Luxembourg employer obligations by headcount: what changes at 15, 50 and 150 staff

Your headcount decides your compliance load

A Luxembourg company with eight employees has a short list of employer duties: a written contract, payroll, social security registration, an occupational health service, a designated safety worker and working-time records. Every employer has those from the first hire. What changes as the company grows is the layer of collective rules on top: elected staff representatives, a whistleblowing channel, consultation, and eventually co-decision on how the business is run.

Luxembourg sets these rules by thresholds. At 15 employees the company must hold staff delegation elections. At 50 it must run an internal whistleblowing channel. At 150 the delegation can block decisions on monitoring, internal rules and evaluation criteria, and every dismissal is preceded by an interview. At 1,000, a public limited company gives a third of its board seats to employee representatives.

The thresholds apply when the headcount is reached, not at the next year-end. This note focuses on the 50-plus stage and complements our note on Luxembourg employment contracts and dismissal, which covers the individual contract.

Thresholds from 15 to 1,000 employees

The thresholds do not all count employees in the same way. The staff delegation threshold uses the average over the 12 months before the month in which the election notice is posted. Part-time employees working 16 hours a week or more count as one; those below count pro rata. Fixed-term staff count in proportion to their presence; apprentices are excluded.

The whistleblowing law speaks of entities with 50 or more workers and gives no averaging rule. The safe reading is to count heads on payroll and to have the channel working before the 50th person starts. When a number sits close to a line, plan for the higher bracket.

Law and practice: Labour Code, Articles L.411-1 to L.411-3 (scope and headcount for the staff delegation), L.412-1 (number of delegates), L.562-3 (disability quota, per ADEM); Law of 16 May 2023 on whistleblower protection; Directive (EU) 2023/970 on pay transparency, Article 9; Omnibus I directive amending the CSRD, published 26 February 2026.

The staff delegation: elections, size, time and protection

Elections. Social elections take place nationally every five years. The last round was held on 12 March 2024, so the next falls in 2029, on a date set by regulation. The employer runs the procedure, with fixed deadlines and forms on guichet.lu. A company that reaches 15 employees between two rounds must organise its own election, and that delegation sits until the next national round. If no candidate stands, the employer keeps the minutes.

Size. The number of effective delegates, each with a substitute, follows the headcount used for the election.

Time. Delegates have a paid credit of hours. Below 150 employees, the total is 40 hours a week per 500 employees represented, so a company with 50 staff gives its delegation about four hours a week in total. From 150 to 249 the base is 40 hours per 250 employees, double the rate. From 250 employees one delegate is released full-time, two from 501, three from 1,001. The delegation meets at least six times a year, three of them with management.

Equality and safety. At its first meeting the delegation designates an equality delegate, who watches equal treatment between women and men, and a health and safety delegate, who works with the employer's designated worker and the Labour Inspectorate (ITM). These are not separate thresholds: they come with every delegation.

Information and consultation. Below 150 employees, the employer informs and consults the delegation on the business's development, working conditions, training, monitoring and decisions that may affect jobs. The delegation can refer complaints to the ITM.

Protection. Delegates cannot be dismissed during their mandate; a dismissal is void. For serious misconduct, the employer suspends the delegate and asks the labour court to end the contract. Candidates and former delegates are protected for a limited time. The sibling note on contracts and dismissal sets out the procedure.

Law and practice: Labour Code, Articles L.412-1 (delegates), L.414-1 and following (powers, equality and health and safety delegates), L.415-5 (credit hours and released delegates), L.415-6 (meetings), L.415-10 and L.415-11 (protection); guichet.lu on social elections; date of the 2024 elections as published.

The internal whistleblowing channel

The Law of 16 May 2023 transposed the EU Whistleblowing Directive (2019/1937). It requires every private-sector entity with 50 or more workers to establish an internal reporting channel. Entities with 250 or more workers had to comply from the law's entry into force in May 2023; those with 50 to 249 workers had until 17 December 2023. Below 50, a channel is voluntary, except for entities that must have one under sector rules, such as those supervised by the CSSF or the CAA and those subject to anti-money laundering law, whatever their size.

Luxembourg went further than the directive: a report may concern any breach of national or EU law. Employees, former staff, applicants, trainees, contractors, shareholders and managers are protected.

What the channel needs. A way to report in writing or orally, an impartial designated person or team (in-house or an external provider), confidentiality protected by access controls, and clear information on internal and external routes. Companies with 50 to 249 workers may share resources, for example within a group, but each stays responsible.

1. Day 0: report receivedLog it in a restricted register. Do not try to identify an anonymous reporter.
2. Within 7 days: acknowledgementConfirm receipt to the reporter, unless that would expose the person or the reporter asked not to be contacted.
3. InvestigationThe designated person assesses admissibility, gathers facts and proposes measures. People named in the report keep the right to be heard.
4. Within 3 months: feedbackTell the reporter what has been done or is planned, and why, within three months of the acknowledgement. Close the file and keep records only as long as necessary.

External channels. The reporter may go straight to a competent authority. The law lists more than 20, including the CSSF, the CAA, the CNPD, the ITM, the ILR, the direct tax administration (ACD), the VAT and registration authority (AED) and the Competition Authority. The Office des signalements, within the Ministry of Justice, assists whistleblowers and directs reports to the right authority.

Retaliation and fines. Dismissal, demotion, a refused promotion or any other retaliation against a protected reporter is void, and the burden of proof is reversed: the employer must show the measure had nothing to do with the report. Retaliation and abusive proceedings are punished with criminal fines of EUR 1,250 to 25,000. Failing to set up a channel, obstructing a report, breaching confidentiality or refusing to remedy a breach exposes the entity to administrative fines of EUR 1,500 to 250,000, with the maximum doubled for a repeat offence within five years. A knowingly false report is punished with imprisonment of eight days to three months and a fine of EUR 1,500 to 50,000.

Law and practice: Law of 16 May 2023 transposing Directive (EU) 2019/1937, in particular Article 18 (competent authorities) and the provisions on internal channels, protection and sanctions; Ministry of Justice, whistleblower pages; FEDIL guide to the law.

Co-decision, pay reporting and board seats

Luxembourg abolished the joint works council (comité mixte) in its 2015 reform, effective from the 2019 elections, and moved its powers to the staff delegation in companies with at least 150 employees. The delegation's office is enlarged and the delegation gains three kinds of rights.

• Co-decision. Introducing or changing internal rules, technical systems that monitor behaviour or performance, health and safety measures, general criteria for hiring, promotion, transfer and dismissal, criteria for evaluating staff, training plans, telework and the right to disconnect regime all need the delegation's agreement. Without it, the matter goes to mediation and conciliation; the employer cannot simply go ahead.
• Information. The employer reports monthly on the progress of the business, and consults in advance on investments, mergers, transfers and other economic decisions that affect employment.
• Dismissal procedure. Every dismissal with notice or for serious misconduct is preceded by a preliminary interview, with fixed deadlines.
• Credit hours. The credit doubles: 40 hours a week per 250 employees. From 250, one delegate is released full-time.

Pay transparency. Directive (EU) 2023/970 had to be transposed by 7 June 2026. Luxembourg missed the date: in June 2026 the Labour Minister said a draft was still being discussed with other ministries before going to the social partners, and no bill had been tabled. The directive still frames what is coming. Pay ranges in job advertisements and a ban on asking candidates for their salary history apply to all employers. Gender pay gap reports are due by 7 June 2027 for employers with 250 or more workers, then every year; by 7 June 2027 for 150 to 249 workers, then every three years; and by 7 June 2031 for 100 to 149. A gap of 5% or more in a category that the employer cannot justify and does not correct within six months leads to a joint pay assessment with the workers' representatives.

Board seats. A public limited company (SA) that has employed at least 1,000 people in Luxembourg on average over the last three years must reserve one third of its board seats for employee representatives, elected by the staff delegation. An SARL has no such rule.

Sustainability reporting. After the Omnibus I directive, in force since 18 March 2026, the CSRD applies to EU groups with more than 1,000 employees and net turnover above EUR 450 million. Headcount alone no longer brings a mid-sized company into scope.

Law and practice: Labour Code, Articles L.414-4 to L.414-13 (powers at 150 and over, co-decision under L.414-9), L.124-2 (preliminary interview), L.312-9 (right to disconnect); Law of 10 August 1915 on commercial companies, provisions on employee representation on the board of an SA; Directive (EU) 2023/970, Articles 5, 9 and 10; Labour Minister's answer to parliamentary question 4012 of 16 June 2026; Omnibus I directive, published 26 February 2026.

Monitoring, data, working time, harassment and AI

Monitoring and data protection. Under Article L.261-1 of the Labour Code, as amended by the Law of 1 August 2018, an employer may monitor staff only for a legitimate purpose: security and health, protecting the company's assets, controlling production or performance where that is the only way to set exact pay, or organising flexible working hours. Before the system goes live, the employer informs each employee individually and the staff delegation, or the ITM where there is none. Within 15 days the delegation, or the employees, can ask the CNPD for a prior opinion; the request suspends the project, and the CNPD has one month to answer. From 150 employees, monitoring is a co-decision matter.

The GDPR applies on top. Monitoring must be necessary and proportionate, and systematic monitoring usually calls for a data protection impact assessment. The CNPD can impose fines of up to EUR 20 million or 4% of worldwide turnover. A data protection officer is not triggered by headcount: under Article 37 GDPR a private company needs one only if its core activities involve large-scale regular and systematic monitoring or large-scale processing of sensitive data. Non-EU groups with no EU establishment also need an EU representative under the GDPR.

Right to disconnect. Since 4 July 2023, Article L.312-9 requires every employer whose staff use digital tools for work to set up a regime for disconnection outside working hours, by collective agreement or, failing that, at company level. Below 150 employees the delegation is informed and consulted; from 150 it must agree. The ITM can fine an employer that has no regime between EUR 251 and 25,000.

Working time and harassment. Every employer keeps a record of hours worked, overtime included. The Law of 29 March 2023 added moral harassment to the Labour Code: the employer must stop harassment as soon as it learns of it, define protective measures after consulting the delegation, investigate promptly and train staff. Failure is punished by a fine of EUR 251 to 2,500, doubled for repeat offences, and retaliation against victims or witnesses is void.

AI. Since 2 February 2025 the AI Act requires deployers to support AI literacy among staff who use AI, softened by the AI Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) from a duty to ensure it. AI for recruitment, promotion, termination, task allocation or monitoring of workers is high-risk under Annex III. The Omnibus moved those obligations from August 2026 to 2 December 2027. Employers will then need human oversight, logs and prior information to workers' representatives. AI that monitors performance is also L.261-1 monitoring.

Cybersecurity. The Luxembourg NIS2 law has applied since 10 May 2026. It covers medium and large entities, broadly from 50 employees or EUR 10 million turnover, in 18 listed sectors, including managed IT services. In-scope entities had to register with the ILR, or the CSSF for financial infrastructure, by 10 July 2026.

Law and practice: Labour Code, Articles L.261-1 (monitoring), L.211-29 (working-time records), L.246-1 and following (moral harassment, Law of 29 March 2023), L.312-3 (designated workers), L.312-9 (right to disconnect, in force 4 July 2023), L.326-1 (medical examination at hiring); Law of 1 August 2018 on the CNPD; GDPR, Articles 35, 37 and 83; Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744; Luxembourg law transposing Directive (EU) 2022/2555, published 6 May 2026.

Growing past 50, a report, and cameras

Law and practice: Figures and dates are assumptions for illustration. Check weekends and public holidays for each deadline; the three-month feedback period runs from the acknowledgement.

Check what your headcount triggers

Simplified: Labour Code and EU rules as of October 2026, Luxembourg staff only, no collective agreement. Sector rules can bring a duty forward.

Luxembourg employer duties by headcount: frequent questions