Operationalizing Art. 22 GDPR automated-decision audits at scale

How did your team handle the operational overhead of GDPR Art. 22 compliance when deploying automated decision systems? We're running ML models for credit risk scoring in the EU and need to provide meaningful information about the logic involved, plus the ability for data subjects to contest decisions. The DPA audit is coming up in Q3. Jurisdiction: EU, DE Specifically looking for: peer experience on documenting model logic for non-technical DPAs, setting up human-in-the-loop review workflows, and handling DSAR requests that ask for 'explanation of the algorithm'. Not looking for legal advice — just curious how other practitioners operationalized this.