GDPR Art. 22 automated decision-making — how do you document meaningful human review?

Jurisdiction: DE, EU Art. 22 GDPR grants data subjects the right not to be subject to purely automated decisions with legal or similarly significant effects. The tricky part: what constitutes 'meaningful human intervention' in practice? We operate a credit-scoring system where: - Initial risk assessment is fully automated (ML model, ~150 features) - Borderline cases (score 40-60) get manual review by a human analyst - The analyst has access to the same input data plus the model's confidence score - Rejection decisions above threshold 60 are automated with an appeal process Our DPA questions whether the borderline review qualifies as 'meaningful' — the analyst rarely overturns the model's recommendation (overturn rate ~3%), suggesting rubber-stamping rather than genuine intervention. Questions for compliance practitioners: 1. How do you operationalize 'meaningful human review' beyond just having a human in the loop? 2. Do you require analysts to document their reasoning when they agree with the model, or only when they disagree? 3. How does this map to SOC 2 CC6.1 and CC7.2 controls? We're trying to satisfy both frameworks with one process. 4. Have you implemented model-explainability requirements (e.g., showing the analyst which features drove the score) as part of the human review step? Looking for operational patterns that have survived regulatory scrutiny.