AI Glossary / Governance, ethics and safety / Intermediate
Risk stratification
Definition
Risk stratification is the process of assigning cases to groups based on estimated risk of a specified outcome. A prediction model may produce a continuous score or probability, which is then divided into categories such as lower, intermediate, and higher risk. The categories simplify communication or workflow, but they do not remove uncertainty or determine what action is appropriate by themselves.
What it means
A risk estimate concerns a defined event over a defined period, such as whether equipment will fail within the next month. Stratification turns that estimate into a smaller set of labels. This can help organize attention, but cases within one group may still differ substantially. The boundary between groups is a design choice that needs justification. Risk stratification is not necessarily unsupervised clustering: a model can estimate a particular outcome and then apply explicit cutoffs. It also differs from stratified sampling, which divides a population to support data collection.
How it works
First define the outcome, horizon, population, and available information. Develop and evaluate a risk model, checking both its ability to order cases and the accuracy of any probability estimates. Then choose thresholds appropriate to the intended workflow, considering benefits, harms, capacity, and uncertainty. Assign cases according to clearly specified boundary rules and monitor outcomes within each group. If the model or population changes, the same labels may represent different actual risks. A category should therefore retain a link to its underlying score, definition, and version rather than become an unexplained permanent label.
Three practical examples
- A maintenance team groups machines by estimated probability of a defined failure within a specified period to organize further inspection.
- A support service groups incomplete onboarding sessions by estimated likelihood of remaining unfinished, then tests whether an optional assistance offer is useful.
- A cybersecurity team groups alerts by an assessed likelihood and consequence framework to prioritize investigation. The third example can combine more than a model probability, so its risk definition should be explicit rather than assumed identical to the first two.
Think of it this way
Think of a weather service converting a detailed forecast into a few warning levels. The label helps people orient themselves, but the underlying probability, expected impact, and local conditions still matter. The analogy is limited because AI risk scores may be poorly calibrated or based on incomplete data. A confident-sounding category should not conceal those limitations or substitute for the actual decision policy.
Worked example
Suppose a fictional model estimates the probability that a device will fail within 30 days. A demonstration rule labels probabilities below 5% as lower risk, 5% up to but not including 20% as intermediate, and 20% or above as higher. Devices scored at 4%, 5%, 19%, and 20% receive lower, intermediate, intermediate, and higher labels respectively. The 19% and 20% cases are close in estimated risk despite having different labels. If 100 devices in the higher group each have a calibrated 25% probability, the expected number of failures is 25, not a guarantee that exactly 25 will fail or that every device needs the same intervention. These thresholds are illustrative, and the calibration assumption must be tested rather than inferred from the label.
Illustrative case study
Fictional case: Linden Maintenance introduces three risk bands but finds that staff interpret higher risk as certain imminent failure. The team adds the forecast horizon, score range, uncertainty guidance, and an inspection protocol. It evaluates whether the bands help allocate attention without overwhelming reviewers or neglecting failures in the lower band. This invented case illustrates how the meaning of a category depends on its communication and associated workflow, not only on the model that produced it.
Common misconceptions and mistakes
A lower-risk label does not mean zero risk, and a higher-risk label does not mean an event is inevitable. Good ranking does not guarantee calibrated probabilities. Arbitrary cutoffs can make nearly identical cases receive very different treatment. A model can also stratify cases accurately while the proposed intervention provides little benefit or creates harm. The highest predicted risk is not always the greatest expected benefit from action. Finally, grouping scores can hide uncertainty and variation within a band, so the original information should remain available where it supports a meaningful decision.
Business use
Explain why stratification is needed and what decision each band informs. Validate the model in the intended population and examine performance and calibration across relevant groups. Set cutoffs with appropriate domain input rather than borrowing labels from another product. Document capacity constraints and monitor whether actions taken after classification change the outcomes used for later evaluation. Provide review routes for erroneous inputs and uncertain cases. Reassess bands as conditions change, and avoid presenting a risk label as a complete assessment of a person or asset.
People also ask
Is risk stratification the same as predicting risk?
No. Prediction produces the estimate; stratification groups estimates into categories.
Are three bands always required?
No. The number and boundaries depend on purpose, and sometimes retaining a continuous estimate is more useful.
Does the highest-risk group automatically deserve one particular action?
No. Action also depends on expected benefit, consequences, feasibility, and the applicable decision context.
Check your understanding
Two devices have estimated risks of 19% and 20% and fall on opposite sides of a cutoff. Does the label difference prove a large underlying difference?
Answer: No. Their estimates are close, and uncertainty may be larger than the gap. The threshold's purpose and consequences should be considered explicitly.
Related terms
- Calibration
- Discrimination
- Threshold (for decision trees)
- Stratification
- Decision analysis
- Uncertainty
- risk prediction
- threshold
- expected benefit
- probability estimate
- risk score
Learn next
Define a hypothetical event and forecast horizon, then propose two possible stratification rules. Compare which cases change categories and why that matters for the workflow. Identify the evidence needed to show that using the categories improves decisions rather than merely simplifying a dashboard.
More in Governance, ethics and safety
- Responsible AI - Responsible AI is the practice of developing, deploying, using, and governing AI with attention to its effects on people, society, and the environment.
- Retention limit - A retention limit is a defined boundary on how long data or records are kept for a particular purpose.
- Retraining - Retraining updates a previously trained machine-learning model through another training process using different training data.
- Risk-averse - Risk-averse describes a decision maker who prefers a certain outcome to an uncertain prospect with the same expected outcome value.
- Risk control - A risk control is a measure intended to modify a risk, such as reducing the likelihood of an unwanted event, limiting its consequences, or improving...
- Risk-neutral - Risk-neutral describes a decision maker who compares uncertain prospects by their expected value in a specified outcome measure, without an additional...
Sources
Aalto Dictionary of Machine Learning, risk stratification entry: https://aaltodictionaryofml.github.io/ADictML_Main.pdf Frank Harrell, statistical glossary discussions of risk and discrimination: https://hbiostat.org/glossary/ NIST AI RMF, evaluating intended use and impacts: https://airc.nist.gov/airmf-resources/airmf/5-sec-core/
Previous: Risk set Next: Risk tolerance