AI model cards and system cards: what labs disclose

An AI model card is the document a lab publishes alongside a model to say what the model is, what it was trained on in broad terms, how it was evaluated and where it should not be used. Anthropic and OpenAI call their versions system cards and put most of their weight on safety testing and the safeguards around the deployed model. Google DeepMind keeps the name model card and publishes a separate safety and security report.

None of these documents is an independent audit. Each is the lab’s own account of its own model. Read well, though, a card tells you which version was tested, under what conditions, against which risks, and what the lab chose not to disclose.

Where model cards come from

The format comes from research rather than from the frontier labs. Model Cards for Model Reporting, by Margaret Mitchell and eight co-authors, was first posted to arXiv on October 5, 2018 and presented at the FAT* conference in January 2019. The paper proposed short documents that accompany trained models with “benchmarked evaluation in a variety of conditions”, the context in which the model is intended to be used and details of how its performance was evaluated.

The idea spread to open-model hosting. On Hugging Face, the model card is the README.md file of a model repository: Markdown text with a YAML metadata block at the top. Hugging Face says the card should describe the model, its intended uses and limitations, training parameters, the datasets used and evaluation results, and it cites the Mitchell paper for the limitations section.

Frontier labs kept the name but changed the emphasis. Their documents now spend far more space on dangerous-capability testing than on the fairness breakdowns the 2018 paper focused on.

What Google DeepMind’s model cards contain

Google DeepMind’s model cards page describes them as “simple, structured overviews of how an advanced AI model was designed and evaluated”, and lists each card with a published or updated date. The Gemini 4 Argon model card, updated October 13, 2026, follows a fixed set of sections:

• Model information: a description, whether the model is a fine-tune of an earlier one (Google says Argon is not), inputs and outputs, and architecture. Argon accepts text, images, audio and video with a combined input-output context window of up to 1M tokens and outputs text. Google describes it as a sparse mixture-of-experts transformer but gives no size.
• Model data: the categories of pre-training and post-training data, including crawled web data, licensed data, user data under Google’s terms and synthetic data, and the filtering applied.
• Implementation and sustainability: trained on Google TPUs with JAX and ML Pathways.
• Distribution: the products and APIs that serve the model.
• Evaluation: a results table “as of October, 2026” comparing Argon with GPT-6 Astra, Claude Fable 5.1 and Claude Opus 5.5, with a link to a separate methodology page.
• Intended usage and limitations: suitable uses, known limitations and the knowledge cutoff, which Google gives as March 2026.
• Safety and security: the types of evaluation and red teaming run, the Frontier Safety Framework testing, and a link to the full Safety & Security Report.

The comparison table is Google’s own run of other labs’ models. Our Gemini 4 Argon review reads those numbers against independent evaluations.

What Anthropic’s system cards contain

Anthropic’s system cards page says they “document the capabilities, safety evaluations, and responsible deployment decisions for Claude models”. The archive goes back to Claude 2 in July 2023.

The Claude Haiku 5.5 system card, dated October 7, 2026, reports pre-deployment evaluations in seven areas: Responsible Scaling Policy evaluations, cyber, safeguards and harmlessness, agentic safety, alignment, model welfare and capabilities. Its introduction also covers training data sources, the knowledge cutoff (June 2026), which snapshot was evaluated and the safeguards applied at launch, such as the classifiers used for chemical, biological and cyber misuse.

Two details matter when reading it. First, Anthropic says some sections use an earlier or alternate snapshot, or run the model “with its production safeguards disabled”, so a result may describe the underlying model rather than the product a customer uses. Second, the card says it was deliberately condensed, with fewer human-intensive evaluations and less prose, and that cards for non-frontier models will be similarly condensed. A shorter card is a disclosure choice, not evidence that fewer risks exist. Our report on the Claude Haiku 5.5 release covers the launch itself.

What OpenAI’s system cards contain

OpenAI publishes its system cards on the Deployment Safety Hub. Not every model gets a full card. GPT-6.1 Sol was documented on September 29, 2026 as an addendum to the GPT-6 Astra system card, which OpenAI says “provides updates on the baseline safety metrics and evaluation results”. For data and training it states only that GPT-6.1 Sol uses the same types of data and training as GPT-6 Astra and points back to that card.

The addendum is organised around model safety, robustness to jailbreaks and prompt injection, health, hallucinations, alignment, chain-of-thought monitorability and OpenAI’s Preparedness Framework. Under that framework OpenAI says it is treating GPT-6.1 Sol as Critical in cybersecurity and High for biological and chemical capability. Like Anthropic, OpenAI notes that its evaluations ran in a research environment or through the API and may differ from production ChatGPT because of system prompts, tools and effort settings.

Model card or system card: the practical difference

The labs do not use the two terms by a shared standard, so the label tells you less than the contents. In the documents above, the difference is mostly scope:

How to read a card

Check the date and version. Google lists an “updated” date for each card, and cards change after launch. A card is a snapshot of what the lab disclosed on that date.

Check what was tested. Anthropic and OpenAI both say some results come from snapshots, research environments or configurations without production safeguards. Those numbers describe the model, not necessarily the product.

Separate the lab’s numbers from independent ones. Benchmark tables in cards are run by the lab, with its own harness and settings. Scores we collect on the LLM leaderboard carry the name of whoever ran them for that reason.

Note what is missing. None of the three closed-model documents above gives a parameter count or a training compute figure. Training data is described by category, not by source list.

Follow the frameworks. Risk thresholds such as Anthropic’s RSP levels, OpenAI’s Preparedness categories and Google’s Frontier Safety Framework are defined in separate policy documents. A card says where a model landed; the framework says what that level means.

Every release we track, with its date and a link to the lab’s announcement, is in AI model updates. Lab ownership and listing status are in AI companies, and dated lab developments, such as Anthropic giving METR embedded evaluator access, are in AI lab news.