ISO 42001 Section 6.4: What a Compliant Model Card Requires and Why Auditors Ask for It First
ISO 42001 Section 6.4 defines model card requirements for AI systems. Here's what a compliant model card contains, why enterprise auditors request it immediately, and what most teams are missing.
When an enterprise auditor or procurement team reviews your AI governance documentation, they typically ask for one thing first: a model card.
Not a policy document. Not an org chart with an AI governance committee on it. A model card: a structured, specific record of what your AI system is, what it does, what it was trained on, and what its known limitations are.
ISO 42001:2023 Section 6.4 defines the requirements for this documentation. Most teams have either never heard of it or assume a README file satisfies it. Neither is true.
What Section 6.4 actually requires
ISO 42001 Section 6.4 covers the documentation of AI system characteristics. A compliant model card under this section must contain:
- •The intended purpose of the AI system - not just what it does, but what it was designed to do, what decisions it informs or makes, and what populations it affects.
- •The scope of deployment - where the system is used, under what conditions, and any explicitly out-of-scope use cases.
- •Performance characteristics - accuracy, precision, recall, or other relevant metrics, tested against representative data sets.
- •Known limitations and failure modes - documented cases where the system underperforms, produces biased outputs, or should not be relied upon.
- •Data provenance - where the training data came from, how it was processed, and what governance was applied to data collection and labelling.
- •Human oversight mechanisms - who has the authority and ability to override or suspend the AI system, and what process governs that override.
- •Version and change history - what version of the model is deployed, when it was last updated, and what changed between versions.
Why enterprise auditors ask for it first
A model card tells an auditor more about your AI governance maturity than any policy document. Policies are easy to write. A model card requires you to have actually investigated your system.
If you can produce a complete model card, it demonstrates that someone in your organisation has documented the training data, evaluated the performance across meaningful segments, identified the failure modes, and put a name to the person responsible for oversight.
If you cannot produce one - or if the model card is incomplete - it tells the auditor that governance is performative rather than operational.
For enterprise procurement specifically, the inability to produce a model card is increasingly a dealbreaker. Enterprise legal and security teams reviewing AI vendors in 2026 are asking for this documentation before contracts are signed.
What most teams are missing
Based on AI compliance diagnostics, the most common gaps in model card documentation are:
Failure modes are blank or generic. "The model may produce incorrect outputs in edge cases" is not a documented failure mode. A failure mode is specific: "The model underperforms by approximately 23% for non-native English speakers based on our evaluation set."
Performance data is from launch, never updated. ISO 42001 requires ongoing documentation. A model card completed at deployment and never reviewed does not reflect how a system actually performs in production as data distributions shift.
Intended purpose is too broad. "Assist customer service teams" is not a sufficient intended purpose description. The documentation needs to specify what decisions the AI informs, at what threshold, with what human review.
Data provenance is missing entirely. Many teams using third-party foundational models or fine-tuned versions of public models have no documentation of the underlying training data.
How model cards connect to the EU AI Act
ISO 42001 Section 6.4 documentation maps directly to EU AI Act Article 11, which requires technical documentation for high-risk AI systems, and Article 13, which requires transparency about AI system characteristics for deployers.
If you are pursuing EU AI Act compliance and ISO 42001 simultaneously - which is the most efficient approach - the model card produced for ISO 42001 Section 6.4 forms the foundation of your Article 11 technical documentation.
Building it once, correctly, satisfies both requirements.
A practical starting structure
A compliant model card does not need to be lengthy. It needs to be complete:
- •System name and version. Deployment date. Last reviewed date.
- •Intended purpose: specific description of what decisions the system informs or makes, for whom, in what context.
- •Out-of-scope uses: explicitly stated.
- •Performance metrics: relevant metrics, evaluation dataset description, performance by meaningful subgroup if applicable.
- •Known limitations: specific documented failure modes with supporting evidence.
- •Training data: source, size, processing methodology, governance applied.
- •Human oversight: named role with override authority, process for invoking override.
- •Change log: version history with material changes noted.
This structure satisfies ISO 42001 Section 6.4 and gives you a strong foundation for EU AI Act Article 11 technical documentation requirements.