having built its profile around the GDPR and high-profile sanctions, the CNPD will need to determine how to regulate artificial intelligence without reducing this new remit to a mere extension of personal data regulation.