In many companies, AI has gone from experiment to everyday tool in a short time. Quotes are prepared with it, faults analysed, documents summarised. It rarely appears in the emergency plans yet. They list the data centre, the network and the ERP, but not the AI service that half a process now depends on.
New dependencies, old question
Business continuity starts with a simple question: which processes are critical, and what do they depend on? AI adds dependencies that are easily overlooked:
- The service itself. A cloud model can fail, be throttled or be unreachable for a few hours.
- The model. Providers retire older models and replace them with new ones. What worked yesterday behaves differently after the switch.
- The data. If the data source that feeds a model fails, it delivers no results or wrong ones.
- The know-how. When a task is only ever done with AI, the team forgets how to do it without.
Add AI to the business impact analysis
The approach is the same as for any other dependency. The business impact analysis checks, for each critical process, which AI services it uses and what happens if they are missing. From this comes the question that management has to answer: how long can the process manage without the AI before the damage is no longer acceptable?
The answer decides the effort. An assistant that drafts texts can be missing for a day. An AI that sorts out parts in quality inspection perhaps not for an hour.
A fallback without AI
Every critical AI application needs a described way of working without it. That can be the previous manual inspection, a simpler rule-based method or a second provider. What matters is that this way is known, documented and practised now and then. A fallback that nobody masters any more only exists on paper.
AI management and business continuity belong together
An AI management system under ISO/IEC 42001 records which AI the company uses and who is responsible for it. A business continuity management system asks what happens when something fails. Connecting the two gives you the full picture: you know which AI exists, how important it is and what to do when it is missing.
What follows
- Record AI services as dependencies, in the business impact analysis like any other system.
- Decide for critical processes how long they can manage without AI.
- Describe and practise a fallback.
- Cushion model changes at the provider contractually and organisationally.
The more AI becomes routine, the more important the answer to the question of how things carry on without it.