AI System Card Template for EU AI Act Readiness

Why a system card beats a Slack thread

Lawyers and enterprise security teams ask the same questions every time: What does the AI do? Who is affected? Which model? Who oversees outputs? What is your role under the AI Act?

A system card is the one-page answer. It is not a conformity assessment and not a legal opinion. It is the intake form that stops counsel from reconstructing your product from marketing copy.

When you need one

• Before a legal review or outside counsel engagement
• When an enterprise buyer sends a security / AI questionnaire
• When you ship a new AI feature (one card per feature, not one for the whole company)
• When you prepare documentation toward Annex III duties (apply from 2 December 2027 if high-risk)

Art. 50 transparency still lands earlier (2 August 2026) — the card should note whether users interact with AI and how you disclose.

Fields that actually matter

How to fill it in 30 minutes

1. Pick one AI feature (e.g. “CV ranker”, not “the whole product”).
2. Write intended purpose in one paragraph — what a reasonable person would use it for.
3. Mark output type honestly. If the score auto-rejects candidates, say so.
4. List models and what personal data you send.
5. Describe the human path (or admit there is none).
6. List missing facts instead of guessing classification.

Copy the template

Use the ready table: AI system card template.

Pair it with:

• Human oversight SOP
• AI vendor inventory
• Documentation requirements for SaaS providers

Turn the card into a brief

Once the card is filled, get a free readiness brief for your product. The brief adds confidence labels, sources, and effective dates so counsel spends time on judgment — not archaeology.

Not legal advice. A system card is a readiness artefact, not proof of compliance.