You fine-tuned a foundation model on internal data last quarter. Article 25(1)(b) substantial-modification transfer just made your organization the provider of the fine-tuned model with full Article 16 obligations including an Annex IV technical file. The vendor model card you've been relying on is now insufficient on its own. You have to produce your own model card. This lesson walks the full Mitchell-et-al. (2019) nine-section structure layered with EU AI Act Article 11 + Annex IV §2 expectations, with a worked example for a customer-service fine-tune of Anthropic Claude 4 on 50,000 internal support transcripts. By the end you can write the L2 deliverable: a complete model card for one internal fine-tuned LLM that satisfies Mitchell-et-al. + Article 11 + Annex IV §2(b) + ISO 42001 A.8 expectations simultaneously.

Why the Fine-Tune Changes the Documentation Burden

Before fine-tuning, the customer was a deployer of Anthropic Claude 4. Article 26 deployer obligations applied; Anthropic's Annex XII receivable was the GPAI-specific documentation; the customer-side gap-fill addressed application-specific elements. After fine-tuning on 50,000 customer-service transcripts, three things changed simultaneously:

• The fine-tuning is substantial modification under Article 3(23): the model's behavior, performance, and risk profile changed materially (new domain adaptation, new refusal patterns adapted to support-context queries, new latent biases inherited from the support-ticket history).
• Article 25(1)(b) transfer fires automatically, no contractual escape, and the deployer becomes the provider of the fine-tuned model.
• The full Article 16 obligation set attaches to the fine-tuned model: Annex IV technical file, Article 17 QMS, conformity assessment under Article 43, Article 47 declaration if placed on the market or put into service in high-risk context, Article 71 EU database registration where applicable.

The model card is the documentation backbone for the fine-tuned model. It serves three audiences simultaneously: regulators (Annex IV §2(b) design specifications); auditors (ISO 42001 A.8 information for users); internal developers and operators (Mitchell-et-al. usability). The L2 deliverable is one model card that satisfies all three.

The Mitchell-et-al. Nine Sections - Definitions and 2026 Updates

Mitchell et al. (2019), "Model Cards for Model Reporting", proposed nine sections that have become the industry-standard structure. Each section maps to specific EU AI Act + ISO 42001 expectations in 2026:

1. Model details: Architecture, version, owner, date, contact. Maps to Annex IV §2(a) (development methods + third-party pre-trained systems) + §2(c) (system architecture).
2. Intended use: Primary use cases, intended users, out-of-scope uses. Maps to Annex IV §2(b) (intended purpose, key design choices, classification choices).
3. Factors: Demographic, environmental, instrumentation factors. Maps to Annex IV §2(b) design rationale + §2(d) data requirements.
4. Metrics: Performance metrics, decision thresholds, variation approaches. Maps to Annex IV §2(g) validation and testing.
5. Evaluation data, Datasets used for validation. Maps to Annex IV §2(d).
6. Training data: Datasets used for training, preprocessing, distribution. Maps to Annex IV §2(d) + Article 10(1)(2)(3).
7. Quantitative analyses, Unitary results, intersectional results. Maps to Annex IV §2(g) + fairness-metric-selection memo.
8. Ethical considerations, Risks, mitigations. Maps to NIST AI 600-1 12-risk applicability + Article 9 RMS.
9. Caveats and recommendations, Limitations, future work. Maps to Annex IV §2(f) (pre-determined changes).

For a fine-tuned model specifically, three additional sections become essential in 2026: Article 14 human-oversight design; Article 15 robustness/cybersecurity claims with OWASP/ATLAS coverage; Article 25(2) cooperation evidence with the upstream GPAI provider.

Worked Example - Customer-Service Fine-Tune of Anthropic Claude 4

The scenario: Acme Insurance fine-tuned Claude 4 Opus on 50,000 internal customer-service transcripts (anonymized, with PII removed) to build a customer-service support agent. The fine-tuned model is deployed via Anthropic's enterprise fine-tuning API; the deployer is now the provider of the fine-tune. The model card structure with each section filled out:

Section 1 - Model Details

• Model name: Acme.ServiceAssist v1.0
• Architecture: Fine-tune of Anthropic Claude 4 Opus (vendor model card v2026-05) via Anthropic enterprise fine-tuning API. Base model is a transformer LLM; fine-tuning is parameter-efficient (LoRA adapters per Anthropic's enterprise fine-tuning service).
• Version: 1.0 (fine-tuned April 15, 2026; deployed May 1, 2026)
• Owner: VP Customer Operations (business); ML Engineering Lead (technical); AI Officer (compliance)
• Date: Initial card May 1, 2026; quarterly refresh due August 1, 2026
• Contact: [email protected]
• Article 25 status: Article 25(1)(b) substantial-modification transfer triggered by the fine-tune; Acme Insurance is the provider of the fine-tuned model under Article 16. Anthropic remains the GPAI provider for the base model under Article 53. Article 25(2) cooperation evidence: signed inter-company memorandum dated April 10, 2026.
• Risk tier: Limited / transparency under Article 50(1) (chatbot disclosure); not Annex III high-risk (insurance customer-service support distinct from insurance pricing under §5(c)).

Section 2 - Intended Use

• Primary use cases: Customer-service support for policy inquiries, claims-status queries, billing inquiries, coverage explanations. The fine-tuned model surfaces relevant policy provisions, retrieves account information through approved CRM integrations, and drafts customer-facing responses for review by human agents.
• Intended users: Customer-service agents at Acme Insurance. Not customer-facing in fully-automated mode; agents review and send.
• Out-of-scope uses: Underwriting decisions (Annex III §5(c) territory; not designed for); claims-adjudication decisions (separate governance review required; not designed for); medical advice (prohibited by AUP); legal advice (prohibited by AUP); marketing / sales (separate tool, not this one); employee performance evaluation (Article 5(1)(f) workplace emotion-recognition risk; not designed for).
• Annex IV §2(b) classification choices: Output classification, agent-suggested response text (not autonomous action). Optimization target: helpful, accurate, on-policy responses; trade-off with response speed accepted in favor of accuracy.

Section 3 - Factors

• Demographic factors: Customer demographic distribution: analyzed against fairness-metric-selection memo; baseline accuracy comparable across customer demographic groups (within 3 percentage points across age, sex, and inferred-language-preference categories).
• Environmental factors: Production deployment via Anthropic enterprise infrastructure (Anthropic's environmental reporting per Risk 5 of NIST AI 600-1 GenAI Profile); deployer-side inference-time optimization (batching, caching) reduces inference cost ~30%.
• Instrumentation: Each interaction logged with prompt + retrieved context + model output + agent action; logs retained per Article 18 record-keeping (10 years).

Section 4 - Metrics

• Accuracy: Domain accuracy 87% on held-out customer-service evaluation set (compared to 78% for un-fine-tuned Claude 4 Opus baseline).
• Refusal-appropriateness: 96% correct refusal on out-of-scope query set (medical advice, legal advice, underwriting decisions).
• Hallucination rate: 4.2% on factual policy-detail queries, flagged as a remediation priority; mitigated via RAG retrieval of authoritative policy text.
• Bias / fairness: Demographic parity in agent-recommendation rates within 5pp across analyzed customer demographic groups; equalized odds within 4pp.
• Robustness: OWASP LLM01 (prompt injection), 89% successful refusal on Promptfoo harmful-* and injection-* plugin tests; MITRE ATLAS AML.T0051 coverage documented.
• Cybersecurity: API key management per Acme's SOC; rate limiting; audit logging; incident-response runbook tested via Q2 2026 tabletop exercise.
• Decision thresholds: Confidence-below-0.7 routes to senior agent review; confidence-below-0.5 routes to subject-matter expert.

Section 5 - Evaluation Data

• Held-out evaluation set: 5,000 customer-service interactions sampled from Q1 2026 production (post-fine-tune); stratified by query type and customer demographic.
• OWASP/ATLAS test corpus: Promptfoo standard harmful-* and injection-* plugin suites; Garak v0.14.0+ dan.Dan_*, glitch.*, promptinject.* runs.
• Fairness evaluation: 10,000 synthetic and de-identified real interactions stratified by inferred-demographic categories per Acme's fairness-metric-selection memo.
• Pre-deployment evaluation: 1,000 expert-curated test cases covering edge cases (policy ambiguities, multi-policy questions, complex claims scenarios).

Section 6 - Training Data

• Fine-tune dataset: 50,000 internal customer-service transcripts from January 2023 - December 2025; PII removed via approved DLP toolchain; consented per the Article 13/14 customer-service privacy notice; further anonymized for fine-tune use.
• Annex IV §2(d) data governance: Source, internal CRM. Provenance - Acme employee-only access; retained per Article 18. Examination for biases, analyzed across customer demographic categories; identified slight over-representation of urban customers (mitigated via stratified sampling). Gaps, limited coverage of niche policy types (e.g., farm policies); flagged for next fine-tune round.
• Base model training data: Per Anthropic Annex XII + Article 53(1)(d) public summary; Acme has reviewed Anthropic's published summary as part of upstream-provider diligence.
• GDPR Article 9 special-category data: Article 10(5) carve-out applied: health-related queries in customer-service transcripts processed strictly for bias monitoring; safeguards documented (de-identification, access controls, retention limits).
• Article 53(1)(c) copyright policy: No copyrighted material in fine-tune dataset (internal documents only); upstream Anthropic copyright policy reviewed.

Section 7 - Quantitative Analyses

• Unitary results: Per-metric performance broken down by query type (policy inquiry: 91% accuracy; claims status: 88%; billing: 90%; coverage explanation: 82%, flagged for next-round improvement).
• Intersectional results: Performance across demographic intersections (e.g., older × non-English-preference customers; younger × first-time-claimants). Identified slight accuracy gap for older × non-English-preference customers (84% vs 87% baseline); remediation in progress via additional training data for that intersection.
• Cross-walk to fairness-metric-selection memo: Demographic parity in recommendation rates; equalized odds within tolerance; predictive parity within tolerance; four-fifths rule satisfied.

Section 8 - Ethical Considerations

• Confabulation risk (NIST AI 600-1 Risk 2): Mitigated via RAG retrieval, confidence thresholds, human review of customer-facing output. Residual risk: customer receives a confidently-wrong policy-detail explanation. Acceptance: residual risk is at acceptable level given human review.
• Data privacy risk (Risk 4): Mitigated via PII removal in training data + DLP at prompt time + output PII filtering. Residual risk: rare PII leakage. Acceptance: residual risk accepted; ongoing monitoring.
• Harmful bias risk (Risk 12): Mitigated via stratified fairness evaluation + ongoing monitoring + intersectional analysis. Residual risk: subtle bias drift over time. Acceptance: quarterly fairness recomputation.
• Value chain risk (Risk 11): Anthropic is GPAI Code-of-Practice signatory; Annex XII receivable in place. Residual risk: Anthropic base-model behavior change. Mitigation: vendor-update notification clause in procurement contract; substantial-modification change-control gate.
• Information security risk (Risk 10): OWASP LLM Top 10 coverage; MITRE ATLAS technique coverage; cybersecurity per Article 15. Residual risk: novel prompt-injection vectors. Mitigation: quarterly red-team refresh.
• Article 5(1)(f) workplace emotion-recognition prohibition: Confirmed not implicated, model does not analyze employee voices or behaviors; the training data is customer-side transcripts; the output is customer-facing recommendation.

Section 9 - Caveats and Recommendations

• Caveats: Performance varies by query type (coverage-explanation underperforms; remediation planned); intersectional accuracy gap for older × non-English customers (remediation in progress); confabulation rate non-zero; OWASP LLM07 system-prompt-leakage risk acknowledged.
• Future work: Q3 2026 fine-tune refresh with expanded training data for coverage-explanation domain; Q4 2026 intersectional fairness remediation; ongoing OWASP/ATLAS coverage expansion.
• Annex IV §2(f) pre-determined changes: Any future fine-tune (Q3 2026 planned) will trigger Article 43(4) substantial-modification re-conformity review; the change-control gate documents the process.
• Article 14 human-oversight design: Customer-service agents always review model output before sending to customers; confidence-below-threshold escalates to senior agent or SME; ongoing oversight-effectiveness monitoring per Article 26(4).
• Article 15 robustness claims: Per OWASP/ATLAS test results; quarterly red-team refresh; substantial-modification gate for any change that affects robustness.
• Article 25(2) cooperation evidence: Inter-company memorandum with Anthropic signed April 10, 2026; quarterly coordination meeting; incident-coordination clause in procurement contract.

Cross-Walks - One Model Card, Five Framework Windows

The Acme.ServiceAssist v1.0 model card serves multiple frameworks simultaneously:

• EU AI Act: Annex IV §2(a) provenance + §2(b) design + §2(c) architecture + §2(d) data + §2(e) human oversight + §2(f) changes + §2(g) validation + §2(h) cybersecurity; Article 11 technical documentation; Article 13 information to deployers; Article 16 provider obligations (post-Article-25-transfer); Article 25(2) cooperation evidence.
• NIST AI RMF: Map 1 context; Map 2 categorization; Map 3 capabilities; Map 4 third-party (upstream Anthropic); Map 5 impacts; Measure 1 methods; Measure 2 evaluation; Measure 2.7 red-team; Measure 3 tracking; Manage 1 prioritization; Manage 4 response/recovery.
• NIST AI 600-1 GenAI Profile: 12-risk applicability matrix integration: Risks 2, 4, 10, 11, 12 priority; Risks 1, 3, 5, 6, 7, 8, 9 addressed per applicability.
• ISO/IEC 42001:2023: A.6.1.1 impact assessment; A.6.2 impact criteria; A.6.4 post-deployment monitoring; A.7 data governance; A.8 information for users; A.10 third-party relationships (upstream Anthropic).
• OWASP + MITRE ATLAS: LLM01-LLM10 + ASI01-ASI10 coverage per applicability; ATLAS technique IDs per finding (AML.T0051, AML.T0010, etc.).

The cross-walk in the model card is what makes it the L2 "one artifact, five framework windows" exemplar.

Publication, Retention, and Refresh

The fine-tune model card is an internal document but with regulator-facing readiness. Publication scope:

• Internal: Engineering, customer-service operations, AI Officer team, AI Governance Committee, full access.
• Customer-facing summary: A redacted version (Mitchell-et-al. sections 1, 2, 8, 9 with sensitive details removed) for customer-assurance reviews and external transparency commitments.
• Regulator-facing: Full version furnished on request as part of Annex IV technical-file disclosure; integrated with Article 11 + Annex IV §2 evidence.
• Retention: Per Article 18 record-keeping (typically 10 years for high-risk records); ISO 42001 A.7 documentation retention.
• Refresh cadence: Quarterly review (in this case August 1, 2026 for the v1.0 card); triggered updates on substantial modification events (next fine-tune, new training data, threshold changes), vendor model-card updates (Anthropic Claude 4 minor releases), Commission interpretive notes on Annex IV expectations, and significant evaluation results (new red-team findings, fairness drift).

Common Model-Card Mistakes for Fine-Tuned Models

Mistake 1 - Treating It as an Extension of the Vendor Model Card

Article 25(1)(b) substantial-modification transfer makes the fine-tune a new product for which the deployer-now-provider must produce a complete model card. The vendor card is one input among many; the fine-tune card is a new artifact with its own Annex IV §2(a)-(h) coverage.

Mistake 2 - Skipping Mitchell-et-al. Sections

All nine Mitchell-et-al. sections are operationally relevant. Skipping "Factors" or "Quantitative analyses" leaves the model card weak on the fairness and bias-monitoring evidence that regulators and auditors will ask for.

Mistake 3 - Skipping Intersectional Quantitative Analysis

Single-attribute analysis can mask intersectional disparities. NYC LL 144 references intersectional analysis as best practice. Mitchell-et-al. Section 7 explicitly calls for it. Skipping it costs the model card credibility with auditors and litigators.

Mistake 4 - Listing Risks Without Naming Residual-Risk Acceptance

Mitchell-et-al. Section 8 (ethical considerations) is not just risk enumeration. It requires naming the mitigation and the residual-risk acceptance posture. Listing risks without acceptance posture leaves the regulator asking "and then what?"

Mistake 5 - Skipping Article 25(2) Cooperation Evidence

Article 25(2) requires the original provider to cooperate with the new provider by providing technical-documentation access. Cooperation evidence should appear in the fine-tune model card: the inter-company memorandum, the quarterly coordination cadence, the incident-coordination clause.

Mistake 6 - Treating the Model Card as Static

Quarterly refresh + triggered updates on substantial-modification events, vendor model-card updates, Commission interpretive notes, evaluation-result changes. A static model card from 2025 in mid-2026 is stale and audit-defensible-only with a current refresh.

Key Takeaways

• A fine-tuned foundation model triggers Article 25(1)(b) substantial-modification transfer. The deployer becomes the provider; full Article 16 obligations attach; the fine-tune needs its own complete model card.
• Mitchell et al. (2019) nine sections map to EU AI Act Annex IV §2(a)-(h) expectations. Model details, intended use, factors, metrics, evaluation data, training data, quantitative analyses, ethical considerations, caveats and recommendations.
• For fine-tunes in 2026, add three sections beyond Mitchell-et-al. Article 14 human-oversight design, Article 15 robustness/cybersecurity with OWASP/ATLAS coverage, Article 25(2) cooperation evidence with upstream provider.
• The model card serves multiple audiences. Regulators (Annex IV §2(b)); auditors (ISO 42001 A.8); internal developers/operators (Mitchell-et-al. usability). One document, three audiences.
• Cross-walks make the model card the L2 exemplar of evidence efficiency. One document satisfies EU AI Act + NIST AI RMF + NIST AI 600-1 + ISO 42001 + OWASP/ATLAS simultaneously.
• Intersectional quantitative analysis is best practice. NYC LL 144 references it; Mitchell-et-al. Section 7 calls for it; regulators and auditors expect it.
• Ethical considerations must name residual-risk acceptance. Not just risk enumeration; the mitigation + the residual-risk acceptance posture per risk.
• Article 25(2) cooperation evidence belongs in the model card. Inter-company memorandum with upstream provider, quarterly coordination, incident-coordination clause.
• Publication scope and retention are explicit. Internal full access; customer-facing summary; regulator-facing full version on request; Article 18 retention (10 years for high-risk).
• The model card is a living document. Quarterly refresh + triggered updates on substantial-modification events, vendor updates, Commission notes, evaluation changes.