The document a buyer can demand is catching up with the model a buyer can rent. On July 30, 2026, NIST published an initial public draft, NIST AI 300-1, “Guidance and Templates for Public-Facing AI Documentation.” It is part of a Zero Drafts pilot announced in March 2025. NIST collects input on topics that already have a body of practice and writes a thorough preliminary standard, then hands it to the private-sector standards process. This draft covers documentation of datasets and models so that one organization’s paperwork is legible to the next. NIST’s plan is to submit the result through INCITS/AI, the U.S. committee for ISO/IEC JTC 1/SC 42. If that committee proposes it and SC 42 accepts, the text becomes an ordinary consensus project. NIST says it will be one voice in that room, not the owner of the finished standard.
The draft is voluntary, and it says so in the definitions. “Shall” means “required in order to claim you conform,” not “required by a U.S. rule.” “Should” is guidance. NIST writes that industry asked for this because ad hoc documentation wastes time on both sides of a transaction. A procurement team that has been inventing a security questionnaire for every model vendor is the audience, even though the document never uses the word “RFP.”
A second template, for what organizations do
The OECD’s Hiroshima AI Process Reporting Framework 2.0, launched May 28, 2026, asks a complementary question. Version 1 produced a first round of reports. Version 2.0 is built so smaller firms can participate, and so the questions follow an organization’s role: model developer, application developer, or deployer. It connects to the OECD.AI catalogue of tools for trustworthy AI. It explicitly keeps pace with agentic systems. Submissions are rolling. Reports filed by September 30, 2026, were in line for the next analytical review. The overview page limits participation to organizations in OECD members, GPAI members, or adherents to the OECD AI recommendation. It is not a universal filing. It is the closest thing to a shared public narrative of practice that an international body is currently collecting.
Put the two templates side by side and the buyer’s file writes itself. NIST AI 300-1 is about the artifact: dataset and model documentation a third party can read. HAIP 2.0 is about the organization: which role you play, which risks you manage, which tools you use, including when the system is an agent. Neither is a European conformity assessment, and neither replaces the FDA’s device summary or the NAIC’s governance expectations. They are the cross-sector packets that sit underneath those sector files.
General-purpose models already have a public-summary duty in Europe
The European Commission’s AI Act materials add a third packet for a narrower set of companies. Providers of general-purpose models have had duties since August 2, 2025, with Commission enforcement powers from August 2, 2026. One instrument is a template for a public summary of training content: sources, large datasets, top domain names, and enough processing detail for people with legitimate interests to exercise their rights. A buyer who will never file that summary will still receive it, or fail to receive it, from the vendor whose model sits under the application. Absence is information.
NIST’s separate agent work, announced February 17, 2026, says identity and authorization are unsolved. HAIP 2.0’s choice to include agents means a deployer can be asked how an agent is governed before a technical identity standard exists. Procurement can live in that gap. Ask who the agent acts as, what it may touch, how an action is logged, and which document — the NIST-style model card, the HAIP-style practice report, the EU training summary — the vendor will attach. If the answer is a slide, the templates exist so you can ask again in their shape.
The reason to start now is that both efforts are designed to escape the organizations that drafted them. NIST expects the zero draft to become someone else’s standard. The OECD expects reports to be published and compared. A vendor questionnaire written in a private dialect in 2024 will look eccentric next to a packet that a dozen other customers already recognize. Documentation is becoming infrastructure. The firms that treat it as a writing assignment at the end of implementation will be the ones filling it out under a deadline they did not set.