The AI Resilience Gap: Bringing Artificial Intelligence Inside the Operational Resilience Perimeter

Jul 16, 2026

Upload by Quinn

Rapid adoption of artificial intelligence in regulated firms has triggered extensive governance focused on trustworthiness, including the EU AI Act, ISO/IEC 42001, the NIST AI Risk Management Framework, and the UK’s principles-based approach. That response addresses safety and model risk but remains incomplete because it does not cover operational resilience: continuity of important services under severe disruptions, dependency substitutability, and provider concentration. The paper presents an AI Resilience obligation distinct from trustworthy-AI governance, maps regulatory logics, identifies a structural gap, and proposes an AI Resilience Framework to bring AI dependencies inside the operational resilience perimeter.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages11

Reading Time28 min

Introduction

Trustworthiness vs operational resilience

Central argument and UK efforts

arXiv :2607 .07359v 1 [ cs .CR] 8 Jul 2026 The AI Resilience Gap: Bringing Artificial Intelligence Inside the Operational Resilience Perimeter Jonathan Shelby Department of Computer Science, University of Oxford Hertford College, Oxford, United Kingdom July 2026 Abstract The rapid adoption of artificial intelligence across regulated firms has produced an extensive governance response oriented around trustworthiness: the EU AI Act, ISO/IEC 42001, the NIST AI Risk Management Framework, and the United Kingdom’s principles-based approach all address safety, fairness, transparency, and model risk. That response is necessary but incomplete. It does not, on its own, address operational resilience: the continuity of important business services under severe but plausible disruption, the substitutability of AI components, and the concentration of dependency on the small number of firms that supply frontier models. This paper argues that AI adoption creates a resilience obligation that is distinct from, and inadequately covered by, the trustworthy-AI stack, and that United Kingdom financial authorities are already closing this gap through the Financial Policy Committee’s systemic analysis, the Critical Third Parties regime, and the May 2026 joint statement on frontier AI and cyber resilience. We map the two regulatory logics, identify the structural gap between them, and propose the AI Resilience Framework: a regime-agnostic method for bringing AI dependencies inside the operational resilience perimeter through dependency mapping, a criticality-substitutability tiering, the extension of impact tolerances to AI-specific failure modes, an explicit fallback doctrine, and provider-level concentration management. The framework gives chief information security officers, security architects, and boards an actionable route from AI governance policy to demonstrable resilience. This work extends a companion analysis of the United Kingdom cyber resilience regulatory stack [1] into the artificial intelligence dimension. Keywords: artificial intelligence, operational resilience, EU AI Act, DORA, Critical Third Parties, concentration risk, impact tolerance, model risk, financial services 1. Introduction Artificial intelligence has moved from pilot to production across United Kingdom financial services. The third Bank of England and Financial Conduct Authority survey of AI in the sector, published in November 2024, reported that around three quarters of firms were already using AI, with a further tenth planning adoption within three years, and that foundation models, including large language models, already accounted for roughly a sixth of use cases [2] . A majority of use cases involved some degree of autonomous decision-making, even though only a small fraction were described as fully autonomous. The direction of travel is unambiguous. AI is no longer confined to marketing analytics and back-office productivity; it is entering credit decisioning, transaction monitoring, trading, and the operation of customer-facing services that firms are obliged to keep running. The regulatory and standards response to this shift has been substantial. At the European level, the AI Act establishes a horizontal, risk-tiered regime for AI systems and general-purpose models [3] . Internationally, ISO/IEC 42001 provides a certifiable managementsystem standard for AI [4], and the NIST AI Risk Management Framework offers a voluntary structure for identifying and managing AI risks, extended in 2024 by a profile for generative AI [5, 6] . In the United Kingdom, financial regulators have chosen a principles- based, technology-neutral path, declining to introduce AI-specific rules and instead relying on existing frameworks such as the Consumer Duty, the Senior Managersand Certification Regime, model risk management expectations, and operational resilience requirements [7, 8] . These instruments share an orientation. They are concerned, first and forem

FAQs

What gap does the paper identify between AI governance and operational resilience?

Trustworthiness-focused governance does not address whether important business services survive severe but plausible disruptions, including AI dependency concentration and lack of substitutability. The paper argues this creates a distinct resilience obligation not covered by the trustworthy-AI stack.

How does the paper characterize a severe resilience liability created by AI adoption?

It describes a scenario where an AI system can be trustworthy while still creating a severe resilience liability through a single, unsubstitutable dependency on an external frontier model provider embedded in an important service.

What does the proposed AI Resilience Framework aim to do?

It provides a regime-agnostic method to bring AI dependencies inside the operational resilience perimeter using dependency mapping, criticality–substitutability tiering, AI-specific impact tolerance extensions, an explicit fallback doctrine, and provider-level concentration management.

Jul 16, 2026

Upload by Quinn