REFERENCE · §7 · LAST REVIEWED 2026-04-27

ACF §7 — Operational Resilience

Agent operational resilience covers the firm’s capacity to continue regulated services — and to rollback or compensate for in-flight actions — when the agent stack experiences degradation, provider outage, or unanticipated behaviour, mapped to the firm’s impact-tolerance commitments.

A foundation-model provider outage is now an operational-resilience scenario. So is a model-version cutover that changes behaviour mid-day. Agent operational resilience extends FCA SYSC 15A and DORA Article 24 with agent-specific scenarios: provider outage, prompt-injection-induced lockup, runaway tool-call loop, model-version drift mid-action. The framework section requires impact-tolerance assessment per regulated business service, scenario testing, and documented fallback paths.

Regulatory anchors

• FCA SYSC 15A
• DORA Art. 24-26
• BCBS 239 (proxy)
• EU AI Act Art. 17
• ISO 22301 (proxy)

What this covers

• Impact-tolerance per regulated business service touching the agent
• Provider-outage scenarios and tested fallback
• Mid-action degradation runbooks
• Manual-mode service continuity
• Resilience drill cadence and lessons-learned cycle

Common gaps

• Impact-tolerance assessment never extended to AI-mediated services
• Fallback path documented but never tested
• Manual-mode service is technically possible but staff are not trained
• No drill cadence — first time is the real outage

Related sections

• §5 — Vendor Due Diligence

  Foundation model providers, MCP servers, tool authors — third-party risk for the agent stack.

• §6 — Performance Monitoring

  Drift, hallucinations, and other performance regressions that produce regulatory breaches.

• §4 — Reversibility

  Capability to unwind agent-mediated actions within a defined window.

• §12 — Incident Response

  When the agent does the wrong thing — runbook, regulator notification, customer remediation.

Reference compiled by Sebastian Heine. Editorial perspective at The SHeine Brief.