AI Rollback and Safe-State Protocol

How to use this document

• What it is for. This is a base protocol that defines when and how to degrade, roll back, disable or shut down an AI system to bring it to a safe state, who can decide this, how it is carried out, how it is verified and how normal operation resumes.
• Who should own it. Usually operations or IT, with the owner of each system. Enter the function in [RESPONSIBLE FUNCTION] and the person in [OWNER].
• Decisions to take first. For each critical system, decide its safe state and its non-AI fallback (Section 4 and aid B), which triggers activate each level (Section 6), who can decide without prior approval (Section 7) and how often rollback is tested (Section 12).
• Fields to complete. Replace the bracketed fields and complete one safe-state record per system. Keep [OPTIONAL] clauses only if they apply.
• Country variants. This protocol has no country variants. If the organization is a financial entity, an essential services operator or subject to cybersecurity or continuity rules, check the continuity and reporting obligations against the laws listed in "Related regulatory references."
• Review. Have the technical teams confirm that each safe state can be reached in the expected time, and have the system owner confirm that the manual fallback has enough capacity.
• Approval and publication. Have it approved by the technology leadership or [AI COMMITTEE], record the approval in "Version history," and distribute it to on-call engineers, system owners and the incident response team.

AI Rollback and Safe-State Protocol

Field	Value
Organization	[LEGAL ENTITY NAME]
Owning function	[RESPONSIBLE FUNCTION]
Protocol owner	[OWNER]
Approved by	[APPROVED BY]
Effective date	[DATE]
Review frequency	[REVIEW FREQUENCY]
Activation channel	[COMPLETE: on-call channel or phone] and [AI GOVERNANCE EMAIL]

1. Purpose

1.1 This protocol sets out how [ORGANIZATION NAME] quickly and in a controlled way withdraws or limits the operation of an AI system when its behavior is no longer acceptable, in order to reduce harm and regain control without improvising.

1.2 It ensures that the people responsible for human oversight can stop or correct the system and that every intervention is recorded.

2. Scope

2.1 It applies to all AI systems in production listed in the "AI System Inventory." A tested safe-state record is mandatory for High- or Medium-risk systems, for customer-facing systems, for agents that take actions and for self-hosted models in production. In this protocol, a "critical system" is any system that must have that record.

2.2 It covers the model, its system instructions and configuration, vendor integrations, reference data (for example, an assistant's knowledge base), agent permissions and, for self-hosted models, the weights, the chat template and the inference server.