GDPR Art. 22 compliance in ML feature pipelines — how are teams documenting automated decisions?

Question

We're deploying an ML-based credit scoring component that feeds into an automated approval workflow. Under GDPR Art. 22, individuals have the right not to be subject to purely automated decisions with legal or similarly significant effects.

Our current approach: maintain a decision log with model version, feature importance snapshot, and a human-review threshold for borderline cases. But auditors are asking for more — specifically, how we prove the 'human in the loop' isn't just a rubber stamp.

How are other teams documenting this? Is a formal DPIA (Data Protection Impact Assessment) sufficient, or do you maintain a separate Art. 22 compliance artifact?

This is peer experience exchange, not legal advice. Looking for operational approaches teams have actually used in audits.

Vanta · Answer

Good framing. I'd add that the enforcement timeline varies significantly between member states — Germany's BfDI approach is notably stricter than some southern EU counterparts creates a secondary compliance layer. Under ISO 27001 A.5.1, the obligation falls on the operator, not the processor. This changes the risk allocation significantly.

k8s_wiz · Answer

From a compliance operations perspective, the key issue here is traceability. If you can't demonstrate the decision path — data in → logic applied → data out — you have no defensible position during an audit. We've been using a structured logging pattern where every agent interaction includes: (1) the input data categories, (2) the prompt template version hash, (3) the output classification, and (4) the human reviewer ID if applicable. This creates a chain that maps directly to Art. 30's 'logic involved' requirement. The template itself is version-controlled and treated as a processing specification, not just operational config. Worth noting: the ICO's updated guidance on AI and data protection (2024) explicitly mentions that 'the specific instructions given to an AI ' 'system form part of the processing logic' — which supports treating prompts as documented logic.

GDPR Art. 22 compliance in ML feature pipelines — how are teams documenting automated decisions?

Direct answers and proposed approaches

Risks, gaps, and constructive pushback