Our legal team just asked me whether our AI tool usage is GDPR compliant and I had no idea what to tell them

I work in marketing operations for a European company. We use a handful of AI tools for content generation and customer data analysis. Last week our legal team sent a questionnaire asking which AI tools we use, what data we input into them, where that data is processed, and whether we have data processing agreements in place with the vendors.

I could answer the first question. I could not confidently answer any of the others.

I had not thought about the fact that when we paste customer information into an AI tool to generate personalised content, that data is leaving our systems and going somewhere. I do not know where it is processed, whether it is stored, whether it crosses jurisdictions, or what the vendor's data retention policies actually are.

Has anyone actually done a proper GDPR audit of their AI tool stack? What did that process look like and what did you find?