AI Exit ArchitectureGive six runways one accountable destination

The AI Exit Architecture is this article's synthesis. It treats exit as six coordinated runways that can advance at different speeds but must share one configuration, decision date and closure authority. A runway is not a workstream that can declare success alone. Each produces receipts consumed by the others. The technology team cannot revoke access until evidence custody and knowledge transfer are complete. Finance cannot close a licence while open decisions still require the old service. Operations cannot promise a manual fallback without staffing the resulting queue.

The decision and trigger runway records the cause, observation, evidence threshold, urgency, reversibility, legal duties, decision authority and go or no-go gates. It distinguishes a planned expiry from emergency containment and prevents legal termination from becoming the only operational signal. The service-continuity runway identifies critical outcomes, minimum service, degraded modes, affected populations, human capacity, open cases, fallback, recovery time and communication.

The asset and evidence runway governs data, outputs, feedback, prompts, retrieval, evaluations, logs, lineage, incident records, rights, retention, transfer and verified deletion. It preserves the ability to explain and challenge old decisions after live use ends. The technology and dependency runway covers models, tools, interfaces, identities, queues, integrations, infrastructure, upstream providers, substitutes, cutover, rollback and decommissioning.

The people and accountability runway assigns decision owners, exit leads, incoming and outgoing staff, supplier contacts, knowledge transfer, training, review queues, complaints, recourse and independent assurance. The commercial and value runway closes notices, transition assistance, fees, licences, claims, final acceptance, benefit reconciliation, stranded cost and reusable assets. It prevents a technically retired system from surviving as expense, risk or unsupported expectation.

Synchronisation occurs at four gates. At authorise, the trigger and interim posture are accepted. At ready, minimum service, assets, people, substitute and affected-party plans are evidenced. At cutover or retire, the old authority is constrained and the chosen mode begins. At close, every runway produces its final receipt or assigns a time-bound tail obligation to a named owner.

Exit Trigger MatrixStart operational preparation before legal termination

The Exit Trigger Matrix is this article's synthesis. It covers six families: planned expiry, consolidation or strategy change; persistent performance or value failure; safety, security, rights or regulatory events; supplier, subcontractor or concentration failure; economic discontinuity, price shock or funding withdrawal; and technology deprecation, incompatibility or loss of support.

For every trigger, record the observation, evidence threshold, decision authority, notice requirement, time available, interim posture, affected-party action, likely exit mode and reversal condition. A planned expiry may allow dual-running and careful cohort migration. A safety event may require immediate suspension before root cause is known. Supplier distress can justify early knowledge and asset transfer even while the contract remains in force. Persistent value failure can lead to full retirement when a simpler process produces a better verified outcome.

Trigger evidence should be strong enough for the consequence but not impossibly complete. Emergency containment can be pre-authorised when credible harm exceeds the cost of temporary suspension. Irreversible termination remains with accountable executives unless law requires otherwise. A pause, partial exit or scoped continuation can preserve lower-consequence uses while one population or purpose leaves the system.

Four Exit ModesName the destination before moving the service

The Four Exit Modes are this article's synthesis. Retire stops the AI capability because the underlying service is no longer needed or no longer creates value. Revert restores a non-AI or earlier workflow while preserving critical service and evidence. Replace moves to another model, component or provider through comparison, controlled cutover and rollback. Internalise or redesign brings capability in-house or changes the workflow so the rejected dependency is removed.

A model deprecation does not automatically imply replacement. The organisation may revert a consequential decision to staff while replacing only retrieval. A regulatory prohibition may remove one purpose and population while lower-consequence drafting remains. A persistently empty business case may favour retirement over migration. Mode choice follows the service obligation and recovery evidence, not organisational attachment to AI.

Exit mode can be composite. Retire an unsafe function, revert the critical workflow, replace a commodity component and internalise evidence custody. The control record must say which population, decision and configuration follows each route. Otherwise a “partial exit” becomes an ambiguous estate that nobody owns.

Minimum-Service BridgeSize the people who must carry degraded operation

Exit success is measured by preserved service and resolved cases, not the cutover date. Define the minimum outcome, eligible population, protection, evidence, maximum interruption, backlog ceiling and recovery objective. Then calculate the manual and technical capacity required for the transition window. An unstaffed fallback is a statement, not continuity.

Human demand can rise for three reasons: more cases require review, each review takes longer because the substitute provides less context, and appeals or replays arrive from the outgoing service. Capacity therefore includes trained reviewers, supervisors, specialists, complaint handlers and evidence custodians. When demand exceeds capacity, contract scope before exhausting controls. Fewer users or functions can continue safely while the high-consequence queue remains bounded.

Affected-party action belongs on the bridge. Communications should explain relevant service changes, delay, review, recourse and contact routes without overstating causal certainty. Emergency suspension can be protective when a staffed non-AI path preserves access and appeal. Temporary quality degradation is acceptable only inside an authorised envelope with monitoring and a recovery date.

Open-Decision Reconciliation LedgerDo not orphan the cases produced by the old system

The Open-Decision Reconciliation Ledger is this article's synthesis. Every case influenced by the outgoing configuration is classified as complete, pending, disputed, appealed, replay-required, notification-required, retained or deleted. Each entry binds decision and configuration version, evidence, owner, affected party, legal clock, disposition and closure proof.

Configuration identity matters after cutover. An appeal may require the prompt, retrieval source, model version, human action and policy that existed when the decision was made. Replaying every case under a new model can change evidence without resolving the original question. The ledger records whether the old evidence remains authoritative, whether a lawful replay is required, how differences are explained and which party owns correction.

Deletion follows reconciliation. Keeping everything indefinitely transfers ownership confusion into privacy and security risk. Deleting too early destroys recourse, investigation and claims evidence. The retention rule therefore comes from purpose, law, dispute state and agreed learning need, with a named deletion event and receipt. Exit remains open while consequential cases have no disposition.

Exit Readiness Drill and Closure PackExercise cooperation, then prove the tail is closed

The Exit Readiness Drill is this article's synthesis. Use a realistic trigger. Freeze the relevant configuration, invoke contacts, stand up minimum service, export and verify artefacts, activate the substitute or fallback, reconcile open decisions, communicate with affected groups, monitor transition outcomes, prove deletion and close residual licences and spend. Record actual time, human load, outcome degradation, missing evidence and supplier cooperation.

Do not assume the supplier remains helpful after dispute, failure or insolvency. Test alternate contacts, escrow or buyer-held artefacts, direct subcontractor information where permitted, and the ability to operate without privileged support. Knowledge transfer should reach named incoming people through observed tasks. A presentation or repository handover does not establish that an incident can be managed after experienced staff depart.

The drill should expose queue growth, not hide it. It should include one rollback decision and one affected-party communication. Continue observability across both outgoing and incoming paths until reconciliation stabilises. Revoke accounts and decommission infrastructure only after evidence custody, open work, knowledge transfer and rollback decisions are complete.

The Exit Closure Pack is this article's synthesis. It contains the trigger and authority record; final configuration and decision inventory; asset-transfer and rights receipts; retention and deletion evidence; open-case dispositions; continuity and outcome reconciliation; access revocation and decommissioning; supplier, licence, cost and benefit reconciliation; unresolved risks with owners and deadlines; lessons and reusable assets. Closure is an evidence bundle, not a date in the project plan.

Ten exit casesApply mode, runways, reconciliation and closure

Every case below names the trigger family, exit mode, six-runway implications, critical service, open decisions, evidence disposition, affected-party action, cooperation assumption, transition measure, closure proof and accountable owner.

AI Exit Control RoomConvert the live state into one of five exit decisions

The AI Exit Control Room is this article's synthesis. It returns exactly five outcomes: continue while funding a dated exit option; run a controlled component substitution; migrate the capability to a new provider; retire the AI and restore a non-AI service; or invoke emergency exit and contain exposure. It does not produce one readiness score or call technical cutover closure.

Strong rival and failure boundaryPlan the critical path, not every possible future

The strongest rival is right that exit planning can become pessimistic bureaucracy. Detailed plans decay as models, vendors, people and workflows change. Maintaining substitutes and drills costs money. Emergencies can invalidate an elegant sequence, and any exit may temporarily reduce quality or increase manual work.

The answer is critical-path readiness rather than exhaustive prediction. Maintain the six runways for consequences the enterprise cannot abandon, a tested minimum service, current owners and one realistic drill. Refresh after material change. Pre-authorise reversible containment while reserving irreversible termination for accountable authority. Accept temporary degradation when it preserves safety, rights, evidence and recovery.

Scope sources carefully. OMB, EU and UK materials provide public-sector and legal or commercial mechanics in their applicable domains. Financial-sector guidance illustrates tested exit and critical-service continuity under regulated outsourcing; it is not a universal AI rule. NIST, CISA and NCSC inform lifecycle, incident, dependency and decommissioning controls. Research on future-proof procurement and soft lock-in shows why open code and formal rights can still leave knowledge and practice trapped. The named constructs here are this article's synthesis.

The final test is not whether the old endpoint is silent. Ask whether critical service continues or closes lawfully, affected people retain recourse, open decisions have dispositions, evidence remains usable, assets and access have receipts, people know their roles, costs and benefits are reconciled, and every remaining risk has a deadline. Only then has the enterprise exited rather than merely moved.

Evidence spineSources checked 3 September 2026

1. US OMB, M-25-22.
2. European Union, Regulation (EU) 2023/2854, Data Act.
3. GSA, Buy AI.
4. UK Government, Digital, Data and Technology Playbook.
5. UK Government, Contract Management Playbook.
6. UK Government, Sourcing Playbook.
7. UK Government, Commercial and Supplier Management Approach to Mitigating and Preventing Legacy IT.
8. Federal Reserve, OCC and FDIC, Interagency Paper on Operational Resilience.
9. European Banking Authority, Guidelines on Outsourcing Arrangements.
10. NIST, Artificial Intelligence Risk Management Framework.
11. NIST, AI RMF Playbook.
12. NIST, Generative Artificial Intelligence Profile.
13. NIST, SP 800-61 Rev. 3.
14. CISA, NSA and ODNI, Securing the Software Supply Chain: Guide for Customers.
15. UK NCSC and partners, Guidelines for Secure AI System Development.
16. UK NCSC, Mapping Your Supply Chain.
17. Hickok, Public Procurement of Artificial Intelligence Systems.
18. Persson and Linåker, Soft-lockins in Public Sector Acquisitions of Open Source Software-solutions.

Operating closure cadenceKeep the tail visible after the launch team leaves

Exit governance changes after cutover. Daily command may be appropriate while service is unstable, queues are growing or evidence is still moving. Once the new route is accepted, the cadence should shift to weekly reconciliation of open decisions, affected-party contacts, delayed outcomes, residual access, invoices and deletion events. Each meeting begins with the remaining obligations rather than a percentage-complete dashboard. The owner of every tail item states the closing evidence, due date and consequence of delay. Items with no owner return to the accountable executive instead of becoming project debris.

Do not dissolve the exit team simply because the technology team has moved on. Preserve a smaller closure group until the last consequential case, retention period, supplier claim and cost receipt reaches its event. Compare promised benefits with realised outcomes under the replacement or non-AI service. Record reusable prompts, evaluations, runbooks, data mappings and lessons where rights permit. The final independent check should sample decommissioned accounts, storage, tool credentials, monitoring routes and supplier invoices, then trace several open decisions from outgoing configuration to final disposition. This cadence converts a temporary programme into accountable organisational memory and prevents the same hidden dependencies from being purchased again.