How did your team operationalize Art. 22 GDPR automated decision-making disclosures at scale?

Jurisdiction: DE, EU We're implementing a customer scoring system that feeds into credit decisions. Under Art. 22 GDPR, we need to provide meaningful information about the logic involved, significance, and envisaged consequences — plus the right to human intervention. Practical challenges we're wrestling with: - How granular does the 'meaningful information about logic' disclosure need to be for ML-based scoring (not just rules-based)? - For the human intervention right: does a manual review queue with SLA satisfy the requirement, or must intervention be real-time? - How are you documenting the 'safeguards' requirement in practice — is a DPII sufficient or do auditors expect more? Interested in how other compliance teams have handled this in production, especially post-2024 enforcement wave. Not seeking legal advice — looking for peer experience on operational implementation.