What it means
- Each AI system has a short, standard document explaining what it is for, how it works, what data it used, how well it performs, and where it should not be used.
- A model card covers a single model; a system card covers the whole application (model plus prompts, retrieval, guardrails, human steps).
- For bought models, include what the vendor tells you plus how you configured and tested it.
- Kept current: updated on each significant change, versioned alongside the model.
Why it matters
- RBI FREE-AI expects documentation of objectives, design, context and benchmarks from design to decommissioning.
- Validators, auditors and incident responders all need it; without it every review starts from scratch.
- Enterprise customers and government buyers increasingly ask for model or system cards.
Checklist
- Adopt a model card template: purpose, intended users, out-of-scope uses, model type and version, training data summary, performance metrics, fairness results, known limitations, owner, approval date.
- Add a system card template for applications combining models, prompts and tools.
- Complete cards for all medium and high risk systems before go-live.
- Store cards with the model in the registry or repository, versioned.
- Update the card on every material change (SC-AI-019 Change management and approval gates).
- Prepare a customer-facing version where customers or buyers need it.
Evidence examples
- Model card v2.3 for the fraud detection model with approval sign-off.
- System card for the customer service GenAI assistant describing prompts, retrieval sources and guardrails.
- Model registry screenshot showing card linked to the deployed version.
- Change log showing card updated after retraining.
Common pitfalls
- Cards written once for launch and never updated.
- Too technical for business owners, or too vague for validators.
- No "do not use for" section, so the model gets reused for a purpose it was never tested for.
Satisfies
- VoluntaryISO/IEC 42001
- BindingEU AI Act
- SupervisoryPRA SS1/23
- VoluntaryNIST AI RMF and GenAI Profile
- BindingTexas TRAIGA
- BindingKorea AI Basic Act
- SupervisoryOSFI E-23
- VoluntaryRBI FREE-AI
Also relevant to
- NITI Aayog Responsible AI for Allno numbered obligations; mapped in its practical notes (record design and functioning for scrutiny)
- Tamil Nadu Safe and Ethical AI Policyno numbered obligations; mapped in its practical notes (vendor evidence pack)
- AI (Ethics and Accountability) Bill 2025no numbered obligations; mapped in its practical notes (model disclosures)
Standards crosswalk
Clause references only. Check the standard itself for the exact wording.
ISO/IEC 42001
- 7.5 Documented information
- A.4.2 Resource documentation
- A.6.2.3 Documentation of AI system design and development
- A.6.2.7 AI system technical documentation
- A.8.2 System documentation and information for users
ISO/IEC 27001
No direct equivalent
SOC 2
No direct equivalent
Key takeaways
- One standard card per model or system, versioned with the model.
- New for AI, not covered by ISO 27001. Your document control habits carry over, but no Annex A control asks for model documentation.
- Include limitations and out-of-scope uses, not just performance.