Why your AI fallback is more dangerous than the failure
When AI fails hard, someone gets paged. When it fails softly with a fallback, the system keeps serving bad results and nobody notices.
Hard failure vs silent fallback
One gets fixed. The other runs for weeks.
AI classification service
Something goes wrong...
Fixed in 90 min
Runs for 6 weeks
The most dangerous failure is the one your dashboard says is fine.
When an AI system fails, most teams have a fallback. The model times out, so the system returns cached results. The classification service is down, so requests skip classification entirely. The recommendation engine is slow, so it returns the most popular items instead.
These fallbacks feel safe. They are not.
The problem is silent degradation. When the AI service fails hard with a 500 error, someone gets paged. When it fails softly with a fallback, the system continues to serve requests. The metrics stay green. Users get worse results but the monitoring does not catch it because the monitoring measures availability, not quality.
I worked on a system where the AI classification service had a 2-second timeout. When it hit the timeout, the system fell back to a rule-based classifier that was built two years earlier. In theory, this was a safe fallback. In practice, the rule-based classifier was trained on categories that no longer existed. 23% of requests were being misclassified silently. It ran like this for six weeks before anyone noticed.
This is a governance failure, not a technical one. The fallback existed. It was tested. It was documented. But nobody asked what happens when the fallback runs for days instead of seconds.
Nobody monitored the gap between AI output quality and fallback output quality. The fix is straightforward but requires a mindset shift.
- Treat fallback paths as their own system with their own SLOs
- Monitor the ratio of primary to fallback responses. If fallback exceeds 5%, alert.
- Track output quality metrics separately for AI and fallback paths
- Set a maximum fallback duration after which the system degrades visibly rather than silently
- Run game days that simulate extended AI outages, not just momentary ones
The safest fallback is the one that tells you it is running. The most dangerous is the one that pretends everything is fine.
Get the next one in your inbox
One short, opinionated field note per fortnight on platform engineering, cloud, and making AI work in production. No spam. Unsubscribe anytime.
