What it is

Model cards were proposed by researchers at Google in 2018 as a short, standard document to accompany a trained model: what it is for, how it was evaluated, how it performs across different groups, and where it should not be used. The idea spread because it answered a question every downstream user had and few providers documented.

The major model providers now publish system cards with each release, covering the model and the safeguards around it: safety evaluations, red-teaming results, known risks and mitigations. For a deployer, the system card is often the most detailed evidence available about a model it did not build.

How it differs from regulatory documentation

  • A model card or system card is voluntary and written for users.
  • EU AI Act technical documentation is mandatory. Providers of general-purpose AI models must keep it for the AI Office, give integrators what they need and publish a summary of training content (Article 53). Providers of high-risk AI systems keep fuller documentation (Annex IV) and give deployers instructions for use (Article 13).
  • An entry in the AI inventory is the deploying organisation's own record, and should point to the card rather than repeat it.

The content overlaps heavily, which is why a provider with a good model card usually finds the regulatory documentation easier, and why one without a card is a due-diligence concern.

What a useful card contains

  • Intended uses, and uses that are out of scope.
  • Training data in outline, including sources and known gaps.
  • Evaluation results broken down by relevant groups and conditions, with the metrics and thresholds used.
  • Known limitations and failure modes.
  • Safety and security evaluations, and the safeguards applied.
  • Version, date, and what changed since the previous version.

A card that reports only aggregate accuracy, or names no failure modes, tells you most by what it leaves out.

Using cards in governance

Ask for one for every third-party model in the inventory, and record the version it describes, because last year's card says nothing about this year's model. Read it against your own use: a model evaluated on general benchmarks may be untested in your domain. For models you build, write one; it is the cheapest way to make model risk management evidence reusable. Staff who cannot interpret a card are part of the AI literacy gap.

Frequently asked questions

What is a model card? A short document describing a model's intended uses, performance, limitations and known risks.

What is the difference between a model card and a system card? A model card documents a model. A system card also documents the deployed system around it, including safety evaluations and safeguards.

Is a model card required by law? Not by that name. The EU AI Act requires technical documentation from providers of general-purpose AI models and high-risk systems, which covers much of the same ground.

Where it sits in the register

Third-party model and dataset provenance and inadequate AI vendor due diligence are the gaps a missing card signals. Third-party model and vendor due diligence is where the card is requested.