A technology company incorporates an AI system into its creative pipeline. The system produces hundreds of original-looking works – software outputs, generated images, marketing copy, financial models – each bearing no human author in the traditional sense. When a competitor copies one of these outputs. The company's legal team faces a question that Luxembourg's intellectual property legislation does not yet answer directly: does the work attract protection. Additionally, if so, who holds it?
AI-generated works occupy a legal grey zone under Luxembourg's current intellectual property regime. Protection under copyright legislation depends on the presence of a human author whose personal creative choices shaped the work. Where AI systems operate autonomously, that condition is absent, and the work may fall outside the scope of protected subject matter entirely. The position is evolving rapidly, driven by EU-level regulation and domestic court practice.
This analysis covers the doctrinal foundations, the gap between statute and current practice, competing interpretations emerging across European courts. Cross-border strategic implications for businesses operating through Luxembourg structures. Additionally, the regulatory outlook under the EU AI Act.
The doctrinal foundations: authorship, originality, and the human-author requirement
Luxembourg's intellectual property legislation follows the civil law tradition. It aligns closely with the broader EU copyright acquis – the body of EU directives that harmonise copyright across member states. Under that body of law, a work qualifies for protection when it reflects the author's own intellectual creation. That phrase carries doctrinal weight: courts across the EU have consistently interpreted it to require a human being who makes free and creative choices during the production process.
The Tribunal d'arrondissement (Luxembourg District Court) applies this standard in copyright disputes at first instance. The Cour de cassation (Luxembourg Supreme Court) provides the authoritative final interpretation. Neither court has yet issued a definitive ruling on AI authorship. However, both operate within a framework shaped by EU harmonisation directives, which means rulings from the Court of Justice of the European Union carry considerable persuasive – and in many cases binding – force.
The human-author requirement has deep roots. It was not designed with AI in mind. It emerged from a tradition that links creative works to personality, moral rights, and individual expression. Under Luxembourg's civil law system, moral rights are inalienable: an author cannot permanently assign the right of attribution or the right of integrity. Applying these concepts to an AI system produces a conceptual impasse. A machine cannot hold moral rights. It cannot be attributed as a legal person. And it cannot assert injury to its reputation.
This creates the first doctrinal gap. Where a human author uses an AI tool as an instrument – selecting inputs, curating outputs, and exercising judgment over the final result – the traditional analysis can still apply. The human's creative choices are present. The work reflects those choices. Protection follows. Where AI operates with substantial autonomy, the analysis breaks down. The human operator may have contributed little more than a prompt. Whether that contribution clears the threshold of personal intellectual creation is an open question.
Practitioners in Luxembourg note that the distinction between "AI-assisted" and "AI-generated" is not merely semantic. It determines the entire legal strategy. A company that documents its creative process carefully. preserving evidence of human editorial decisions at each stage. is in a far stronger position than one that treats AI output as a product requiring no further legal analysis.
Where statute and practice diverge: the gap that costs businesses protection
Luxembourg's copyright legislation does not expressly address AI-generated works. This is not an oversight unique to Luxembourg: the gap exists across virtually every EU member state. The EU harmonisation directives were drafted before large-scale generative AI was commercially viable. They assume a human creative process as the default.
The practical consequence is significant. A business that deploys AI to produce protectable creative assets – source code, literary content, visual outputs, financial analysis reports – may find that those assets receive no copyright protection at all. The work enters the public domain immediately. Any competitor can copy it freely. The investment in the AI system yields no exclusive rights.
This is the lost-opportunity dimension that most businesses fail to identify at the outset. They invest in AI infrastructure, assume their outputs are protected, and discover the gap only when a competitor copies the material. By that point, the evidentiary record of human involvement is incomplete or absent. The litigation position is weak.
There is a partial alternative under Luxembourg's approach to software protection. Software – including AI-generated code, to the extent that human programmers made protectable choices in designing the underlying model architecture – may qualify for protection under the software copyright rules within EU intellectual property legislation. This is a narrower avenue. It protects the structure and expression of the code itself, not outputs generated at runtime.
A second partial alternative is the droit sui generis (database right) under EU database legislation. Where an AI system produces structured data outputs and a business has made substantial investment in obtaining, verifying, or presenting that data, the database right may apply. This right does not require human creativity. It requires investment. The threshold is lower. The protection is also more limited: it prevents extraction of substantial parts of the database, but it does not create the broad exclusive rights that copyright confers.
A third avenue is trade secret protection. AI-generated outputs that are maintained in confidence, have commercial value, and are subject to reasonable protective measures can qualify as trade secrets under EU trade secret legislation. This does not create an exclusive right that can be enforced against innocent third parties. But it provides a remedy against misappropriation – including by employees, contractors, and business partners who obtain access to the outputs.
For businesses using Luxembourg structures. including sociétés de participation financière (SOPARFI, Luxembourg holding companies) and sociétés d'investissement en capital à risque (SICAR. Risk capital investment companies) that hold IP assets. the absence of copyright protection in AI-generated works can affect the tax and regulatory treatment of those assets. Luxembourg's IP box regime requires protectable intellectual property assets as its qualifying subject matter. If the underlying work lacks copyright protection, the IP box benefit may not apply. This is a structuring consideration that many AI-focused groups overlook at the outset.
For a comprehensive overview of the technology licensing and IP structuring options available through Luxembourg vehicles. See our analysis of intellectual property law in Luxembourg. This covers the full range of protectable assets and the conditions for IP box qualification.
To discuss how these structuring considerations apply to your AI assets, contact us at info@ferrazwhitmore.com.
Competing interpretations: how European courts are approaching the question
No uniform European answer has emerged yet. Courts across EU member states are approaching the AI authorship question from different starting points, and the results are inconsistent.
One line of interpretation focuses strictly on process. The court examines the production workflow and asks whether, at any identifiable stage, a human being made a creative choice that is reflected in the final output. This approach tends to favour protection for AI-assisted works and deny it for fully autonomous AI outputs. It is broadly consistent with the human-creativity requirement in EU harmonisation directives.
A second line takes a more functional approach. Some courts have been willing to attribute authorship to the legal entity that operated the AI system. This is closer to the approach taken in a small number of common law jurisdictions. notably the United Kingdom. There. Legislation explicitly addresses computer-generated works and assigns authorship to the person who makes the necessary arrangements for the creation of the work. Luxembourg is a civil law jurisdiction. It does not have an equivalent statutory provision. But the functional argument surfaces in academic commentary and in the positions taken by some industry participants before regulatory bodies.
A third approach treats AI-generated works as a category requiring new legislation rather than judicial adaptation of existing rules. Under this view, existing copyright concepts cannot be stretched to cover the AI scenario without distorting their conceptual foundations. The solution is a purpose-built sui generis right for AI-generated content – similar in structure to the database right but calibrated to the AI context. This view has influenced the European Commission's approach in its consultations on the future of copyright in the digital single market.
Luxembourg courts – particularly the Tribunal d'arrondissement and ultimately the Cour de cassation – will need to choose among these approaches when the first significant AI authorship dispute reaches them. In the interim, practitioners advise clients to structure their AI workflows to maximise the evidence of human involvement at each creative stage. This preserves the option to argue under the first interpretation while avoiding an outcome that depends on legislative reform.
The interaction between copyright doctrine and AI-generated training data adds a further layer. Where an AI model was trained on copyrighted works without authorisation, the model itself may embed infringing material, and its outputs may constitute infringements of the training data. This is a distinct legal question from the authorship issue. It arises under EU copyright legislation's provisions on temporary copies, text and data mining exceptions, and the three-step test for exceptions. The Commission de Surveillance du Secteur Financier (CSSF. Luxembourg's financial sector regulator) has noted the relevance of AI-related IP risks for regulated entities holding AI-generated content as an asset class or deploying AI in financial services operations.
Algorithmic accountability and software liability principles are increasingly relevant here. Where AI-generated outputs cause harm. whether through copyright infringement embedded in training data, through errors in AI-generated financial analysis, or through discriminatory outputs. the question of who bears liability is unresolved in Luxembourg's domestic legislation. The answer depends on a combination of product liability legislation, general tort law under Luxembourg's civil code, and the emerging AI Act obligations that sit at EU level.
The EU AI Act: a new compliance layer over an unresolved IP question
AI Act compliance is now a primary strategic concern for businesses deploying AI systems in Luxembourg and across the EU. The AI Act entered into force in 2024 and applies progressively, with obligations for high-risk AI systems and general-purpose AI models phasing in across 2025 and 2026. Its operative provisions affect the IP question in several indirect but significant ways.
First, the AI Act imposes transparency obligations on providers of general-purpose AI models. This includes disclosure requirements regarding training data and the copyright status of materials used in training. Businesses using third-party AI systems in Luxembourg need to assess whether those systems carry IP risk through their training data – and whether that risk affects the protectability of the AI's outputs.
Second, the AI Act introduces requirements for technical documentation, risk assessment, and human oversight of high-risk AI systems. The human oversight requirement is directly relevant to the copyright analysis. A workflow that satisfies the AI Act's human oversight standard – with a human reviewing, approving, and modifying AI outputs – is also more likely to satisfy the human-creativity threshold for copyright protection. Compliance with AI Act obligations thus serves a dual purpose: it reduces regulatory risk and strengthens the IP position.
Third, the AI Act's provisions on copyright and training data transparency apply to providers placing general-purpose AI models on the EU market. Businesses that develop their own AI models in Luxembourg – including through SOPARFI or SICAR structures holding the model as an IP asset – face obligations around training data documentation and copyright compliance. These obligations interact with Luxembourg's IP box regime: a model that has violated copyright in its training data may face challenges in qualifying as a legitimate IP asset for tax purposes.
Digital services deployed through Luxembourg-based entities are subject to both the AI Act and the Digital Services Act, with the CSSF playing a supervisory role for relevant regulated entities. The overlap between these regulatory instruments and the unresolved IP questions creates a structuring challenge that requires coordinated legal and tax advice. Technology licensing arrangements that appeared straightforward before the AI Act may need to be revisited in light of the new obligations.
Our team's dedicated practice on AI and technology law in Luxembourg advises businesses at the intersection of AI Act compliance, IP structuring, and cross-border technology transactions. For a tailored strategy on AI Act compliance and IP protection in Luxembourg, reach out to info@ferrazwhitmore.com.
Cross-border implications and strategic recommendations for Luxembourg structures
Luxembourg's position as a hub for international holding structures, investment funds, and technology licensing creates specific cross-border dimensions to the AI-IP question. Many businesses that use Luxembourg entities to hold IP assets also operate AI systems in multiple jurisdictions. The legal treatment of AI-generated works varies across those jurisdictions. A work that qualifies for protection in one country may not qualify in another.
For businesses operating between Luxembourg and Portugal – both EU civil law jurisdictions with comparable copyright traditions – the analysis runs broadly in parallel. A comparative perspective is available in our related analysis of AI-generated works and intellectual property in Portugal, which examines how Portuguese courts and legislation approach the same doctrinal questions.
The UK presents a contrasting position. As noted above, UK legislation contains an express provision attributing authorship of computer-generated works to the person who makes the necessary arrangements. Post-Brexit, UK law is no longer constrained by EU harmonisation directives. A Luxembourg-based business that generates AI content for distribution in the UK may obtain UK protection that it cannot obtain under Luxembourg law for the same work. This creates an incentive to route certain activities through UK entities – but the structuring decision requires careful analysis of where the most commercially valuable protection is needed.
The United States takes yet another approach. US copyright authorities have declined to register works produced entirely by AI without human authorship. But courts have been willing to protect works where AI was one tool among several used by a human creator. The US position is closer to the first European interpretive line described above – process-focused, requiring documented human creative involvement.
Strategic recommendations for businesses using Luxembourg structures to hold AI-generated IP assets fall into five categories.
First, document the creative process at every stage. Maintain records of human decisions – prompts selected, outputs reviewed, modifications made, editorial choices applied. This documentation is the primary evidence base for any future copyright claim. It is also relevant to AI Act compliance documentation requirements.
Second, assess the training data for any AI system used to generate commercially valuable outputs. Obtain representations and warranties from AI system providers about copyright clearance in training data. Consider the exposure if training data challenges emerge after the IP asset has been valued and structured into a holding vehicle.
Third, evaluate alternative protection strategies alongside copyright. Trade secret protection, database rights, contractual restrictions in technology licensing arrangements, and technical access controls each provide layers of protection that do not depend on copyright subsisting in the AI output itself.
Fourth, review the interaction between AI-generated asset characterisation and Luxembourg's IP box regime. The IP box requires qualifying intellectual property assets as defined in the relevant tax legislation. If the underlying work lacks copyright protection, the IP box benefit is unavailable. This should be assessed before the asset is transferred into a SOPARFI or similar vehicle.
Fifth, build AI Act compliance into the operational design of AI systems from the outset. The human oversight structures required by the AI Act should be designed to serve both regulatory and IP purposes simultaneously. Retrofitting compliance onto an existing workflow is significantly more expensive than building it in at the design stage.
Outlook: what to monitor and where the law is heading
The regulatory and judicial trajectory points toward greater clarity on AI-generated works, but full resolution is unlikely before the end of this decade. The following developments merit close attention.
The European Commission's ongoing review of copyright legislation in the context of AI is expected to produce a legislative proposal addressing AI-generated content directly. Any such proposal would supersede the current gap in EU harmonisation directives and provide a statutory basis for – or against – protection of AI-generated works. The outcome remains uncertain, but the Commission's consultations suggest a preference for a targeted sui generis right rather than an extension of copyright to AI.
The Court of Justice of the European Union will inevitably receive preliminary references on the human-creativity requirement as applied to AI-generated works. When those rulings emerge, they will be binding on Luxembourg courts. The Tribunal d'arrondissement and the Cour de cassation will be required to apply the CJEU's interpretation in domestic proceedings. Businesses should monitor CJEU referrals from any EU member state that touch on the authorship question.
The AI Act's transparency obligations on training data will produce a more complete picture of the copyright exposure embedded in commercial AI systems. As that disclosure landscape develops, some AI-generated content may be retroactively recharacterised as infringing, with consequences for IP asset valuations and tax structures built on those assets.
Luxembourg's domestic courts are likely to face their first significant AI authorship dispute within the next few years. Given the volume of IP-holding structures in Luxembourg and the increasing deployment of AI in financial services, investment management. Additionally. Digital services. all supervised by the CSSF. the domestic case law will develop relatively quickly once the first case is filed.
For businesses that act now. documenting workflows, assessing trade secret and database right alternatives, reviewing IP box qualification, and integrating AI Act compliance into their operational design. the period of legal uncertainty represents an opportunity. Those who wait for legislative clarity before addressing their AI-IP position risk discovering the gap only when protection is needed and the evidentiary record is incomplete.
Self-assessment checklist for Luxembourg AI-IP strategy
The following checklist helps businesses determine whether their current AI-IP position requires immediate attention.
- Have you documented human creative decisions at each stage of your AI content production workflow?
- Have you assessed whether your AI system's training data is copyright-clear, and obtained contractual protections from the system provider?
- Have you identified which of your AI-generated outputs are commercially most valuable and verified whether they qualify for any form of intellectual property protection under Luxembourg law?
- Have you reviewed whether AI-generated assets held in Luxembourg structures meet the qualifying conditions for the IP box regime?
- Have you mapped your AI systems against the AI Act's risk classification and identified the applicable compliance obligations, including human oversight requirements?
If any of these questions cannot be answered with confidence, a structured legal review is warranted before the gap produces a material loss of protection or a compliance failure.
Frequently asked questions
Q: Can an AI system be named as an author of a work under Luxembourg intellectual property law?
A: No. Under Luxembourg's intellectual property legislation – shaped by EU harmonisation directives – authorship requires a human being whose personal creative choices are reflected in the work. An AI system cannot hold legal personality, cannot hold moral rights, and cannot be attributed as an author. Where a human exercises genuine creative judgment in directing or curating AI output, that human may qualify as author. Where the AI operates autonomously, the work may receive no copyright protection at all.
Q: How long does it take to structure a Luxembourg IP holding arrangement that accounts for AI-generated assets, and what does it cost?
A: Establishing a SOPARFI or similar Luxembourg holding vehicle for IP assets typically takes between four and eight weeks from the point of instruction to operational readiness. Depending on the complexity of the structure and the number of assets being transferred. Legal and notarial costs vary with the transaction's scope. The more time-consuming element is often the prior IP audit: assessing which assets qualify for copyright or alternative protection, reviewing training data exposure, and confirming IP box eligibility. That audit should precede any structuring work. Engaging a lawyer in Luxembourg with experience in both IP and tax structuring at the outset avoids costly redesign at a later stage.
Q: Does the EU AI Act resolve the question of who owns AI-generated outputs?
A: No. The AI Act is a regulatory instrument, not a copyright law. It does not assign ownership of AI-generated works. It imposes obligations on AI system providers and deployers relating to transparency, risk management, human oversight, and training data disclosure. These obligations create conditions that are indirectly relevant to the copyright analysis – particularly the human oversight requirements – but they do not create a new intellectual property right in AI-generated outputs. The ownership question remains governed by intellectual property legislation, which has not yet been amended to address AI authorship at EU level.
About Ferraz & Whitmore
Ferraz & Whitmore is an international law firm based in Lisbon, advising business clients across 46 jurisdictions. Our practice combines Portuguese civil law expertise with English common law tradition to deliver integrated legal solutions at the intersection of AI regulation, intellectual property, and cross-border technology structuring. In Luxembourg, we advise on AI Act compliance, IP box qualification for AI-generated assets, technology licensing arrangements, and the structuring of SOPARFI and SICAR vehicles that hold intellectual property. Our attorneys have advised on digital services, algorithmic accountability, and software liability matters across both civil law and common law systems. As an international law firm serving clients in Luxembourg, we bring together regulatory, IP, and tax perspectives to address the full picture – not just one dimension of the problem. The firm's IP and technology practice covers all major European jurisdictions, supported by a network of local counsel and active participation in cross-border practice groups focused on AI and emerging technology. To discuss how AI-generated IP strategy and AI Act compliance apply to your Luxembourg structure, contact us at info@ferrazwhitmore.com.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.