The distributed monolith was the cloud-native failure that looked like success. AI already has its own catalog: the load-bearing prompt, the eval that tests the model instead of the system, RAG on a data model never meant to be retrieved from, the agent with tool access, and the special-case integration. Each one, and the check that finds it.
Five levels, from "we added a chat feature" to "this is how we build now," each with an observable test instead of an adjective. Most organizations are two levels below where they believe they are, for the same reason they were on cloud maturity. The demo works, so the architecture must be fine.
AI components belong on the same risk matrix as everything else. What changes is how you score them: a likelihood rubric built on how often a person meets the failure, and a severity rubric built from reach, reversibility, and detection lag.
Services version on your schedule. Models drift, get deprecated, and improve on someone else's. Designing the boundary around a component you do not control, and the honest math on how much abstraction is worth paying for.
Retrieval, freshness, and data boundaries stop being back-office plumbing the moment a model depends on them. The context supply chain deserves the same rigor we learned to give service contracts, and it is where AI security actually lives.
Distributed systems changed architecture because the network made a function call expensive. AI does it again, except the cost is money as well as latency. Model routing is an architectural decision, not an optimization you do later.
Every testing, monitoring, and reliability practice you own rests on one assumption: same input, same output. An LLM in the call path removes it. What replaces it is evaluation, thresholds, and verification as an explicit architectural layer with a cost and an owner.
Reliability isn't only a technical property, it's an ownership property. Two decisions sit underneath every reliable system, what actually matters and who is accountable for keeping it up, and most organizations have made neither.
The EU AI Act's reach extends to any company whose AI system's output is used by people in the EU, no European office required. A plain-language breakdown of the four risk tiers, what high-risk systems (hiring, credit, biometrics) must actually do, and what the Act does not require.