What happens to your store when your AI provider goes down?

Here's a question worth asking before you put AI in front of shoppers: what does your store do on the afternoon your provider has a bad day?

Not if. Providers rate-limit under load, deprecate models on a schedule, and — the one that catches everyone — stop working when a card expires. That's not a knock on any of them. It's what depending on someone else's service means.

The answer that should worry you

If AI search is the only search you have, then their outage is your outage. Your shoppers get an error where the product grid should be, and you find out from Twitter.

This is easy to end up with by accident. You're building a feature, the AI works, you ship it. Nobody sets out to make their catalog unreachable when a third party has a wobble. It just follows from replacing something that worked with something better, and never asking what happens when the better thing isn't there.

What fallback-first means in practice

The alternative is that every AI feature has a deterministic path underneath it, and the store degrades instead of breaking:

• Semantic search falls back to keyword search. Worse results, still results.
• The AI shopping assistant falls back to a rule-based one. It can still show products and manage a cart; it just stops being clever about it.
• AI-curated recommendations fall back to the affinity scores underneath them, which are ordinary arithmetic over what people actually clicked.

The shopper sees a worse experience. They don't see an error. Nothing is unreachable, nobody's cart is stuck, and the store keeps taking money while somebody sorts out the billing.

We know ours does this because we ran it that way for weeks — not as a drill, just as the actual state of things. No API key at all for a long stretch, then a key with no credits behind it, then a provider returning 400s at us. The store kept selling the whole time on rules and keyword search.

The trap inside the fallback

Here's the part we got wrong, and it's the part nobody warns you about.

A graceful fallback means the failure is invisible. That's the point — for the shopper. But it also meant that when our AI broke, the only symptom was a slightly worse experience, and our code was catching the error and throwing away everything except the status code.

We spent real time guessing at causes. The actual answer, once we bothered to log what the provider said:

status: 400
message: 'Your credit balance is too low to access the Anthropic API.'

An unpaid bill. Invisible for as long as we let it be.

So the rule is two-sided: graceful for the shopper, loud for the operator. If your fallback is silent in both directions, you've built something that can be broken for a week while everyone assumes it's fine. The shopper's experience should degrade quietly. Your logs should be shouting.

What to ask, whoever builds it

• What does a shopper see when the AI call fails? "An error" is the wrong answer.
• What do you see? If nothing alerts, nothing gets fixed.
• Which features are load-bearing? Search failing is bad. Checkout depending on an LLM is a different category of bad.
• What's the blast radius of a rate limit? Not an outage — a Tuesday.

The framing that's served us: the AI is an upgrade, not a dependency. Turning it off should cost you conversion, not revenue. If switching off the AI switches off the store, that's not an AI feature — it's a single point of failure with better marketing.