Europe’s privacy watchdogs tell AI companies what they must do to avoid big GDPR fines