MCCM Wiki
Rollback plan for AI workflows
A rollback plan for an AI workflow names who can stop it, what the last known-good prompt or process version is, and how work continues without the model within one business day. If you cannot answer those three, you are not ready for production.
Pilots fail gracefully when someone can hit reverse. Many AI rollouts cannot. The chat keeps running while nobody owns the kill switch.
Write the kill switch before go-live
Put a named person and a backup on the rollback. Define the trigger: error rate, customer complaint, privacy incident, or cost spike. Publish the stop command in the same place as the prompt workflow. Verbal “we’ll just stop using it” is not a plan.
Version what you roll back to
Keep the previous prompt, checklist, and routing rules dated. When quality drops after a “small tweak,” you need the last known-good package, not a Slack memory. Treat prompts like SOPs. Date, owner, change note.
Manual path must still exist
Rollback means the old path works. If you deleted the template inbox or the spreadsheet during the pilot, you built a trap. Keep a thin manual path ready for at least one full cycle after cutover. That is the opposite of a shadow process that never dies: it is an emergency lane you intend to close later.
Communicate the stop
Staff need a one-line status: AI assist paused, use manual steps, owner is X. Customers may need disclosure if outputs already went external. Practice this in a short tabletop before the first real incident.
Pilot implication
MCCM includes rollback in the pilot pack next to the KPI and review gate. Go/no-go at week six includes whether the team can pause without chaos.