Model cards and system cards for defense AI documentation

Defense programs ask for “the model card.” Official pages define short model-reporting documents and, in CDAO toolkits, point to templates. They do not, in the sources we checked, make a model card or a system card a numbered CMMC or DFARS control.

Status as of 14 October 2026: the Hugging Face Hub model-cards page still describes model cards as simple Markdown files with additional metadata (README.md plus YAML), still citing Mitchell, 2018 for intended uses and limitations. CISA’s 2026 Minimum Elements HTML page is still dated 29 July 2026. We still found no CDAO system-card template at the Pathway or December 2024 GenAI toolkit URLs.

What a model card is

Mitchell et al.’s Model Cards for Model Reporting, hosted by Google Research, propose a framework that we call model cards. The paper describes them as short documents accompanying trained machine learning models that provide benchmarked evaluation in a variety of conditions and disclose the context in which models are intended to be used.

The Hugging Face Hub says model cards are files that accompany the models and should describe intended uses and potential limitations, including biases and ethical considerations as detailed in Mitchell, 2018, plus training information, datasets and evaluation results. Google DeepMind publishes simple, structured overviews of how an advanced AI model was designed and evaluated. Meta’s Llama 3 model card is an official example of the same document type for a released model.

Those pages are documentation conventions. They are not defense acquisition documents.

What CDAO pages actually name

The RAI Strategy and Implementation Pathway lists toolkit resources that include AI Data Cards and Model Cards, and corresponding catalogs, with detailed instructions. The available-resources list includes an AI Data Card template and an AI Model Card template.

CDAO’s December 2024 Generative AI RAI Toolkit lists a Hugging Face Model Card Template as a tool, annotated template and resources to aid in model card creation. It defines model cards as a documentation framework for understanding, sharing, and improving machine learning models and tells teams to fill in a Hugging Face Model Card Template for each model to help traceability (transparent and auditable documentation).

The public RAI Toolkit announcement still describes the toolkit as a voluntary process. See DoD RAI Toolkit vs NIST AI RMF and the CDAO AIA Toolkit listing.

We searched those CDAO pages for a numbered contract clause that requires a model card. We did not find one.

System cards

Vendor “system cards” are official documents some model providers publish for a deployed system rather than a single checkpoint. Google DeepMind’s model cards index is the official collection we cite for that organization’s structured overviews. Meta’s Llama 3 card is labeled a model card, not a system card.

We searched the CDAO Pathway and the December 2024 GenAI toolkit PDF for an official DoD system card template. We did not find a published template at those URLs. The Pathway names data cards and model cards. Treat “system card” as provider documentation unless a program’s own issuance defines it.

What NIST and CISA add (not a DoD clause)

The NIST AI RMF is intended for voluntary use. The AI RMF 1.0 PDF is a risk-management framework, not a model-card standard. We did not find a sentence in that PDF that adopts Mitchell et al. or Hugging Face cards as a required artifact.

CISA’s 2026 Minimum Elements for an SBOM notes additional useful supply chain data—for example, information such as what AI engineers commonly discuss under the titles of “model cards” or “data cards.” The same paragraph says this document does not introduce additional elements for SBOMs for AI systems. See data provenance and SBOM/AIBOM.

What we searched for and did not find

We searched the CDAO and NIST pages cited above for a sentence that makes “model card” or “system card” a CMMC practice or a DFARS clause. We did not find one. CMMC remains a CUI-protection program.

Analysis, not sourced fact: a defense program can still fill the CDAO / Hugging Face template as the traceability artifact the GenAI toolkit asks for, and keep the Mitchell sections (intended use, limitations, evaluation) as the content checklist. That stacking is a reading of the documents, not a requirement we found.

Listed documentation resource: Hugging Face Model Cards.

Questions

Does DoD require a model card on every AI contract?

No source we cite says that. CDAO names templates inside a voluntary toolkit. Check the contract and the program’s RAI plan.

Is a system card the same as a model card?

Not on the official pages we cite. Model cards document a trained model. Some providers publish separate system-level documents. CDAO’s Pathway names data cards and model cards. We did not find a published CDAO system-card template at the URLs above.