For Heads-of · Practitioner
Impact Tolerance
The maximum tolerable level of disruption to an important business service, set under the UK operational resilience regime. Applied to AI, it asks how long a firm can run without an AI component, or with one that is wrong, before customers or markets suffer intolerable harm.
- operational resilience
- impact tolerance
- important business services
- SS1/21
- financial services
The regime
The PRA (in SS1/21), the FCA and the Bank of England require firms to identify their important business services, set an impact tolerance for each, map the people, processes, technology and third parties behind them, and test that they can stay within tolerance in severe but plausible scenarios. Firms had to be able to remain within their tolerances by 31 March 2025.
Why AI changes it
An AI component can fail without going down: a fraud model that silently degrades, a chatbot giving wrong answers at scale, a vendor model that changes behaviour overnight. A tolerance expressed only as downtime misses these. The mapping also has to reach the AI vendors and model providers behind each service, which is where AI not mapped to important business services usually starts.
What good looks like
Every important business service that depends on AI names the component, its fallback, and a tolerance that covers degraded as well as absent operation. The register's no impact tolerance for AI-dependent services is the gap; important business service impact-tolerance mapping is the control.
Sources
Related Terms
AI Inventory
A maintained register of every AI system, model and AI-enabled feature an organisation uses, builds or buys, with an owner, a purpose, a risk tier and a status for each. It is the first control in every AI governance framework because none of the others can be applied to a system nobody has listed.
Critical Third Parties Regime
The UK regime under which HM Treasury can designate a third party whose services are critical to the financial sector, bringing it under direct oversight by the Bank of England, the PRA and the FCA. Its rules have applied since 1 January 2025, and the first designations, in July 2026, were four cloud providers.
PRA SS1/23
The Prudential Regulation Authority's supervisory statement setting out five principles for model risk management at UK banks. It took effect on 17 May 2024, applies to AI and machine learning models as to any other model, and was amended in April 2026.
Risk Appetite
The level and types of risk an organisation is willing to accept in pursuit of its strategic objectives. Applied to AI, a single organisational posture is rarely enough: appetite has to be set separately across distinct risk dimensions and tiers of decision consequence.
Third-Party Risk
The exposure an organisation carries through dependencies on external parties who build, train, host or operate the AI systems it uses. In AI the exposure is characteristically deeper than the contract: beneath most vendors sits a model provider, and beneath that an infrastructure provider.