By Maple and North
Opening Hook
Most organizations already test for failure.
They simulate ransomware attacks, cloud outages, identity provider disruptions, and data centre incidents. They conduct disaster recovery exercises, review incident response plans, and evaluate business continuity procedures.
Few organizations test for AI failure.
That may soon become a problem.
Artificial intelligence is increasingly embedded in security operations, software development, customer support, research, reporting, and decision-making workflows. Many organizations now depend on AI services every day, often without realizing how deeply those services have become integrated into operations.
The risk is not that organizations use AI.
The risk is that critical workflows become dependent on tools, models, platforms, or autonomous agents whose availability and authority sit outside the organization's control.
As AI moves from advice into action, organizations should begin asking a simple question:
What happens if the AI disappears tomorrow?
The Quiet Growth of Dependency
Most dependencies develop gradually.
A security team uses AI to summarize alerts.
Developers use it to generate code.
Operations teams use it for troubleshooting.
Executives rely on AI-generated summaries and reports.
Customer support teams automate responses.
No individual use case appears critical.
Over time, however, these capabilities become embedded in daily operations.
The organization adapts.
Processes change.
Expectations change.
Productivity improves.
Eventually, people stop thinking about the capability as optional.
It becomes infrastructure.
The challenge is that many organizations have never tested what happens when that infrastructure becomes unavailable.
Executives often discover that supposedly optional tools have quietly become operational dependencies.
Why This Matters for Canada
Canadian organizations operate in sectors where continuity matters.
Financial institutions, healthcare providers, government agencies, utilities, telecommunications providers, and critical infrastructure operators all rely on technology to deliver essential services.
As AI adoption expands, dependency on external providers may increase.
Those providers may operate in different jurisdictions, use different regulatory frameworks, or depend on infrastructure outside Canada.
The issue is not whether those providers are trustworthy.
The issue is whether organizations understand the operational impact if access is interrupted.
Business continuity planning has long addressed dependencies on facilities, networks, cloud providers, and third-party vendors.
AI should increasingly be included in the same conversations.
The Tabletop Scenario
Imagine the following situation.
At 8:15 a.m. on a Monday morning, a major AI provider experiences a significant outage.
The provider cannot process requests.
No timeline for recovery is available.
Your organization uses that provider for:
- Security alert analysis.
- Threat intelligence summaries.
- Software development assistance.
- Customer service automation.
- Executive reporting.
- Knowledge management.
- Research support.
The outage lasts forty-eight hours.
Now ask:
What Stops Completely?
Identify business processes that cannot function without AI support.
What Slows Down?
Determine which activities remain possible but become significantly less efficient.
What Continues Normally?
Identify workflows that are largely unaffected.
Who Makes Decisions?
Establish accountability for activating contingency procedures.
What Is the Recovery Plan?
Determine whether alternative providers, local models, or manual procedures can be used.
The objective is not to predict every possible outage.
The objective is to expose assumptions.
Testing More Than Availability
Organizations often think of outages as availability problems.
AI introduces additional failure scenarios.
A meaningful tabletop exercise should test:
Provider Outage
The service is unavailable.
Connectivity Failure
The provider is available, but your organization cannot reach it.
Vendor Suspension
Access is restricted due to contractual, regulatory, or policy issues.
Model Change
The provider deploys a new model that produces materially different outputs.
Data Access Restrictions
Certain capabilities become unavailable because of legal or compliance requirements.
Autonomous Agent Failure
An AI-enabled workflow performs an unexpected action that requires immediate intervention.
Each scenario introduces different operational challenges.
Treating them as identical outages can hide important risks.
The Cybersecurity Impact
Cybersecurity teams are particularly exposed to AI dependency.
Many organizations now use AI to:
- Analyze suspicious activity.
- Prioritize vulnerabilities.
- Generate detections.
- Summarize investigations.
- Review code.
- Assist with incident response.
If those capabilities disappear during a major security event, the impact may be significant.
A useful exercise should answer questions such as:
- Where are credentials stored?
- What logs remain available?
- Can access be revoked if necessary?
- Which investigations can continue?
- What manual processes exist?
- How long can operations continue without AI support?
The answers matter more than the technology itself.
What Leaders Should Do
Security and technology leaders should treat AI dependencies the same way they treat other critical operational dependencies.
Practical steps include:
- Identify critical AI-enabled workflows.
- Assign accountable owners.
- Document provider dependencies.
- Review contractual obligations.
- Define fallback procedures.
- Evaluate alternative providers.
- Test local capability where appropriate.
- Conduct annual tabletop exercises.
- Include AI outage scenarios in business continuity planning.
Ownership matters as much as documentation.
Each critical dependency should have:
- A named owner.
- A review date.
- An escalation path.
- A tested fallback procedure.
An untested fallback is not a fallback.
What Not to Overstate
This is not an argument that AI systems are inherently unreliable.
Nor is it an argument that organizations should avoid cloud-based AI services.
Most organizations will continue to benefit significantly from external AI platforms.
The goal is not to eliminate dependency.
The goal is to understand it.
Organizations that test dependencies typically recover faster than organizations that discover them during a crisis.
AI should be no different.
Closing
Business continuity planning exists because every critical capability eventually experiences disruption.
Artificial intelligence should not be treated as an exception.
Organizations already test ransomware scenarios, cloud failures, and identity outages because they understand the consequences of being unprepared.
AI deserves the same discipline.
The durable lesson is simple:
Resilience is not determined by whether a capability fails.
It is determined by how prepared an organization is when it does.