With the increasing integration of artificial intelligence (AI) tools into daily life, the implications for exercising data subject rights under the General Data Protection Regulation (GDPR) have become more pronounced. AI systems such as ChatGPT, Copilot, and Google Gemini are now widely used across various industries, raising significant concerns about the processing of personal data. However, the enforcement of data subject rights in relation to such models has encountered challenges that have not yet been addressed by European Union (EU) legislation. This article examines the challenges of exercising data subject rights within the context of AI models, as highlighted by the European Data Protection Board (EDPB) in its Opinion 28/2024, which addresses data protection aspects related to AI models. The author analyzes how the EDPB suggests strengthening data subject rights in AI models. This includes examining the criteria for considering AI models anonymous, the use of legitimate interest as a legal basis for data processing, suggestions on how to ensure data subject rights to information, erasure, and the right to object to data processing in AI models, and how the EDPB’s suggestions extend beyond current GDPR requirements.