Model Cards › The Regulatory Context

Model cards did not develop in isolation. They have become increasingly intertwined with regulatory frameworks governing AI deployment, and understanding this context is important for practitioners who need to produce documentation that satisfies internal standards and external requirements.

The EU AI Act, which entered into force in 2024, establishes documentation requirements for AI systems based on their risk category. High-risk AI systems (including systems used in employment, education, essential services, law enforcement, and credit decisions) must be accompanied by technical documentation that covers training data, development methodology, intended purpose, performance characteristics including accuracy metrics, and human oversight provisions. Model cards, if written to cover these areas with sufficient depth, can serve as the core of this required documentation.

In the United States, the NIST AI Risk Management Framework provides a voluntary but influential structure for AI risk management that includes documentation requirements. Several executive orders and federal agency guidance documents have endorsed the NIST framework, making model card-style documentation a de facto expectation for government contractors and agencies deploying AI systems.

Canada, Japan, South Korea, and the United Kingdom have all published AI governance frameworks that include documentation requirements. The common thread across these frameworks is the expectation that developers can articulate, in writing, what a system was designed to do, how its performance was evaluated, what its known limitations are, and who is responsible for it. Model cards are designed to answer exactly these questions.

Regulatory requirements create both an incentive and a risk for model card documentation. The incentive is clear: documentation that satisfies regulatory requirements reduces compliance risk. The risk is that regulatory compliance becomes the goal rather than accountability. A model card written to check boxes rather than inform deployers satisfies neither goal well. The most effective approach is to write model cards that serve deployers, because documentation written for practical use will also satisfy well-designed regulatory requirements.