With the majority of obligations for general-purpose AI (GPAI) models set to take effect on 2 August 2025 (AI Act, Chapter V, Art. 53), the European Commission has published the long-awaited GPAI Code of Practice on 10 July 2025. The document—developed by independent experts—serves as voluntary guidance to help GPAI providers prepare for compliance under the EU AI Act. It focuses on three key areas: Copyright, Transparency, and Safety & Security.

Exploring AI hallucinations through the lens of GDPR, this article focuses on the regulatory challenges, key DPA perspectives, and industry measures to balance innovation and data protection.