Fallback plans fail when they exist only as architecture diagrams. Teams need drills that prove the system can move between providers, cached answers, degraded mode, human review, and temporary shutdown.

Run drills against realistic incidents: provider outage, latency spike, cost runaway, unsafe response pattern, and evaluation regression after a model update. Each drill should produce evidence that routing, alerts, customer messaging, and rollback instructions work.

A mature model-ops function treats fallback as a rehearsed operating capability, not a last-minute engineering scramble.