AI Platform and Security · Whitepaper

Chapter 5 · Foundations

AI Decision Records, Model Cards and the Architecture Repository

Key insights from Chapter 5 of "AI Platform and Security"

Author Conceived and directed by Gunnar Nordqvist; text written by AI agents under his direction.
Published 1 November 2026
Build number 2026.11
devsecmlops ai-security agentic-architecture digital-sovereignty
Figure 5.1: An AI Decision Record travels through the same pull-request workflow as code, gathers its companion artefacts (model card, datasheet, system card and risk register), and feeds the generated technical documentation.
Figure 5.1: An AI Decision Record travels through the same pull-request workflow as code, gathers its companion artefacts (model card, datasheet, system card and risk register), and feeds the generated technical documentation.

Chapter 4 described what an AI estate should consist of; the decisions that shape any particular system within it need a record of their own. This chapter extends the Architecture Decision Record (ADR) to AI systems and shows how the record, the model card, the datasheet, and the system card together form an architecture repository from which the technical documentation demanded by Article 11 and Annex IV of Regulation (EU) 2024/1689 can be generated rather than written by hand. It builds on Architecture as Code (Chapters 4 and 22) (72, Nordqvist, 2025).

Michael Nygard's original proposal for documenting architecture decisions was deliberately minimal: context, decision, consequences, and a status, stored as short text files alongside the code (40, Nygard, 2011). Architecture as Code adopted that format and added a review workflow, YAML front matter, and review dates so that the record could be validated in a pipeline (72, Nordqvist, 2025). That template remains the right starting point, but it is not sufficient for AI, for three reasons.

First, the most consequential component of an AI system, the model, does not stay fixed once chosen: it is derived from data, retrained, and degrades as the world changes. A record that captures the decision to use a model without stating its data and the evaluation criteria it must continue to meet documents a moment rather than a commitment.

Primary topics explored

  1. Why decisions about AI need a different record
  2. The AI Decision Record template
  3. Model cards and datasheets as version-controlled companions
  4. The system card for compound systems
  5. The architecture repository as the single source of truth
  6. Summary

About AI Platform and Security

AI Platform and Security is Book 3 of The Transformed Architecture. It shows how large European enterprises and public authorities build, secure and operate the platform on which artificial intelligence runs: data, models and DevSecMLOps, retrieval and agents, infrastructure and sovereignty, AI security engineering, evaluation, observability and cost.

The companion volume AI Governance covers risk management, governance, assurance, organisation and leadership; Architecture as Code supplies the underlying discipline.

Who should read this

Platform engineers, security architects, MLOps teams, AI architects and technical decision-makers.

Portrait of Gunnar Nordqvist

Gunnar Nordqvist

Conceived, directed and published the books of The Transformed Architecture.

Continue with the full chapter

Read the full chapter online

Chapter 5: AI Decision Records, Model Cards and the Architecture Repository in AI Platform and Security gives the detailed explanations, practical examples and implementation patterns behind this summary.

This whitepaper belongs to “Foundations” and is one of 29 drawn from the manuscript.