Yes there’s lots of ambiguity and the details will be hammered out over the coming years. You will be subject to audit and noncompliances will be notified. Only the most egregious “bad faith” violators will suffer fines in the near term. I fully expect a couple of high profile cases will be made to get the ball rolling.
The GDPR is rather ambiguous about use cases like this. That's part of the problem. Different national regulators are going to have to decide what they consider reasonable and how much they want to enforce. Unless and until they issue authoritative guidance, everyone is basically in the dark on what this really means, and the penalties for misjudgement could be severe if the regulator strongly disagreed with your interpretation.
As for sharing data between organisations, one of the more unwise (IMHO) aspects of the GDPR is that when it comes to the right to erasure, the obligations to notify other parties to which the data has been supplied have guard conditions about reasonable efforts, but there are no such conditions at all on the immediate obligations to delete the data. If you're not covered by one of the acceptable cases (where the scope is, as noted above, not entirely clear yet) then you must be able to delete the data on demand, regardless of the practicality or cost of doing so.