Model cards: documenting AI systems for compliance
A model card is a structured document describing an AI model's intended use, training data, performance metrics, limitations and ethical considerations. Originally proposed as a research practice, model cards are increasingly expected by auditors assessing AI systems against ISO 42001, the EU AI Act and the NIST AI RMF.
What a model card contains
A model card typically records the model's purpose and intended users, the training data (sources, size, known gaps), performance metrics broken down by relevant subgroups, known limitations and failure modes, and ethical considerations such as potential for harm.
There is no single mandatory format, but the structure should be consistent across your AI inventory so that auditors can compare systems and reviewers can find what they need.
- Model name, version and owner
- Intended use and out-of-scope uses
- Training data: sources, preprocessing, known biases
- Performance metrics, disaggregated by relevant groups
- Known limitations and failure modes
- Ethical considerations and potential for harm
Model cards in a compliance programme
Model cards overlap with the documentation that AI frameworks already require. ISO 42001 asks for documented information about AI systems. The EU AI Act requires technical documentation for high-risk systems. The NIST AI RMF's Map function asks you to understand and document AI systems. A model card addresses parts of all three.
- AI system inventory: the register each model card belongs to.
- AI transparency: model cards make the system's behaviour visible.
- AI compliance: ISO 42001, EU AI Act and NIST AI RMF in one workspace.
Working through this for an audit?
Talk it through with someone who has run the audit before, or look up another term.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them