In short gdpr compliant means you can configure it but it must not be compliant by default and also there is no guarantee.

They are constantly changing their software and settings. More than once they believed that something is legal but can be risky for the atlassian customer.

For example training AI on metadata which they believe are anonymized but are maybe not enough changed.

Training data or metadata permisson can not be configured on all subscriptions. But as a data processor they must follow the contract otherwise they become data controller.

Also there are risks associated with privacy data framework, cloud act etc. to be non compliant just by data transfers to other countries.