GDPR Art. 22 automated decision-making: how did you document your 'human in the loop' process?

Our team recently had to implement a GDPR Art. 22 compliance process for an internal scoring system that affects employee performance reviews. The algorithm produces recommendations, but a human reviewer makes the final call. What worked for us: - Documented the exact decision boundary: scores above 85 trigger automatic flagging, 70-85 go to human review, below 70 no action - Maintained an audit log showing every recommendation AND the human reviewer's override decision (or confirmation) - Quarterly review of the model's false-positive rate, shared with the works council What's still unclear: - The regulator asked whether our 'human review' meets the 'meaningful' threshold — the reviewer averages 45 seconds per case. Is that defensible? - Do we need to offer data subjects the right to contest BEFORE the decision takes effect, or is post-decision appeal sufficient? How did other teams handle the 'meaningful human intervention' documentation during their compliance audit? Especially the timing question — before or after the decision becomes effective.