<!-- Product AI system card · from Chapter 33 of The Product 360 Handbook -->

# System card · [Product or feature] · v[n] · [Date]

Audience: customer security, compliance and admins. Every claim must be confirmed by its engineering owner.

## Overview
- What the system does and for whom:
- Intended purpose and prohibited uses:
- Our role and the customer's role (EU AI Act):

## Models
| Use | Model and version | Provider | Hosting region | Provider documentation |
|---|---|---|---|---|
| | | | | |

## Data flows
- Data the system reads, from where (connectors, MCP servers):
- What is stored, where, for how long:
- Training on customer data: [default and options]
- Sub-processors:

## Tools, permissions and autonomy
| Action class | Permission scope | Autonomy level (suggest / approve / autonomous) | Who can change it |
|---|---|---|---|
| | | | |

## Evaluation
- What we test, how often, and on what data:
- Current results (headline metrics and slices):
- Red-team scope and date of last exercise:

## Known limitations
-

## Human oversight and controls
- Approval gates, overrides, kill switch:
- Audit logs: fields, retention, customer access and export:

## Transparency to end users
- How users know content or actions are AI-generated:
- Content marking (if the system generates media or published text):

## Monitoring and incidents
- What we monitor in production:
- How customers report a problem; how we notify them:

## Change log
| Date | Change | Re-reviewed? |
|---|---|---|
| | | |