Operationalizing GDPR Art. 22 for automated decision systems

Jurisdiction: EU, DE Our team is implementing automated scoring for a B2B SaaS product. GDPR Art. 22 requires meaningful human review when decisions produce legal or similarly significant effects. The challenge: defining what "meaningful" means operationally. We're considering a tiered approach: low-impact decisions fully automated, medium-impact flagged for human review within 24h, high-impact blocked pending manual sign-off. But the regulation is vague on thresholds. How did your team operationalize Art. 22 compliance at scale? Did you use risk matrices, external audits, or something else? Also interested in how this intersects with the EU AI Act's risk classification once it applies.