The AI Resilience Gap: Bringing Artificial Intelligence Inside the Operational Resilience Perimeter

AI governance currently focuses on trustworthiness but misses operational resilience: While frameworks like the EU AI Act and NIST AI Risk Management Framework address safety, fairness, and transparency, they don't adequately cover whether critical business services can continue operating if AI systems fail or become unavailable—a distinct regulatory gap the paper identifies.

Concentration of AI dependency poses systemic risk: The paper highlights that reliance on a small number of frontier model suppliers creates dangerous concentration risk similar to other critical infrastructure vulnerabilities, requiring explicit management of provider-level dependencies rather than just individual model risk assessment.

Financial regulators are already moving ahead: UK financial authorities are closing the resilience gap through mechanisms like the Critical Third Parties regime and a May 2026 joint statement on frontier AI and cyber resilience, suggesting that operational resilience requirements for AI may need to extend beyond financial services to other regulated sectors.

Organizations need explicit fallback plans for AI failures: The proposed AI Resilience Framework requires firms to establish clear fallback procedures and impact tolerances specifically for AI-related failure modes—not just general business continuity plans—recognizing that AI systems fail differently than traditional IT infrastructure.

Dependency mapping and tiering should become standard practice: The framework proposes that organizations systematically map their AI dependencies, tier them by criticality and substitutability, and manage them as they would other critical operational assets, bringing AI into existing operational resilience governance structures.