#33

Unmet architectural requirements

Risk taxonomy

Definition

Inadequate architectural requirements due to technology, cost or people constraints, leading to technical debt and hindering scalability, robustness and long-term viability of the Gen AI system.

Controls & guardrails that address this

Grouped by control function, with the AI lifecycle stage(s) to apply each and the other risks it addresses. Filter by control category below.

Control category

Preventive · 3

Non-functional performance requirements at design

Define non-functional requirements (latency, throughput, scalability) for the AI system at design stage.

Lifecycle stage1 – Use Case Context & Design

Modular architecture

Design and implement a modular AI architecture meeting all S1-defined NFRs. Validate against each requirement before deployment.

Lifecycle stage3 – Onboarding, Build & Review

Also addressesModel Drift & Silent Degradation

Small model selection

Select a model architecture sized appropriately for platform constraints (memory, compute, latency).

Lifecycle stage3 – Onboarding, Build & Review

Also addressesHallucination

Detective · 1

Robustness testing

Perform final NFR compliance tests in the production environment before go-live. Block deployment if any NFR is unmet.

Lifecycle stage4 – Deployment

Also addressesHallucination Overreliance / Automation Bias Model Drift & Silent Degradation

Corrective · 1

Robustness testing

Monitor production NFR compliance continuously. Conduct periodic architecture health checks and escalate when SLAs are breached.

Lifecycle stage5 – Usage, Monitoring & Change

Also addressesHallucination Overreliance / Automation Bias Model Drift & Silent Degradation

Open these in the Control Library →

Other risks in Robustness & Stability

#24 Hallucination / Fabrication / Confabulation #25 Overconfidence #26 Training data or inputs not fit for purpose #27 Lack of continuous monitoring #28 Insufficient data quality #29 Model staleness #30 Insufficient model accuracy / soundness #31 Model degradation from unexpected use #32 Inadequate operational resilience #34 Lack of reproducibility #44 Disruption to connected systems