# OUT-16 Fallback model assurance

Domain: OUT Output Integrity & Supply Chain · HI-AAF v1.3 · Public review · https://humanintel.net/standard/out/out-16

Any alternate model an agent may run on is held to the same pre-deployment assurance as the primary. An agent does not silently operate on an unassessed model.

A fallback model is not a free pass. Any alternate model an agent may run on, whether selected deliberately or invoked automatically by a provider's fallback mechanism, is held to the same pre-deployment assurance as the primary: the capability evaluation suite, the versioned evaluation set, adversarial assessment, and a captured behavior baseline. Where a provider may substitute models without notice, the substitution is either contractually constrained, detected and contained at runtime (MON-12), or the fallback is pre-assessed so the substitution lands on assured ground. An unassessed substitution is a material change and is handled as an incident.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for OUT-16: Every pre-identified fallback model carries a current assessment to the same standard as the primary; provider substitution paths are contractually constrained, detected at runtime, or pre-assessed; no production traffic is served by an unassessed model.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Every pre-identified fallback model carries a current assessment to the same standard as the primary.
- Provider substitution paths are contractually constrained, detected at runtime, or pre-assessed.
- No production traffic is served by an unassessed model.

## Framework mappings

- NIST AI RMF: MANAGE 3
- OWASP LLM Top 10: LLM03
- SOC 2 (TSC): A1.2
- EU AI Act: Art. 15, Art. 25
- Singapore: MAIGF Trusted Development and Deployment

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cites MON-12 Model identity verification: https://humanintel.net/standard/mon/mon-12
- Cited by OUT-15 Model availability & continuity: https://humanintel.net/standard/out/out-15
- Cited by MON-12 Model identity verification: https://humanintel.net/standard/mon/mon-12
- Glossary: Fallback model: https://humanintel.net/standard/glossary#fallback-model

## Cite this control

Human Intelligence. HI-AAF v1.3, OUT-16 Fallback model assurance. Public review edition, July 2026. https://humanintel.net/standard/out/out-16