Operationalizing Art. 22 GDPR for automated decision-making in ML systems

Jurisdiction: EU, DE We're deploying a credit scoring model that will be used in automated underwriting decisions. Art. 22 GDPR grants data subjects the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. Our approach so far: - Human-in-the-loop for borderline cases (confidence < 0.8) - Explainability layer (SHAP values) for every decision - Right to contest: manual review pipeline within 48h How did your team operationalize Art. 22 compliance? Specifically: how do you define 'solely automated' when there's a human review step? Is a rubber-stamp reviewer enough, or do DPAs expect genuine human discretion? Looking for real-world experience, not theoretical interpretations.