SOC 2 Type II + GDPR Art. 22 audit: handling automated decision-making documentation

Our team recently went through a combined SOC 2 Type II audit and GDPR compliance review. The most time-consuming intersection was documenting automated decision-making processes under GDPR Article 22 while simultaneously satisfying SOC 2's CC6.1 and CC7.1 controls. We found that the auditor frameworks don't map cleanly: - SOC 2 wants evidence of monitoring and alerting around system changes - GDPR Art. 22 requires documentation of logic, significance, and consequences of automated decisions, plus the right to human intervention - EU AI Act (risk-based classification) adds another layer for any ML-based scoring systems How did your teams handle this overlap? Did you build a unified control matrix, or maintain separate documentation trails? Jurisdiction context: We operate across EU/DE and US-CA. Looking for peer experience, not legal advice — just what documentation approaches survived actual audits.