Model Card Submission

Defines the precise operational context and intended purpose for which the model was designed, forming the legal boundary of its registration. This section must explicitly enumerate out-of-scope use cases—applications the model was not validated for and where failure modes are unknown. The EU AI Act requires this declaration to establish the scope of the conformity assessment.

• Specifies target domains, modalities, and user populations
• Lists prohibited use cases (e.g., medical diagnosis for a non-clinical model)
• Defines the geographic and cultural contexts of training data
• Establishes the legal boundary for liability and post-market monitoring

Documents quantitative performance across disaggregated evaluation slices including accuracy, precision, recall, F1 scores, and fairness metrics. Results must be stratified by demographic factors, environmental conditions, and edge cases. The EU AI Act mandates disclosure of performance on protected subgroups to demonstrate non-discrimination.

• Reports metrics on held-out test sets with confidence intervals
• Includes performance across intersectional subgroups (age, gender, geography)
• Documents failure modes and error distribution patterns
• Specifies evaluation datasets, benchmarks, and testing protocols used

A documented lineage of all datasets used during pre-training, fine-tuning, and reinforcement learning stages. This component demonstrates compliance with copyright obligations and data governance requirements under the EU AI Act. It must detail data collection methodologies, filtering criteria, and known biases.

• Lists data sources with collection dates and licensing status
• Documents data preprocessing, cleaning, and augmentation steps
• Discloses the presence of personal data and consent mechanisms
• Identifies known representational gaps and sampling biases in the corpus

Mandatory declaration of known limitations and any remaining risks that could not be mitigated through technical measures. This section must transparently communicate failure modes to deployers and end-users. The EU AI Act requires residual risk disclosure as part of the technical documentation file for registration.

• Enumerates known failure modes and edge-case degradation
• Discloses demographic performance disparities with root-cause analysis
• Documents sensitivity to input perturbations and distribution shifts
• Specifies operational conditions where performance is unvalidated

Documents the fairness criteria and ethical review process applied during model development. This includes the specific fairness metrics used (demographic parity, equalized odds, equal opportunity), the rationale for metric selection, and the results of bias audits. Required for conformity assessment under harmonized standards.

• Specifies fairness definitions and metric thresholds applied
• Reports disparate impact ratios across protected attributes
• Documents the composition and findings of ethical review boards
• Describes mitigation strategies implemented and their effectiveness

Specifies the post-market monitoring plan detailing how the model's real-world performance will be continuously tracked after deployment. This section links the model card to the ongoing compliance obligations under the EU AI Act, including drift detection thresholds and incident reporting triggers.

• Defines key performance indicators for production monitoring
• Specifies data drift detection methods and retraining triggers
• Establishes thresholds for automatic rollback or human intervention
• Links to the incident reporting mechanism via the unique registration ID

The comprehensive dossier required as part of registration, containing:

• System architecture and design specifications
• Risk management protocols and residual risk disclosures
• Training data provenance records
• Model card as a summary transparency artifact This file forms the evidentiary basis for conformity assessments and must be kept for 10 years post-market placement.

The mandatory verification process demonstrating that a high-risk AI system meets the essential requirements of the EU AI Act. For systems requiring third-party oversight, a Notified Body conducts the assessment. Successful completion is a prerequisite for CE Marking affixation and database registration. Internal assessments are permitted for certain categories if a Quality Management System Audit is certified.

An alphanumeric identifier assigned by the EU database upon successful registration. This ID must be:

• Displayed on the CE Marking or accompanying documentation
• Referenced in all incident reporting submissions
• Linked to the Digital Product Passport for physical goods It enables traceability across the entire AI supply chain, from provider to deployer.

The continuous, systematic process by which providers collect and analyze real-world performance data after registration. This obligation requires:

• Automated decision logging for auditability
• Proportional data collection based on risk classification
• Immediate incident reporting linkage for serious malfunctions Findings must be documented and may trigger a substantial modification review requiring re-registration.

A legal requirement for non-EU providers to designate a natural or legal person established within the Union. This representative:

• Acts as the point of contact for National Competent Authorities
• Maintains the Technical Documentation File for inspection
• Manages market withdrawal notifications if required This mandate ensures that foreign entities remain accountable to EU enforcement without establishing a physical presence.