The use of AI requires organizations that act as controllers under the GDPR to determine the purposes and means of processing personal data.