For Heads-of · Practitioner
No impact tolerance for AI-dependent services
A business service that depends on an AI system has no defined impact tolerance for AI-specific disruption.
- high
- operational-resilience
- impact-tolerance
How it happens
Even where an AI dependency is known, the service's impact tolerance was set before the AI component existed, or was set for generic outages, so it doesn't specify a tolerable duration or severity for AI-specific failure modes like model degradation or vendor incident.
Why it matters
Without an AI-specific tolerance, there's no agreed threshold for when an AI issue becomes a resilience incident rather than a technical one to fix quietly, which slows exactly the escalation the framework exists to trigger.
Mitigating controls
The controls that address this risk, ranked by effectiveness.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| SS1/21: Operational Resilience | Impact tolerances | Impact tolerances |
Related resources
The external sources behind this risk, from the Resources library.