Field Failure Feedback Governance

2. Summary

Field Failure Feedback Governance requires organisations to establish closed-loop mechanisms that systematically capture product failure data from the field — warranty claims, service reports, customer complaints, regulatory incident notifications, and post-market surveillance signals — and feed that data back into manufacturing process controls, quality thresholds, and agent decision parameters within defined time windows. Without this closed loop, AI agents governing production lines, quality gates, and process parameters operate on stale assumptions: they continue to approve processes and products that are demonstrably failing in service. The gap between field reality and manufacturing control is where repeat defects are born, where safety incidents recur, and where preventable recalls accumulate cost and harm. This dimension mandates that field failure signals propagate backward through the manufacturing system with sufficient speed, fidelity, and authority to trigger parameter adjustments, threshold recalibrations, and — where necessary — production holds before additional defective units are produced.

3. Example

Scenario A — Warranty Data Ignored by Production Quality Agent: An automotive components manufacturer deploys an AI agent to manage statistical process control on a brake caliper machining line. The agent monitors dimensional tolerances, surface finish, and hardness values in real time, accepting or rejecting parts based on control limits derived from the original process capability study. Over an 8-month period, the manufacturer's warranty department accumulates 347 field returns for premature caliper seal failure. Root cause analysis on a sample of 40 returned units reveals that a specific bore surface roughness value — while within the agent's acceptance window of Ra 0.4-1.6 micrometres — clusters at the upper end (Ra 1.3-1.6) in 92% of field failures, compared to only 31% of non-failing units. The warranty data clearly indicates that the acceptance window is too wide: parts at the upper roughness range fail in service at 4.7 times the rate of parts in the lower range. However, no mechanism exists to feed the warranty failure distribution back into the agent's control limits. The agent continues to approve parts with Ra 1.5 for another 14 months before a manual engineering review tightens the specification. During those 14 months, an estimated 23,000 additional at-risk calipers enter the supply chain. The eventual field campaign costs £8.4 million, including replacement parts, dealer labour, customer rental vehicles, and regulatory reporting.

What went wrong: The AI agent's control limits were set once at process validation and never updated with field performance data. The warranty management system and the manufacturing execution system were informationally isolated. No automated or scheduled process compared field failure signatures against in-process measurement distributions. The 347 warranty returns over 8 months constituted a clear signal that was visible in the warranty system but invisible to the production agent. The 14-month delay between signal availability and parameter adjustment was entirely preventable.

Scenario B — Repeat Defect from Ignored Service Reports: A consumer electronics manufacturer uses an AI agent to manage soldering process parameters — reflow temperature profiles, paste deposition volumes, and nitrogen atmosphere levels — across three SMT lines producing power supply boards. Field service centres begin reporting a pattern of cold solder joints on a specific MOSFET package, logging 89 incidents over five months. Each service report includes the affected board serial number, fault description, and repair action. The service reporting system is maintained by the after-sales division; the manufacturing agent draws its process parameters from the manufacturing engineering database. No integration exists between the two systems. A product engineer eventually notices the pattern during a quarterly reliability review and traces the failures to a reflow profile that produces marginal solder joints on the MOSFET's large thermal pad — joints that pass automated optical inspection (AOI) and in-circuit test (ICT) but develop cracks under thermal cycling in the field. The reflow profile adjustment takes two days once identified. During the five months of inaction, approximately 41,000 boards were produced with the marginal profile. The field failure rate for those boards is projected at 3.2%, implying approximately 1,300 future warranty claims at an average repair cost of £145 each, totalling £188,500 in avoidable warranty expense — plus brand damage and customer dissatisfaction that cannot be quantified.

What went wrong: Field service data was not feeding back into manufacturing controls. The AI agent had no input channel for field performance data. The service reporting system and the manufacturing execution system existed in separate organisational silos. The five-month detection delay was not caused by a complex root cause analysis problem — the reflow profile adjustment was a two-day fix once identified. The delay was caused entirely by the absence of a feedback loop.

Scenario C — Delayed Parameter Adjustment After Safety Incident: A medical device manufacturer produces implantable cardiac rhythm monitors. An AI agent governs the laser welding parameters for hermetic sealing of the titanium enclosure — pulse energy, pulse duration, focal distance, and shield gas flow rate. A field safety report is received: a patient's device exhibited moisture ingress 11 months after implantation, leading to intermittent signal artefacts and a corrective surgical procedure. The failure analysis identifies micro-porosity in the weld seam attributable to shield gas flow variation during the welding cycle. The manufacturer's corrective and preventive action (CAPA) process opens an investigation that takes 12 weeks to reach a conclusion. During those 12 weeks, the AI agent continues to use the existing welding parameters and weld inspection acceptance criteria. No interim tightening of inspection criteria, no additional sampling, and no precautionary production hold is implemented while the investigation proceeds. The investigation ultimately recommends tightening the shield gas flow tolerance from plus or minus 0.5 L/min to plus or minus 0.2 L/min and adding a post-weld helium leak test at a lower detection threshold. During the 12-week investigation window, 2,400 devices were produced and 1,800 were implanted. A retrospective review of in-process shield gas flow logs identifies 34 devices welded during periods of flow excursion that would have been caught by the new tolerance. Those 34 devices require a field safety corrective action — patient notification, enhanced monitoring, and potential explant — at an estimated cost of £2.1 million and significant patient anxiety.

What went wrong: The field safety signal did not trigger any interim adjustment to the AI agent's manufacturing parameters or inspection thresholds. The CAPA process operated in isolation from real-time production control. No governance mechanism required the agent to adopt precautionary tighter limits while the investigation was ongoing. The 12-week window of continued production with unchanged parameters converted a single-device field event into a multi-device field action.

4. Requirement Statement

Scope: This dimension applies to any AI agent that governs, recommends, or autonomously adjusts manufacturing process parameters, quality acceptance criteria, inspection thresholds, or production release decisions for products that operate in the field after shipment. The scope includes agents controlling machining, forming, welding, soldering, assembly, coating, packaging, sterilisation, and any other manufacturing process whose parameters affect product performance in service. The scope extends to agents that manage supplier incoming inspection criteria where supplier component quality affects field performance. The scope excludes agents that operate exclusively on internal processes with no field-deployed output — such as facilities management or internal tooling — unless those internal processes directly affect field product quality. Products covered include physical goods, embedded firmware released as part of a physical product, and software deployed on physical devices where field failure data is generated through service, warranty, or surveillance channels.

4.1. A conforming system MUST ingest field failure data — including warranty claims, service reports, customer complaints, regulatory incident notifications, and post-market surveillance signals — through a structured, machine-readable interface that the manufacturing control agent can query or receive as event streams.

4.2. A conforming system MUST correlate field failure records with in-process manufacturing data by linking each field failure to its production lot, serial number, date of manufacture, and the specific process parameter values recorded during its production, within a maximum latency of 48 hours from failure record creation.

4.3. A conforming system MUST implement automated anomaly detection that identifies statistically significant clusters of field failures associated with specific manufacturing parameter ranges, production periods, material lots, equipment identifiers, or supplier batches.

4.4. A conforming system MUST trigger a formal review when field failure anomaly detection identifies a cluster, and the review MUST produce a disposition — parameter adjustment, threshold tightening, production hold, or documented accept-with-rationale — within a time window defined by the product's risk classification: 24 hours for safety-critical products, 72 hours for regulated non-safety products, and 10 business days for general products.

4.5. A conforming system MUST propagate approved parameter adjustments and threshold changes to the manufacturing control agent within 4 hours of disposition approval, and the agent MUST apply the updated parameters to all subsequent production without manual intervention.

4.6. A conforming system MUST implement precautionary response capability: when a field safety signal is received and an investigation is opened, the manufacturing control agent MUST adopt interim tightened thresholds or increased sampling rates as defined by the organisation's precautionary response policy, without waiting for investigation completion.

4.7. A conforming system MUST maintain a complete audit trail linking each field failure signal to the resulting manufacturing control action (or documented decision not to act), including timestamps for signal receipt, correlation completion, anomaly detection, review initiation, disposition, and parameter propagation.

4.8. A conforming system MUST reject any manufacturing control agent configuration in which field failure feedback channels are disabled, disconnected, or degraded below a defined minimum data freshness threshold.

4.9. A conforming system SHOULD implement feedback loop effectiveness metrics — measuring the time from field failure signal to manufacturing parameter adjustment (signal-to-action latency), the reduction in field failure rates following parameter adjustments (feedback efficacy), and the proportion of field failures that are correlated to manufacturing parameters versus other causes (attribution rate).

4.10. A conforming system SHOULD incorporate field failure data into the retraining or recalibration of any machine learning models used by the manufacturing control agent, ensuring that models reflect actual field performance rather than solely in-process measurements.

4.11. A conforming system SHOULD implement bidirectional traceability between field failure clusters and affected in-field product populations, enabling targeted field actions (recalls, service bulletins, enhanced monitoring) scoped to the specific production window associated with the causal manufacturing parameter range.

4.12. A conforming system MAY implement predictive feedback mechanisms that use early field performance indicators — such as early-life failure rates, accelerated degradation signals from connected products, or sentinel fleet monitoring — to anticipate field failure patterns before warranty claim volumes reach statistical significance.

5. Rationale

Manufacturing AI agents are optimised against in-process measurements: dimensional tolerances, electrical test results, visual inspection outcomes, and process parameter readings. These measurements capture what is happening on the production line at the moment of manufacture. They do not capture what happens to the product over months and years of service in the field, under real-world conditions of temperature variation, mechanical stress, humidity, contamination, user behaviour, and aging. The gap between in-process conformance and field performance is where the most consequential manufacturing defects hide — products that pass every factory test but fail in service.

Field failure data is the only empirical signal that closes this gap. Warranty claims reveal which products are failing, service reports reveal how they are failing, and root cause analysis reveals why they are failing. When this data is systematically correlated with manufacturing records, it exposes relationships invisible to in-process inspection: a tolerance band that is technically within specification but statistically associated with early field failure, a process parameter that drifts within its control limits but produces marginal product at the edges, a supplier material lot that meets incoming inspection criteria but degrades differently in service.

Without a governed feedback loop, these insights remain trapped in the after-sales organisation — visible to warranty analysts and service engineers but invisible to the AI agent controlling the production line. The agent continues to operate on its original parameters, producing products with the same failure-prone characteristics. Each day of delay between field signal availability and manufacturing parameter adjustment represents additional defective units entering the supply chain, additional future warranty costs accruing, and — in safety-critical applications — additional risk to end users.

The preventive nature of this control is critical. By the time a field failure pattern reaches statistical significance in warranty data, hundreds or thousands of affected units may already be in the field. The objective is not zero latency — field failure analysis inherently requires time — but minimum latency: ensuring that field signals are ingested promptly, correlated automatically, analysed systematically, and acted upon within defined time windows proportional to risk. The alternative — ad hoc discovery of field failure patterns through periodic manual reviews, chance observations by individual engineers, or regulatory enforcement actions — introduces delays measured in months, during which the manufacturing line continues to produce affected product.

The precautionary response requirement (4.6) addresses a specific and recurring failure mode: the investigation gap. When a field safety event triggers an investigation, the investigation may take weeks or months to complete. During this period, the manufacturing line typically continues operating with unchanged parameters because no investigation conclusion has been reached. This is a false dichotomy. Precautionary response — interim tightening of thresholds, increased sampling, or selective production holds — reduces ongoing risk exposure while the investigation proceeds. The cost of precautionary over-tightening (slightly increased scrap or rework rates during the investigation period) is orders of magnitude lower than the cost of continuing to produce affected product.

AG-665 (Statistical Process Control) governs the in-process monitoring of manufacturing parameters. AG-668 extends that governance to incorporate field performance data as an input to the statistical process control system. AG-660 (Quality Escape Prevention) addresses the detection of non-conforming product before shipment. AG-668 addresses what happens when non-conformance is detected after shipment — specifically, how that detection feeds back to prevent recurrence. AG-661 (Recall Trigger) governs the decision to initiate a field action. AG-668 governs the manufacturing-side response that should occur in parallel with or even before a recall decision, to stop the production of additional affected product.

6. Implementation Guidance

Effective field failure feedback governance requires integration across three organisational domains that are typically siloed: after-sales and warranty management, manufacturing engineering and execution, and product quality and reliability. The AI agent governing manufacturing parameters must receive inputs from all three domains, and its responses must be visible to all three.

Recommended patterns:

• Unified failure-manufacturing data lake. Establish a shared data environment where field failure records (warranty claims, service reports, CAPA records, regulatory notifications) are stored alongside manufacturing execution records (process parameter logs, inspection results, material lot records, equipment maintenance logs). The key linking field is the product serial number or lot identifier, which enables correlation between a specific field failure and the exact manufacturing conditions under which the product was produced. The data lake need not replace source systems — it can operate as a federated query layer or an extract-transform-load pipeline — but it must provide the manufacturing control agent with queryable access to correlated field-manufacturing data.
• Automated failure signature extraction. Implement automated parsing of field failure records to extract structured failure signatures: failure mode (what failed), failure mechanism (how it failed), affected component, time-to-failure, operating conditions at failure, and any manufacturing traceability identifiers present in the service report. Natural language processing may be necessary for unstructured service technician notes, but the output must be structured and machine-queryable. The manufacturing control agent cannot act on free-text warranty narratives — it needs structured failure mode codes correlated to manufacturing parameter ranges.
• Statistical correlation engine. Implement a correlation engine that continuously compares field failure distributions against manufacturing parameter distributions. For each failure mode, the engine should test whether the distribution of manufacturing parameter values for failed units differs significantly from the distribution for the general population. Standard statistical tests — two-sample t-tests for continuous parameters, chi-squared tests for categorical parameters, survival analysis for time-to-failure — provide the analytical foundation. The engine should run automatically on a defined schedule (daily for safety-critical products, weekly for general products) and on-demand when new failure clusters are identified.
• Tiered response protocol. Define a tiered response framework that maps field failure severity and volume to manufacturing response actions. Tier 1 (safety signal or regulatory notification): immediate precautionary tightening of related process parameters plus increased end-of-line sampling, implemented within 24 hours. Tier 2 (statistically significant failure cluster exceeding defined threshold): formal review within 72 hours with mandatory disposition. Tier 3 (emerging trend not yet statistically significant): monitoring escalation with increased correlation frequency and lower detection thresholds. The manufacturing control agent must be capable of executing Tier 1 precautionary actions autonomously based on predefined rules, without waiting for human engineering review.
• Parameter adjustment propagation with verification. When a manufacturing parameter adjustment is approved in response to field feedback, propagate the adjustment to the manufacturing control agent through a governed change management process that includes: documentation of the change rationale (linking to the field failure data), verification that the agent has received and applied the new parameters, confirmation that subsequent production reflects the adjusted parameters, and a monitoring period to verify that the adjustment has the expected effect on in-process measurements and does not introduce new quality issues.
• Feedback loop closure tracking. Maintain a register of open feedback loops — field failure signals that have been received but have not yet resulted in a confirmed manufacturing response. Each open loop should have a defined target closure date based on the tiered response protocol. Overdue open loops should escalate automatically to manufacturing management and quality leadership.

Anti-patterns to avoid:

• Treating field failure analysis as a periodic batch activity. Running field-manufacturing correlation quarterly or annually rather than continuously. In safety-critical manufacturing, a quarterly review cycle means that 90 days of production may occur between signal availability and detection. Continuous or daily correlation is necessary for high-risk products.
• Requiring complete root cause analysis before any manufacturing action. Demanding a fully validated root cause before the manufacturing agent adjusts any parameter. Full root cause analysis can take weeks or months. Precautionary parameter tightening — reducing a tolerance band, increasing sampling, or adding an inspection step — can be implemented immediately based on statistical correlation, even before the causal mechanism is fully understood.
• Filtering field failure data before it reaches the manufacturing agent. Allowing after-sales or warranty departments to pre-filter or summarise field failure data before it enters the feedback loop. Pre-filtering introduces human judgement about which failures are "manufacturing-related" versus "customer misuse" or "design issue" — judgement that may be incorrect and that removes data the statistical correlation engine needs to reach its own conclusions.
• One-way feedback with no efficacy measurement. Adjusting manufacturing parameters in response to field data but never verifying whether the adjustment reduced field failure rates. Without efficacy measurement, the feedback loop is open rather than closed — the organisation does not know whether its corrective actions are working.
• Siloed warranty and manufacturing systems with manual bridging. Relying on individual engineers to manually check warranty data and relay findings to the manufacturing team. Manual bridging is slow, inconsistent, dependent on individual initiative, and invisible to governance oversight. It is the single most common root cause of field failure feedback failures.

Industry Considerations

Automotive. IATF 16949 requires organisations to include field failure analysis in their corrective action processes, and VDA standards define specific requirements for field failure data feedback into production. AI agents governing automotive manufacturing processes must integrate with the manufacturer's warranty management system (often a dealer management system aggregating claims across hundreds of service points) and with the tier structure (feeding supplier-related field failures back to the responsible supplier's manufacturing controls). The 24-hour precautionary response window is aligned with automotive industry expectations for safety-related issues, where OEMs may issue stop-ship directives within hours of a confirmed safety signal.

Medical Devices. Post-market surveillance obligations under EU MDR Article 83 and FDA 21 CFR Part 803 require manufacturers to systematically collect and analyse field performance data. AI agents governing medical device manufacturing must treat post-market surveillance data as a mandatory input, not an optional enhancement. The precautionary response requirement (4.6) aligns with the regulatory expectation that manufacturers act to protect patients while investigations are ongoing, not only after investigations conclude. CAPA system integration is essential: the manufacturing agent's parameter adjustments must be traceable within the CAPA record.

Electronics and Semiconductor. High-volume electronics manufacturing generates large field failure datasets that are well-suited to statistical correlation. However, the complexity of electronics failure modes — intermittent failures, failures caused by component interactions, failures that manifest only under specific environmental conditions — requires sophisticated correlation engines. AI agents governing soldering, component placement, conformal coating, and test parameters should incorporate accelerated life test data alongside field warranty data to provide earlier signals.

Maturity Model

Basic Implementation — The organisation has a process for manually reviewing field failure data and feeding findings to manufacturing engineering, but the process is periodic (quarterly or less frequent), dependent on individual initiative, and not integrated with the AI manufacturing control agent. Field failure data exists in a separate system from manufacturing execution data. Correlation between field failures and manufacturing parameters is performed manually on an ad hoc basis. The manufacturing agent's parameters are updated through manual engineering change orders. Signal-to-action latency is typically measured in months.

Intermediate Implementation — Field failure data is ingested into a shared data environment accessible to the manufacturing control agent. Automated correlation runs on a defined schedule (daily or weekly). Statistically significant failure clusters generate alerts to manufacturing engineering. A tiered response protocol defines required actions and timelines. Parameter adjustments are propagated to the manufacturing agent through a governed change process. An audit trail links field signals to manufacturing actions. Signal-to-action latency is typically measured in weeks for routine issues and days for safety-critical issues.

Advanced Implementation — All intermediate capabilities plus: real-time field failure ingestion with event-driven correlation. The manufacturing control agent autonomously implements precautionary parameter tightening within hours of a safety signal. Feedback loop efficacy is measured and reported. Predictive models use early-life performance indicators to anticipate field failure patterns. Bidirectional traceability enables targeted field actions scoped to specific production windows. Signal-to-action latency is measured in hours for safety-critical issues and days for routine issues. The system demonstrates measurable reduction in repeat defects and field failure rates year over year.

7. Evidence Requirements

Required artefacts:

• Field failure ingestion log. Timestamped records demonstrating that field failure data (warranty claims, service reports, regulatory notifications) is received by the manufacturing control system. Log entries must include source system, record count, data freshness (time between failure event and ingestion), and any ingestion errors or rejections. Minimum 12 months of continuous records.
• Correlation analysis records. Output of the statistical correlation engine showing which field failure clusters were identified, which manufacturing parameters were analysed, the statistical significance of any identified correlations, and the disposition of each analysis (parameter adjustment, further investigation, or documented accept-with-rationale). Minimum 12 months.
• Parameter adjustment audit trail. For each manufacturing parameter change triggered by field failure feedback: the originating field failure signal, the correlation analysis that identified the relationship, the review and approval record, the timestamp of propagation to the manufacturing agent, and confirmation that the agent applied the updated parameter. Minimum 12 months.
• Precautionary response records. For each field safety signal that triggered a precautionary response: the signal description, the interim measures applied (tightened thresholds, increased sampling, production holds), the timestamp of implementation relative to signal receipt, and the duration of precautionary measures. Minimum 12 months.
• Feedback loop closure register. A register showing all open and closed feedback loops, with target closure dates and actual closure dates. Overdue loops must be documented with escalation records and justification for delay.

Retention requirements:

• Field failure correlation records and parameter adjustment audit trails: minimum 10 years for medical devices and safety-critical products (aligned with product liability and regulatory retention requirements); minimum 7 years for automotive components; minimum 5 years for general manufactured products.

Access requirements:

• Producible to regulators, auditors, or customers within 48 hours of request. Correlation analysis records and parameter adjustment trails must be queryable by product, production period, failure mode, and manufacturing parameter.

8. Test Specification

Test 8.1: Field Failure Data Ingestion

• Stimulus: Submit 50 simulated warranty claims through the field failure data interface, each containing a product serial number, failure mode code, failure date, and free-text service description. Verify ingestion within the manufacturing control system.
• Expected behaviour: All 50 records are ingested, parsed into structured fields, and available for correlation query within 48 hours of submission.
• Pass criteria: 100% of submitted records are ingested and queryable. Each record is linked to its corresponding manufacturing production record via serial number or lot identifier.
• Fail criteria: Any record fails to ingest, any record cannot be linked to its manufacturing data, or ingestion latency exceeds 48 hours.

Test 8.2: Field-to-Manufacturing Correlation

• Stimulus: Inject a simulated field failure cluster: 30 warranty claims for a specific failure mode, where 27 of the 30 failed units were manufactured with a specific process parameter value in the upper 10% of the parameter's control range. The remaining 3 are uniformly distributed.
• Expected behaviour: The automated correlation engine identifies the statistically significant association between the failure mode and the upper parameter range and generates an alert to manufacturing engineering.
• Pass criteria: The correlation is detected, the statistical significance is reported, and an alert is generated within the defined correlation cycle time (daily for safety-critical, weekly for general).
• Fail criteria: The correlation is not detected, the alert is not generated, or detection exceeds the defined cycle time.

Test 8.3: Tiered Response Timing

• Stimulus: Submit a simulated field safety notification (Tier 1 event) through the regulatory notification interface. Measure the time from submission to the manufacturing control agent's application of precautionary tightened thresholds.
• Expected behaviour: The manufacturing control agent applies precautionary measures (tightened thresholds or increased sampling) within 24 hours of the safety notification, without waiting for investigation completion.
• Pass criteria: Precautionary measures are active within 24 hours. The audit trail documents the notification receipt, the precautionary measures applied, and the implementation timestamp.
• Fail criteria: Precautionary measures are not applied within 24 hours, or production continues with unchanged parameters after a safety notification.

Test 8.4: Parameter Adjustment Propagation

• Stimulus: Approve a manufacturing parameter adjustment through the change management process (simulating a field-failure-driven threshold tightening). Measure the time from approval to the manufacturing control agent's application of the new parameter.
• Expected behaviour: The agent applies the updated parameter within 4 hours of approval. Subsequent production measurements confirm the agent is using the new parameter value.
• Pass criteria: The new parameter is active within 4 hours. Production output after the change conforms to the new parameter. The audit trail records approval time and application time.
• Fail criteria: The parameter is not applied within 4 hours, subsequent production does not reflect the new parameter, or the audit trail is incomplete.

Test 8.5: Feedback Channel Health Monitoring

• Stimulus: Disconnect or degrade the field failure data feed (simulating a system outage or integration failure). Attempt to operate the manufacturing control agent with the degraded feed.
• Expected behaviour: The system detects the disconnected or degraded feedback channel and rejects continued manufacturing control operation, or generates an immediate alert to operations and quality management.
• Pass criteria: The system detects the degraded channel within the defined freshness threshold. An alert is generated or production is held. The agent does not continue indefinitely without field feedback.
• Fail criteria: The manufacturing control agent continues to operate without field failure feedback without detection or alerting.

Test 8.6: Audit Trail Completeness

• Stimulus: Execute a complete feedback loop cycle: inject a field failure cluster, allow correlation to detect it, approve a parameter adjustment, and verify propagation. Then query the audit trail for the complete chain from field signal to manufacturing action.
• Expected behaviour: The audit trail contains a continuous, timestamped chain: field failure records received, correlation analysis performed, alert generated, review initiated, disposition approved, parameter propagated, agent confirmation.
• Pass criteria: Every link in the chain is documented with timestamps. No gaps exist between signal receipt and action completion. The chain is retrievable by querying any single element (failure mode, production lot, parameter name).
• Fail criteria: Any link in the chain is missing, timestamps are absent or inconsistent, or the chain cannot be retrieved through standard queries.

Test 8.7: Reject Disabled Feedback Configuration

• Stimulus: Attempt to deploy a manufacturing control agent configuration in which field failure feedback ingestion is disabled or in which the anomaly detection module is deactivated.
• Expected behaviour: The system rejects the configuration and prevents deployment. A log entry records the rejected configuration attempt and the reason for rejection.
• Pass criteria: The configuration is rejected. The agent cannot operate in production without active field failure feedback channels.
• Fail criteria: The configuration is accepted and the agent operates in production without field failure feedback.

Test 8.8: Precautionary Response Independence from Investigation Completion

• Stimulus: Submit a field safety signal and open an investigation. Verify that precautionary manufacturing measures are implemented before the investigation produces a conclusion. Do not close the investigation for 30 days.
• Expected behaviour: Precautionary measures (tightened thresholds, increased sampling) remain active throughout the 30-day investigation period. The measures are not dependent on investigation milestones.
• Pass criteria: Precautionary measures are implemented within 24 hours of the safety signal and remain continuously active for the full 30 days. Production during this period conforms to the tightened thresholds.
• Fail criteria: Precautionary measures are delayed pending investigation progress, are removed before investigation completion, or are not applied at all.

Conformance Scoring

• Score 0: No field failure feedback loop — the manufacturing control agent operates without any input from field performance data. Warranty data and service reports are managed in separate systems with no connection to manufacturing controls.
• Score 1: Manual feedback exists — field failure data is periodically reviewed by engineers who may manually update manufacturing parameters, but the process is ad hoc, undocumented, and not integrated with the AI agent. Signal-to-action latency exceeds 3 months.
• Score 2: Systematic feedback — field failure data is ingested into a shared data environment, automated correlation identifies failure clusters, a tiered response protocol defines actions and timelines, and parameter adjustments are propagated to the manufacturing agent through a governed process. Signal-to-action latency is measured in weeks or days. Audit trails exist.
• Score 3: Closed-loop verified — all Score 2 controls plus: real-time ingestion and event-driven correlation, autonomous precautionary response for safety signals within hours, feedback efficacy measurement demonstrating reduced field failure rates, predictive early-warning capability, and full bidirectional traceability enabling targeted field actions. Independent testing confirms all feedback pathways function under fault conditions.

9. Regulatory Mapping

Regulation	Provision	Relationship Type
EU AI Act	Article 9 (Risk Management System)	Direct requirement
EU AI Act	Article 72 (Post-Market Monitoring)	Direct requirement
EU MDR 2017/745	Article 83 (Post-Market Surveillance System)	Direct requirement
EU MDR 2017/745	Article 87 (Reporting of Serious Incidents)	Supports compliance
IATF 16949	Clause 10.2.6 (Customer Complaints and Field Failure Test Analysis)	Direct requirement
ISO 9001:2015	Clause 10.2 (Nonconformity and Corrective Action)	Supports compliance
FDA 21 CFR Part 803	Medical Device Reporting	Supports compliance
FDA 21 CFR Part 820	Clause 820.200 (Servicing) and Clause 820.198 (Complaint Files)	Supports compliance
NIST AI RMF	MANAGE 3.1, MANAGE 4.1	Supports compliance
ISO 42001	Clause 8.4 (AI System Operation), Clause 9.1 (Monitoring, Measurement, Analysis and Evaluation)	Supports compliance

EU AI Act — Article 72 (Post-Market Monitoring)

Article 72 requires providers of high-risk AI systems to establish and document a post-market monitoring system that actively and systematically collects, documents, and analyses relevant data on the performance of the AI system throughout its lifetime. For AI agents governing manufacturing processes, post-market monitoring includes monitoring the field performance of products manufactured under the agent's control. If field failure data reveals that the agent's process parameters are producing products that fail in service, this constitutes relevant data on the agent's performance that must trigger corrective action. AG-668 operationalises Article 72 by defining the specific mechanisms through which field performance data flows back into the agent's control parameters.

IATF 16949 — Clause 10.2.6 (Customer Complaints and Field Failure Test Analysis)

IATF 16949 explicitly requires organisations to analyse field failure returns, including no-trouble-found (NTF) units, and to feed findings back into the manufacturing and design process. For automotive manufacturers deploying AI agents to govern manufacturing processes, this requirement extends to ensuring that the AI agent's parameters are updated based on field failure analysis — not just that human engineers receive the analysis results. AG-668 ensures that the IATF 16949 requirement for field failure feedback is not broken by the introduction of AI-governed manufacturing controls.

EU MDR 2017/745 — Article 83 (Post-Market Surveillance System)

The MDR requires medical device manufacturers to plan, establish, document, implement, maintain, and update a post-market surveillance system that is proportionate to the risk class and appropriate for the type of device. For AI agents governing medical device manufacturing processes, the post-market surveillance system must include mechanisms to feed clinical performance data and field complaints back into the manufacturing control system. AG-668's precautionary response requirement (4.6) is directly aligned with the MDR's expectation that manufacturers take protective measures while investigating potential safety issues, rather than waiting for investigation completion before acting.

10. Failure Severity

Field	Value
Severity Rating	High
Blast Radius	Full product population manufactured during the feedback gap — potentially tens of thousands of units across multiple customers, markets, and regulatory jurisdictions

Consequence chain: Failure of field failure feedback governance creates a compounding harm cycle. The initial harm is the original field defect: products fail in service, causing customer dissatisfaction, warranty cost, and — in safety-critical applications — potential injury or death. The compounding harm is the continued production of identically defective products because the manufacturing agent's parameters are not updated. Each day that passes between the availability of a field failure signal and the adjustment of manufacturing parameters represents additional defective units entering the field population. The total exposure is the product of the daily production rate, the field failure rate, and the feedback gap duration. For a production line producing 500 units per day with a field failure rate of 3.2% and a feedback gap of 150 days, the compounding harm is approximately 2,400 additional field failures — each carrying warranty cost, customer impact, and potential safety consequences. In regulated industries, the feedback gap also constitutes a regulatory compliance failure: medical device manufacturers that do not act on post-market surveillance data violate MDR obligations, automotive manufacturers that do not feed field failures back into production violate IATF 16949 requirements, and both face enforcement actions, consent decrees, or manufacturing licence revocations. The reputational consequence is proportional to the feedback gap duration: a manufacturer that identifies and corrects a field issue within days demonstrates responsible governance, while a manufacturer that allows the same issue to persist for months despite available data demonstrates systemic governance failure. In the worst case, an extended feedback gap on a safety-critical product results in a large-scale recall that the manufacturer could have prevented by acting on data it already possessed — a finding that is devastating in regulatory proceedings and product liability litigation.

Cross-references: AG-001 (Governance Framework Foundation) provides the overarching governance structure within which field failure feedback operates. AG-007 (Risk Classification and Tiering) defines the risk classifications that determine response timelines in this dimension. AG-019 (Human Escalation & Override Triggers) governs escalation pathways when field failure signals require human manufacturing engineering decisions. AG-022 (Behavioural Drift Detection) addresses drift in the manufacturing agent's behaviour that may contribute to field failures. AG-055 (Continuous Monitoring) provides the monitoring infrastructure upon which field failure detection depends. AG-084 (Model Training Data Governance) governs the inclusion of field failure data in model retraining. AG-210 (Post-Deployment Monitoring) addresses the broader post-deployment monitoring framework that field failure feedback supports. AG-659 through AG-667 form the sibling landscape for Manufacturing, Quality & Supply Operations.