How do you design an AI system that gracefully degrades when the model is unavailable?

Decide in advance what a 'reduced but useful' experience looks like, since AI is often one feature inside a larger product. Tiers of degradation: swap the frontier model for a faster/cheaper one, then a cached or templated response, then a non-AI path — for search, fall back to keyword results; for a RAG chatbot, return the retrieved source passages with citations even if you can't generate a summary. Keep the rest of the app working so one dependency doesn't take the whole product down. Communicate honestly in the UI ('summaries are temporarily unavailable') rather than failing silently or hallucinating. Circuit breakers trigger the downgrade automatically and recover when the model is healthy again.