The Artificial Intelligence Regulation (EU Reg. 2024/1689) is widely regarded as the European Union’s primary tool for regulating the market for AI systems. This paper, however, explores how the General Data Protection Regulation (EU Reg. 2016/679) takes precedence and remains a crucial legislation in determining how AI systems are produced and deployed in the EU. This research analyses how the GDPR’s prevalence and application, however, is steered by interpretations put forward by different actors, with particular attention to Data Protection Authorities. In this context, I analyse how AI workers and (working) data subjects are essential stakeholders for the production of AI systems. I explore how their involvement in this regulatory standard could enhance the protection of their own interests and rights. More specifically, I focus on how consumer rights organizations and trade union cooperation could cooperate to challenge current predatory practices by the AI industry through the collective use of data protection rights.