Skip to content
AI360Xpert
Cover image for Your Model Card Isn't Annex IV
Governance

Your Model Card Isn't Annex IV

By AI360Xpert

Why Does This Exist?

In the early 2020s, the "Model Card" became the gold standard for ML documentation. Introduced in a seminal paper, it was a one- or two-page summary of a model's intended use, performance, and biases. It was entirely voluntary. Companies released them for good PR, and if a section was inconvenient (like training data provenance), they just left it blank.

With the enforcement of the EU AI Act, that era is over. Annex IV of the Act mandates a specific, exhaustive list of technical documentation that must be maintained for high-risk AI systems. A markdown file on Hugging Face is no longer sufficient.

Think of It Like This

A standard model card is like the marketing brochure for a car. It tells you the horsepower, the safety rating, and the intended terrain. Annex IV documentation is the engineering blueprint and the factory audit log. It is a legally binding record of how the car was built, tested, and approved.

How It Actually Works

Annex IV requires deployers and providers to maintain a living document that includes, among other things:

  1. Design Specifications: Exact architecture details, hyperparameters, and the logic behind algorithmic choices.
  2. Data Provenance: Detailed descriptions of the training, validation, and testing datasets, including how they were collected, cleaned, and assessed for bias.
  3. Evaluation Metrics: Not just top-line accuracy, but disaggregated metrics across protected demographics, and the exact harnesses used to calculate them.
  4. Risk Management Log: A documented history of identified risks, how they were mitigated, and the residual risks that remain.
  5. Human Oversight Measures: Technical specifications of the UI and mechanisms designed to allow human operators to intervene or shut down the system.

If a regulatory body requests this documentation, you must provide it. If it is incomplete or materially false, you are liable.

Watch Out For

You cannot reverse-engineer this documentation after the model is built. Reconstructing data provenance months after a web scraping run is nearly impossible. Annex IV requires a cultural shift: documentation must be generated as a continuous artifact during the engineering process, not tacked on as a post-mortem chore.

(Correct as of August 2026).

The Quick Version

A standard open-source model card is a starting point, not a compliance filing. Under Annex IV of the EU AI Act, technical documentation must be exhaustive, covering exact data provenance, risk logs, and architectural specifications.

Review ai-governance-frameworks to see where Annex IV fits into the broader regulatory landscape.