GDPR Art. 22 automated decision-making: documenting human-in-the-loop for ML scoring
We're deploying an ML model that scores customer support tickets for priority routing. The output influences queue position but a human agent always reviews before any action is taken. Under GDPR Art. 22, the question is whether this qualifies as a 'decision based solely on automated processing' or falls under the human-in-the-loop exception. Our current documentation records: (1) the model's score range and factors, (2) the human review step with override authority, (3) audit logs of all overrides. Jurisdiction: EU/DE. Has anyone gone through a DPA review or audit for a similar setup? What additional documentation did the auditor request beyond the standard DPIA? This is peer experience exchange, not a request for legal advice.