The European Data Protection Board opinion 28/2024 (Opinion), on the processing of personal data in the context of artificial intelligence (AI) models, conveys a clear message that entities developing and deploying these models need to take a proactive, risk-based approach to data protection. Companies subject to the E.U. General Data Protection Regulation (GDPR), as well as emerging regulations in various U.S. jurisdictions, face challenges in complying with ever complex layers of legal requirements. This second article in a two-part series covering the Opinion offers best practices for controllers when processing personal data in the context of AI development and deployment, suggests strategies for navigating the regulatory landscape, and examines the Opinion’s impact in the broader AI and privacy legal arena. It includes practical insights from A&O Shearman, Bird & Bird, McDermott Will & Emery, Morrison Foerster and Steptoe. Part one discussed significant elements of the Opinion and its implications for entities subject to the GDPR. See “CJEU Decision Adds Antitrust Regulators as New GDPR Concern for Companies” (Aug. 16, 2023).