Privacy shield is an ALTERNATIVE method of to GDPR compliance for legal controls (other alternatives are SCCs/BCRs etc). US companies can either do Privacy Shield or implement GDPR themselves.

You are correct on their lack of an Art 27 Rep however.