We are entering a new phase of Business Continuity.

One where a BC plan that would comfortably pass an audit — RTOs assigned, recovery steps defined, resources mapped, dependencies described — can be generated at the click of a GenAI button.  And that changes everything.

Not because standards no longer matter. But because plans alone will no longer mean very much at all.

In a world where documentation is easy, fast, and increasingly indistinguishable, the only thing that will carry real weight is proof. Proof that the plan would actually work.

The standards always assumed this

ISO 22301 and the BCI Good Practice Guidelines were never designed to stop at documentation.

They were built on an assumption that plans would be exercised, validated, and challenged. That recovery assumptions would be tested. That gaps would be exposed. That confidence would be earned, not declared.

Exercising was meant to be where theory met reality.  However, in practice, that intent has slowly eroded.

How exercising lost its edge

Over time, the BC exercise has become one of the most diluted elements of the program. What was once intended to surface friction has been reshaped to avoid it.

Desktop discussions replace decision pressure. Scenarios are curated to ensure success. Injects are softened. Timelines are stretched. Workarounds are quietly allowed.

Everyone leaves reassured. Nothing fundamental changes. 

The exercise becomes a performance — carefully choreographed to demonstrate competence rather than test capability.

This is not because people don’t understand the value of exercising properly. It’s because validation exercises are expensive.  They cost time. They require cognitive load to be applied. They interrupt delivery. They create discomfort. They expose weaknesses that someone then has to own.

So they are smoothed over and resilience quietly stagnates.

Why GenAI makes this problem impossible to ignore

Until now, documentation still carried weight. Creating a credible plan required effort, context, and specialist input. My constant refrain was “it’s not the end product of the plan but the process of planning that is valuable”.

That constraint is disappearing.

GenAI can already produce continuity plans that look coherent, complete, and aligned to standards. Soon, it will do so faster than most organizations can reasonability review them. The systemic impulse to agree with what is written – instead of challenge and review, will be used to the detrainment of planning here.

This creates a dangerous illusion.  We have two options:

1. Teach people how to critically think (useful for not just BC planning but also, I don’t believe we would ultimately successful)
2. Find other ways to stress test the plan.

If plans are easy to generate, organizations will be tempted to equate speed with maturity and volume with capability.

But a plan that looks right is not the same as a plan that works.  And GenAI cannot validate reality. Only the organization can do that.

Validation is becoming the real signal of maturity

In this new environment, exercising and validation are no longer “nice to have”.  They become the primary evidence of resilience.  Not whether a plan exists — but whether it has survived contact with:

• real people
• real constraints
• real decision pressure

Validation answers questions documentation never can.

• Can decisions actually be made at the speed the plan assumes?
• Do people know their roles without prompts?
• Are dependencies real, or theoretical?
• Do recovery steps still make sense under stress?

These are not academic questions.  They are operational ones.

We will need to go further than we ever have before

Even traditional exercises will not be enough.  Desktop discussions and lightly scripted simulations will struggle to differentiate between paper confidence and real capability in a world of AI-generated plans.

The future of Business Continuity will require harder validation.  That means:

• Targeted exercises for specific validation
• Cross-functional decision-making under time pressure
• Stress Testing assumptions, not rehearsing scripts
• Allowing failure to surface, rather than smoothing it away

This does not mean only constant large-scale simulations, but a blend of day to day what if conversations and full noise, messy simulation activations.  It means smarter, more targeted validation — focused on the assumptions that matter most.

Why this is uncomfortable — and unavoidable

This type of validation exposes trade-offs leaders thought were settled. It reveals capacity limits. It shows where recovery expectations are unrealistic. It also forces a shift in posture.

From “are we compliant?” To “are we actually ready?”  That shift is uncomfortable.  But in a world where plans are cheap, comfort is no longer a credible strategy.

What exercising is really for

Exercising is not about proving success. It is about learning faster than disruption forces you to. It builds shared understanding. It strengthens decision-making muscle memory. It creates clarity under pressure.  Most importantly, it replaces assumption with evidence.

And evidence is the only thing that will matter when everyone else also has a perfectly written plan. When documentation becomes commoditized, resilience becomes behavioral. The organizations that will stand out are not those with the neatest plans, but those who can demonstrate — repeatedly — that their assumptions hold under stress.

BC Theatre will not survive this shift.  Only validation will.

In the next article, I’ll pull the series together by looking at what leadership actually looks like in resilient organizations, and why resilience is less about frameworks and far more about behavior under pressure.

Theater ends the moment the lights go out — and disruption doesn’t care how good the paperwork looked.