When an AI API Goes Down: Design a Manual Fallback Before You Need It

Map critical dependencies

List model API, networking, identity provider, search index, vector database, content filters, third-party tools and human escalation systems. Understand whether failure is total, partial or silently wrong. An assistant responding confidently with stale retrieval is often more dangerous than an explicit outage.

Define the business minimum

Choose which tasks must continue manually, which can queue and which should stop. Create simple read-only access to authoritative documents and trained staff procedures. Make sure agents cannot keep executing partially completed workflows after a safety circuit opens.

Test degraded modes

Simulate timeout, unavailable provider, budget exhaustion, rate-limit spike and bad release. Measure recovery time and correctness of queued operations; avoid duplicate payments or repeated external messages. OWASP LLM10 notes that uncontrolled inference can cause denial of service and financial exhaustion.

Be transparent to users

If AI suggestions are unavailable, say so, disclose whether work was saved and present an alternative path. Do not invent completions or tell a user an action succeeded before downstream systems confirm. In high-stakes settings preserve the last human-verifiable source of truth.

Exercise

A public hotline relies on a voice assistant. When transcription fails, the system offers a staffed line, preserves only necessary context with consent and does not generate guessed emergency instructions. Quarterly failover drills verify telephone, staffing and message routing rather than just API availability.

Evidence checked 25 October 2026. Applicability: Global. This material is general education, not legal, medical, investment or other professional advice. No vendor performance test is implied.