Most AI projects fail after deployment — when model assumptions meet real-world complexity. A structured taxonomy of the seven most common failure modes, with diagnostic signals and mitigation strategies.
The model was trained on data from one distribution and is being asked to perform on data from another. This is the single most common production failure mode and is frequently invisible until significant downstream damage has occurred.
Diagnostic signals: Gradual performance degradation over weeks or months; model confidence scores remain high while accuracy falls; errors cluster on recently introduced data patterns (new product lines, new customer segments, regulatory language changes).
Mitigation: Implement continuous distribution monitoring using population stability index (PSI) or Kolmogorov-Smirnov tests on input features. Establish retraining triggers at defined drift thresholds. Maintain a holdout set that reflects current production data, not historical training data.
The model's outputs influence the data it will be trained on next. Over time, the model learns to predict its own prior outputs rather than the underlying ground truth. This is particularly common in recommendation systems, content ranking, and pricing models.
Diagnostic signals:Increasing homogeneity in outputs; diversity metrics falling over successive model versions; apparent accuracy gains that do not translate to business outcomes; human reviewers noting output is "becoming more predictable."
Mitigation: Introduce randomised exploration (epsilon-greedy or Thompson sampling). Maintain a counterfactual logging stream — record what the model would have recommended, not just what it did recommend. Evaluate on outcomes, not on agreement with prior model versions.
The humans in the loop stop engaging meaningfully with the AI's outputs. They approve recommendations by default, no longer apply independent judgment, and lose the domain expertise needed to catch errors. When the model eventually fails, there is no effective human backstop.
Diagnostic signals: Human review time falling without corresponding accuracy increases; approval rates approaching 100%; inability of reviewers to articulate why they approved a decision; staff turnover removing the last people who understand the underlying domain.
Mitigation:Introduce deliberate friction. Route a randomised sample of AI decisions to blind human review where the AI recommendation is hidden. Measure independent human accuracy on these samples. Set minimum review time thresholds. Maintain "human-only" case queues to preserve skill.
The model was trained to optimise a measurable proxy metric rather than the true business objective. It achieves high scores on the proxy while the actual objective degrades. This is Goodhart's Law in production: when a measure becomes a target, it ceases to be a good measure.
Diagnostic signals:Metric dashboards look healthy while business stakeholders report declining outcomes; model exploits loopholes in the training objective (e.g., maximising "clicks" by generating outrage rather than value); complaints about output quality that cannot be captured in automated metrics.
Mitigation:Define outcome metrics separately from optimisation metrics and track both. Conduct quarterly "metric audits" examining correlation between proxy and true objective. Include qualitative human assessment in the evaluation pipeline, not just quantitative metrics.
The AI component functions correctly in isolation but fails as part of a larger system. Failures propagate across service boundaries in ways that were not anticipated during development. In multi-agent systems, a single failing component can corrupt the outputs of all downstream agents.
Diagnostic signals: Errors that cannot be reproduced outside the production environment; incidents that start in one service and manifest in another; timeouts and retry storms causing amplified load; partial failures that produce silently incorrect results rather than explicit errors.
Mitigation: Implement circuit breakers between AI components. Define explicit interface contracts for every inter-service boundary (input schema, output schema, timeout policy, fallback behaviour). Run chaos engineering exercises specifically targeting AI component failures. Log AI outputs at every integration boundary.
The system was compliant at deployment but became non-compliant due to model updates, data changes, or regulatory changes. This is particularly acute for models operating under the EU AI Act, GDPR Article 22, or sector-specific regulations that impose ongoing obligations rather than point-in-time certification.
Diagnostic signals: Model update logs not reviewed by legal/compliance; no ongoing bias testing after initial deployment; regulatory landscape monitoring absent from operational processes; inability to produce an audit trail for a specific decision on demand.
Mitigation: Implement a compliance register for every production AI system, updated quarterly. Treat model updates as triggering a compliance review, not just a technical deployment. Maintain immutable decision logs meeting the audit trail requirements of applicable regulations. Assign a named compliance owner to every production AI system.
LLM-based systems produce confident, plausible-sounding outputs that are factually incorrect. In low-volume settings, hallucination is a nuisance. At production scale — hundreds of thousands of requests per day — it becomes a systemic risk. A 1% hallucination rate on a system processing 50,000 daily decisions produces 500 incorrect outputs every day.
Diagnostic signals: High confidence scores on demonstrably wrong outputs; inconsistent answers to semantically equivalent questions; citations to non-existent sources; downstream systems making decisions on hallucinated data without validation checkpoints.
Mitigation: Implement retrieval-augmented generation (RAG) with source attribution and verifiability constraints. Never trust LLM outputs directly in high-stakes decision paths — require a structured validation step. Monitor output consistency using adversarial prompt variants. Set human escalation thresholds based on confidence score distributions, not absolute values.
| Code | Failure Mode | Primary Risk | Key Mitigation |
|---|---|---|---|
| FM-01 | Distribution Shift | Silent accuracy decay | Drift monitoring + retraining triggers |
| FM-02 | Feedback Loop Collapse | Self-reinforcing errors | Counterfactual logging + exploration |
| FM-03 | Human Override Atrophy | No effective backstop | Blind review samples + skill maintenance |
| FM-04 | Latent Proxy Failure | Gaming the metric | Outcome vs. proxy separation |
| FM-05 | Integration Cascade | Cross-system propagation | Circuit breakers + interface contracts |
| FM-06 | Compliance Drift | Regulatory exposure | Compliance register + update reviews |
| FM-07 | Hallucination at Scale | Systemic incorrect outputs | RAG + validation checkpoints |
This record is maintained by PAI and free to cite. If something is wrong or missing, tell us. Corrections and source suggestions keep the record honest.