How do you use AI for email personalisation without it feeling creepy or hitting compliance issues?

We want to use AI to personalise email campaigns at scale — content, send time, product recommendations. Our email list is 1.2M and we send to about 600k active subscribers weekly. I've seen the lift numbers from personalisation and I want them. But I have two concerns: first, that it crosses a line from helpful to intrusive for our customers; second, that our data team isn't sure what we're actually allowed to do with our customer data under GDPR. Where's the line and how do other marketing leaders navigate it?