Gianclaudio Malgieri is Associate Professor of Law and Technology at Leiden University, the Netherlands.Gloria González Fuster is Research Professor at Vrije Universiteit Brussel, Belgium.Alessandro Mantelero is Associate Professor of Law, Polytechnic University Tourin, Italy.Gabriela Zanfir-Fortuna is Vice President for Global Privacy, Future of Privacy Forum, USA.

• Introduction to the Commentary, Gianclaudio Malgieri (Leiden University, the Netherlands), Gloria González Fuster (Vrije Universiteit Brussel, Belgium), Alessandro Mantelero (Polytechnic University Tourin, Italy) and Gabriela Zanfir-Fortuna (Future of Privacy Forum, USA)Part I: Key Issues1. The EU AI Act: The Objectives of the Law (Article 1), Gianclaudio Malgieri (Leiden University, the Netherlands)2. The Scope of the AI Act in Light of the EU's Digital Strategy (Article 2), Alessandro Mantelero (Politecnico di Torino, Italy)3. Definitions in the AI Act - Main Actors and Key Concepts (Article 3), Gabriela Zanfir-Fortuna (Future of Privacy Forum, USA)4. The Risk Framework in the AI Act and the Role of the European Commission, Laura Caroli (Center for Strategic and International Studies, USA)5. The Mixed Nature of the AI Act: Product Safety and Fundamental Rights Regulation, Giovanni De Gregorio (Católica Global School of Law, Portugal) and Marco Almada (University of Luxembourg)Part II: Prohibited Practices 6. The Prohibitions Related to Human Vulnerabilities and Manipulation (Articles 5(1)(a) and 5(1)(b)), Maria-Lucia Rebrean (Leiden University, the Netherlands) and Silvia De Conca (Vrije Universiteit Amsterdam, the Netherlands)7. Social Scoring (Article 5(1)(c)), Nathan Genicot (Vrije Universiteit Brussel, Belgium)8. Predictive Policing and Facial Recognition (Article 5(1)(d) and 5(1)(e)), Bart Custers (Leiden University, the Netherlands)9. The Prohibition of Emotion Recognition Systems in Education and the Workplace (Article 5(1)(f)), Andreas Häuselmann (Open Universiteit, the Netherlands)10. The Prohibitions Related to Biometric Surveillance and their Exceptions (Articles 5(1)(g), 5(1)(h) and 5(2) to 5(8)), Gavin Robinson (Leiden University, the Netherlands)Part III: High-Risk AI Systems 11. Classification of High-Risk AI Systems and Its Update (Articles 6, 7, 50, 71, Annex I and Annex III), Giorgio Resta (Rome Tre University, Italy) and Cristina Frattone (Roma Tre University, Italy)12. Obligations of Providers of High-Risk AI Systems (Articles 8, 9, 16, 20, 21, 22), Phil Lee (Digiphile, UK)13. Deployers - Key Obligations (Article 26), Phil Lee (Digiphile, UK)14. Conformity Assessment, Quality and Risk Management Systems (Articles 8, 9, 17, 42, 43, 46), Alessandro Mantelero (Politecnico di Torino, Italy)15. The Fundamental Rights Impact Assessment (Article 27), Alessandro Mantelero (Politecnico di Torino, Italy)16. Data and Data Governance (Article 10), Margo Bernelin (Centre National de la Recherche Scientifique, France) and Michaël Van den Poel (Eubelius, Beligum)17. Accountability and Transparency in the EU AI Act: The Procedural Foundations of the Risk-Based Model (Articles 11-13, 18-19, and 50), Anda Bologa (Center for European Policy Analysis, USA)18. Human Oversight (Article 14), Melanie Fink (Leiden University, the Netherlands)19. Accuracy, Robustness, and Cybersecurity (Article 15), Giuseppe Vaciago (42Law Firm, Austria; Politecnico di Torino, Italy)20. Identification and Obligations of Importers, Distributors, and Responsibilities Along the AI Value Chain (Articles 23, 24, 25), Bart Schermer (Leiden University, the Netherlands)21. Standards, Certificates, Registration (Articles 40, 41, 44-49), Irene Kamara (Tilburg University, the Netherlands)Part IV: GPAI and General-Purpose AI Models22. The Obligations of Providers of General-Purpose AI Models (Articles 53, 54 and 56), Michael Veale (University College London, UK) and Joao Quintais (University of Amsterdam, the Netherlands)23. General Purpose AI Models with Systemic Risks - Classification and Specific Obligations (Articles 51, 52, 55), Connor Dunlop (Lucid Computing, USA)Part V: Measures in Support of Innovation24. AI Regulatory Sandboxes and Testing in Real-World Conditions (Articles 57-61), Thiago Guimaraes Moraes (Brazilian Data Protection Authority, Brazil)25. SMEs and Derogation (Articles 62 and 63), Vincenzo Tiani (Future of Privacy Forum, USA)Part VI : Governance26. EU-Level Governance (AI Office, AI Board, Advisory Forum, Scientific Panel) (Articles 64 to 69), Claudio Novelli (Yale University, USA)27. National Level Governance (National Competent Authorities) and Notification Procedures, Joanna Mazur (University of Warsaw, Poland)Part VII: Monitoring and Enforcement28. Implementing Articles 72 and 73 of the EU AI Act: Practical Insights and Recommendations for Post Market Monitoring and Reporting Serious Incidents, Brenda Leong (Luminos.law, USA)29. Enforcement (Articles 74-84 and 88-94), Luca Tosoni (Schjødt, formerly Norwegian Data Protection Agency, Norway)30. The Right to Explanation in the AI Act (Article 86), Margot E Kaminski (University of Colorado Law School, USA) and Gianclaudio Malgieri (Leiden University, the Netherlands)31. Remedies and Penalties (Articles 85, 87, 99-101), Maria Magierska (Maastricht University, the Netherlands)Part VIII: Codes of Conducts, Guidelines and AI Literacy32. Codes of Conduct and EC Guidelines (Articles 56, 95-98), Denise Amram (Scuola Superiore Sant’Anna, Italy) and Roberta Romano (Scuola Superiore Sant’Anna, Italy)33. AI Literacy (Article 4), Tommaso Fia (University of Tübingen, Germany)Part IX : The AI Act Interactions with the Digital Rulebook34. The AI Act and the GDPR, Gloria González Fuster (Vrije Universiteit Brussel, Belgium)35. The AI Act and the Digital Services Act: Legal Consistency and Normative Tensions, Gianclaudio Malgieri (Leiden University, the Netherlands)36. The AI Act and the Product Liability Directive, Gianmarco Gori (Vrije Universiteit Brussel, Belgium)37. Divergent Paths, Subtle Crossroads: Disentangling the DMA and the DA from the AI Act, Muhammed Demircan (DLA Piper, USA), Osman Gazi Gucluturk (Galatasaray University, Turkey), and Heidi Waem (DLA Piper, USA)

Gianclaudio Malgieri is Associate Professor of Law and Technology at Leiden University, the Netherlands.Gloria González Fuster is Research Professor at Vrije Universiteit Brussel, Belgium.Alessandro Mantelero is Associate Professor of Law, Polytechnic University Tourin, Italy.Gabriela Zanfir-Fortuna is Vice President for Global Privacy, Future of Privacy Forum, USA.

• Introduction to the Commentary, Gianclaudio Malgieri (Leiden University, the Netherlands), Gloria González Fuster (Vrije Universiteit Brussel, Belgium), Alessandro Mantelero (Polytechnic University Tourin, Italy) and Gabriela Zanfir-Fortuna (Future of Privacy Forum, USA)Part I: Key Issues1. The EU AI Act: The Objectives of the Law (Article 1), Gianclaudio Malgieri (Leiden University, the Netherlands)2. The Scope of the AI Act in Light of the EU's Digital Strategy (Article 2), Alessandro Mantelero (Politecnico di Torino, Italy)3. Definitions in the AI Act - Main Actors and Key Concepts (Article 3), Gabriela Zanfir-Fortuna (Future of Privacy Forum, USA)4. The Risk Framework in the AI Act and the Role of the European Commission, Laura Caroli (Center for Strategic and International Studies, USA)5. The Mixed Nature of the AI Act: Product Safety and Fundamental Rights Regulation, Giovanni De Gregorio (Católica Global School of Law, Portugal) and Marco Almada (University of Luxembourg)Part II: Prohibited Practices 6. The Prohibitions Related to Human Vulnerabilities and Manipulation (Articles 5(1)(a) and 5(1)(b)), Maria-Lucia Rebrean (Leiden University, the Netherlands) and Silvia De Conca (Vrije Universiteit Amsterdam, the Netherlands)7. Social Scoring (Article 5(1)(c)), Nathan Genicot (Vrije Universiteit Brussel, Belgium)8. Predictive Policing and Facial Recognition (Article 5(1)(d) and 5(1)(e)), Bart Custers (Leiden University, the Netherlands)9. The Prohibition of Emotion Recognition Systems in Education and the Workplace (Article 5(1)(f)), Andreas Häuselmann (Open Universiteit, the Netherlands)10. The Prohibitions Related to Biometric Surveillance and their Exceptions (Articles 5(1)(g), 5(1)(h) and 5(2) to 5(8)), Gavin Robinson (Leiden University, the Netherlands)Part III: High-Risk AI Systems 11. Classification of High-Risk AI Systems and Its Update (Articles 6, 7, 50, 71, Annex I and Annex III), Giorgio Resta (Rome Tre University, Italy) and Cristina Frattone (Roma Tre University, Italy)12. Obligations of Providers of High-Risk AI Systems (Articles 8, 9, 16, 20, 21, 22), Phil Lee (Digiphile, UK)13. Deployers - Key Obligations (Article 26), Phil Lee (Digiphile, UK)14. Conformity Assessment, Quality and Risk Management Systems (Articles 8, 9, 17, 42, 43, 46), Alessandro Mantelero (Politecnico di Torino, Italy)15. The Fundamental Rights Impact Assessment (Article 27), Alessandro Mantelero (Politecnico di Torino, Italy)16. Data and Data Governance (Article 10), Margo Bernelin (Centre National de la Recherche Scientifique, France) and Michaël Van den Poel (Eubelius, Beligum)17. Accountability and Transparency in the EU AI Act: The Procedural Foundations of the Risk-Based Model (Articles 11-13, 18-19, and 50), Anda Bologa (Center for European Policy Analysis, USA)18. Human Oversight (Article 14), Melanie Fink (Leiden University, the Netherlands)19. Accuracy, Robustness, and Cybersecurity (Article 15), Giuseppe Vaciago (42Law Firm, Austria; Politecnico di Torino, Italy)20. Identification and Obligations of Importers, Distributors, and Responsibilities Along the AI Value Chain (Articles 23, 24, 25), Bart Schermer (Leiden University, the Netherlands)21. Standards, Certificates, Registration (Articles 40, 41, 44-49), Irene Kamara (Tilburg University, the Netherlands)Part IV: GPAI and General-Purpose AI Models22. The Obligations of Providers of General-Purpose AI Models (Articles 53, 54 and 56), Michael Veale (University College London, UK) and Joao Quintais (University of Amsterdam, the Netherlands)23. General Purpose AI Models with Systemic Risks - Classification and Specific Obligations (Articles 51, 52, 55), Connor Dunlop (Lucid Computing, USA)Part V: Measures in Support of Innovation24. AI Regulatory Sandboxes and Testing in Real-World Conditions (Articles 57-61), Thiago Guimaraes Moraes (Brazilian Data Protection Authority, Brazil)25. SMEs and Derogation (Articles 62 and 63), Vincenzo Tiani (Future of Privacy Forum, USA)Part VI : Governance26. EU-Level Governance (AI Office, AI Board, Advisory Forum, Scientific Panel) (Articles 64 to 69), Claudio Novelli (Yale University, USA)27. National Level Governance (National Competent Authorities) and Notification Procedures, Joanna Mazur (University of Warsaw, Poland)Part VII: Monitoring and Enforcement28. Implementing Articles 72 and 73 of the EU AI Act: Practical Insights and Recommendations for Post Market Monitoring and Reporting Serious Incidents, Brenda Leong (Luminos.law, USA)29. Enforcement (Articles 74-84 and 88-94), Luca Tosoni (Schjødt, formerly Norwegian Data Protection Agency, Norway)30. The Right to Explanation in the AI Act (Article 86), Margot E Kaminski (University of Colorado Law School, USA) and Gianclaudio Malgieri (Leiden University, the Netherlands)31. Remedies and Penalties (Articles 85, 87, 99-101), Maria Magierska (Maastricht University, the Netherlands)Part VIII: Codes of Conducts, Guidelines and AI Literacy32. Codes of Conduct and EC Guidelines (Articles 56, 95-98), Denise Amram (Scuola Superiore Sant’Anna, Italy) and Roberta Romano (Scuola Superiore Sant’Anna, Italy)33. AI Literacy (Article 4), Tommaso Fia (University of Tübingen, Germany)Part IX : The AI Act Interactions with the Digital Rulebook34. The AI Act and the GDPR, Gloria González Fuster (Vrije Universiteit Brussel, Belgium)35. The AI Act and the Digital Services Act: Legal Consistency and Normative Tensions, Gianclaudio Malgieri (Leiden University, the Netherlands)36. The AI Act and the Product Liability Directive, Gianmarco Gori (Vrije Universiteit Brussel, Belgium)37. Divergent Paths, Subtle Crossroads: Disentangling the DMA and the DA from the AI Act, Muhammed Demircan (DLA Piper, USA), Osman Gazi Gucluturk (Galatasaray University, Turkey), and Heidi Waem (DLA Piper, USA)