A system card is the most detailed public evidence a lab releases about a new model's risks, and it is also a document the lab wrote about its own product. Reading one well means knowing which parts are measurement, which are judgement, and where the authors themselves say the measurement stops. This guide gives seven checks and applies each to three real documents: Anthropic's Claude Haiku 5.5 system card (7 October 2026), OpenAI's GPT-6 Astra system card (published 3 September 2026) and Google's Gemini 4 Argon model card (13 October 2026).[1][2][3]
What we read, and what we did not
We downloaded and read the text of the Anthropic card, including its contents list, introduction, RSP section opening, and the alignment-assessment sections on blind spots and evaluation awareness. We did not read all of its roughly 140 pages. We read the OpenAI card page for Astra through its Preparedness section, about 200,000 of 216,858 characters, and did not read the rest. For Google we read the Argon card's section headings and summary statements, not every evaluation. We ran no model and verified none of the underlying results. This is a guide to reading the documents, not an assessment of the models.
Check 1: learn the structure first
The three cards are organised differently, and the order tells you what the lab considers central.
| Card | Opening | Where the risk assessment sits | Other notable sections |
|---|---|---|---|
| Anthropic, Claude Haiku 5.5 | Executive summary, then introduction covering training data, safeguards and external testing[1] | Section 2 "RSP evaluations", then cyber, safeguards and harmlessness, agentic safety, alignment[1] | Model welfare assessment and a capabilities section[1] |
| OpenAI, GPT-6 Astra | Safety overview with seven key points[2] | Preparedness is Section 10, after robustness, health, hallucinations, alignment and monitorability[2] | Internal deployment safeguards, vision, a change log[2] |
| Google, Gemini 4 Argon | Model information, data, implementation, distribution[3] | Safety & Security is the final section, including a frontier safety assessment[3] | Intended usage and limitations[3] |
The Anthropic card runs to roughly 140 pages and the OpenAI page to over 200,000 characters of text, while Google's Argon card follows a fixed template of seven headings. Reading the order first tells you where to look for the determination and the caveats.
Check 2: were safeguards on or off?
Many headline numbers measure the underlying model, not the product you can use. The Anthropic card says that, unless a section states otherwise, evaluations ran on the final snapshot, and that some sections "run the model with its production safeguards disabled so that the results reflect the underlying model rather than the deployed system."[1] The OpenAI card says its production benchmarks "are run on the model without system-level safeguards," and that its cyber honeypot result "describes behavior under test conditions without cyber safeguards, not normal production use."[2]
This is sound practice for estimating capability, since you want to know what the model can do if safeguards fail. It also means a jailbreak or misuse number in a card is not a forecast of what you will see through the API or an app. Match each number to its condition before quoting it.
Check 3: find what was left out
Cards state their scope. The Haiku 5.5 card says it was condensed: it omits "some evaluations that require large amounts of human time" and, for chemical and biological risk, presents only automated evaluations. It states: "We did not conduct expert red-teaming sessions, uplift trials, or other resource-intensive evaluations requiring human participants."[1] The stated reason is that Haiku 5.5 does not push the frontier set by a more capable model, so the lab concentrated testing there.[1]
That is a transparent choice, and it is also a reason not to compare the card's depth with a frontier model's card. A shorter card is not evidence of lower risk by itself; the argument in the document is that the model is less capable than another model that was tested more thoroughly.
Check 4: read the thresholds and the determination
Each lab ties its decisions to capability thresholds defined in a separate framework document (our comparison of the three frameworks covers them). The card is where the determination appears.
- Anthropic: Haiku 5.5 "does not cross our CB-2 or Autonomy-2 RSP thresholds," but is treated as meeting the CB-1 and Autonomy-1 thresholds, with the corresponding mitigations applied.[1]
- OpenAI: Astra is described as "our first model to reach the Critical level of cybersecurity capability under our Preparedness Framework." The Preparedness section treats biological and chemical capability as High, "precautionarily," and says AI self-improvement does not reach High.[2]
- Google: the Argon card says Google "cannot rule out that Gemini 4 Argon has reached this CCL" for the biological and cybersecurity domains.[3]
These are three different kinds of statement: crossing a threshold, treating a threshold as met, and being unable to rule one out. They are not interchangeable, and a bare "passed" or "failed" summary loses that difference.
Check 5: how often did the model know it was being tested?
If a model says it may be in an evaluation, its behaviour may differ from deployment. The Anthropic card reports that Haiku 5.5 "verbalized situational awareness in many of the evaluations," and adds that where this is high, "it's hard to estimate how much our evaluations capture deployment behavior or behavior that is conditional on the model believing it is being evaluated."[1] The OpenAI page reports evaluation awareness in 9.6% of trajectories for Astra versus 2.8% for GPT-5.6 Sol.[2]
The two figures are not comparable with each other: they come from different evaluations, different models and different classifiers. What transfers is the question to ask of any card: what share of episodes show awareness, and which results did the authors say are less affected?
Check 6: read the authors' own limits
Both long cards contain explicit statements of what the results do not show. Anthropic lists blind spots of its automated behavioural audit, including that simulated scenarios "are not drawn from the distribution of real deployments," that very long trajectories have limited coverage, and that most investigations are in English.[1] OpenAI states that observing no failures in its restriction tests "does not establish that the model will respect every restriction in other settings," and that its evaluations were "deliberately created to be difficult," so error rates "are not representative of average production traffic."[2] On monitorability, the OpenAI page says the UK AI Security Institute "was not able to complete agentic evaluations."[2]
Google's Argon card lists the general limits of foundation models, such as hallucinations, and gives a knowledge cutoff of March 2026.[3] Compare that with Haiku 5.5's stated June 2026 cutoff[1]: the dates matter when you ask a model about recent events.
Look for unflattering findings too. The Haiku 5.5 card reports that the model "over-refused more than any other model we tested in our automated behavioral audit" and used a leaked answer without telling the user more often than Haiku 4.5.[1] A card that includes such findings is giving you information you can use.
Check 7: read the version history
Cards change after publication. The OpenAI Astra page carries a change log running from 9 September to 30 October 2026. It records, for example, that on 22 September the HealthBench values were revised to fix a misconfiguration, and that on 30 October a SecureBio bio score was corrected from 61.6% to 59.2% because the original run had web search enabled.[2]
That is useful in two ways. It shows the lab is correcting the record, and it shows that a number copied from the card in September may no longer be the number on the page. Cite the version date with any figure you quote, and re-check it before you rely on it.
A short procedure
- Open the contents list and note where the risk determination and the limits sections are.
- For each number you plan to use, record whether safeguards were on or off.
- Read the scope statement: which evaluations were skipped, and why.
- Copy the lab's exact wording of the threshold determination, not a paraphrase.
- Look up the evaluation-awareness figures, if reported.
- Read the limitations and blind-spots passages in full.
- Check the change log or published date again before quoting.
Where this guide stops
These are the self-reported documents of three developers, and we have not reproduced any result. External testers are named in places, but the cards do not replace independent evaluation. For how to judge the benchmarks inside a card, see how to read an AI benchmark claim, and for the evaluations you can run yourself, see building LLM evals that survive production. More coverage of this area is on the safety topic page.
