Data, Model, Interface, Agent: What AI Governance Looks Like in Legal Practice

Governance tends to get discussed at altitude: principles, frameworks, commitments, the occasional policy paper. At some point it has to come down and touch the system, living in a document that someone can open, review, and act on. That is the job of AI documentation cards.

A documentation card is a structured, single-page artifact that records the governance-essential facts about one component of an AI system. It captures what a system does and where its limits sit. Four card types cover the layers of a deployment: the data, the model, the interfaces, and the agents. Together they form the technical documentation layer of any serious governance program.

For legal work, the stakes raise these cards from good practice to necessity. A wrong AI output can produce a malpractice claim, a sanction, or harm to a client who trusted the firm to get it right. The four cards are the working evidence that a firm knows what its AI is doing and can answer for it.

The Dataset Card: Knowing Where the Data Came From

Every AI system learns from data. A Dataset Card documents the data that flows into and through the system: where it came from, how it was processed, what it contains, and the constraints that govern its use.

The core elements are consistent across systems: lineage and provenance (the chain of custody from original source to training set), quality characteristics such as completeness, accuracy, and representativeness, privacy and sensitivity classifications, usage permissions and jurisdictional restrictions, and the mechanism by which the dataset gets refreshed over time.

These map directly onto a supervising attorney's obligations. Before certifying work product produced with AI assistance, a lawyer has to be able to account for the inputs behind it. Model Rule 1.1 treats competence as including the technology a lawyer relies on, and a Dataset Card is what turns that competence into something documented rather than assumed.

The Model Card: What the System Does and Does Not Do

A Model Card is a short, structured report that travels with an AI model. It sets out the intended use, the data the model was trained on, how it performs across different groups and conditions, and, most importantly, its known limitations.

The Model Card began as a transparency tool, built so that developers, users, and regulators could understand how a model should and should not be used. In practice it tells a practitioner where the vendor's marketing claim ends and the model's reliable behavior begins.

Several jurisdictions now require this kind of disclosure. New York City's Local Law 144 mandates bias audits for automated tools used in employment decisions. The EU AI Act imposes technical documentation duties on high-risk AI systems, a category that reaches many legal applications. Where those regimes apply, a Model Card stops being good hygiene and becomes a compliance record the firm may have to produce.

The Interface Card: Securing the Point of Contact

An Interface Card documents the surfaces through which an AI system is reached. That includes human-facing surfaces such as dashboards, chatbots, and client portals, and machine-facing surfaces such as APIs, service endpoints, and integrations with other platforms.

Of the four, the Interface Card is the most security-focused. It captures authentication and authorization controls, input validation, the privacy implications of whatever the interface exposes or transmits, and the human usability factors that determine whether practitioners use the system correctly under pressure.

The Interface Card surfaces these risks before they become incidents. It feeds the threat-modeling session and gives a security review its starting checklist. When a firm later has to account for how client data was protected, that same card is the record of due diligence.

The Agent Card: Governing AI That Acts

The Agent Card is the newest of the four and the one gaining importance fastest. It documents AI agents, the components of a system that take action on their own: searching, drafting, filing, communicating, or triggering other processes without step-by-step human direction.

An Agent Card captures five governance-essential elements: the agent's scope of authority (what it can and cannot do without human approval), its impact radius (how far its actions reach), its failure modes and fallbacks (how it degrades when something breaks), its resource-consumption limits, and the oversight mechanisms that keep human control meaningful.

The Agent Card makes that scope of authority explicit and auditable. It lets a firm demonstrate, rather than simply assert, that meaningful human oversight stayed in place while the agent was working.

From Principles to Records

Principles and commitments matter, but on their own they do not produce accountability. Accountability shows up in documentation that reaches the system itself: the data it learned from, the model behind its outputs, the interfaces it is reached through, and the agents it puts to work on a client's behalf.

These four cards are working artifacts, used today by organizations building governance that can hold up under legal scrutiny, regulatory review, and a client's reasonable demand to know how AI was used on their matter. InGlobo AI helps legal organizations build governance at that level of operational detail, so the program lives in the system and not only on paper.