Author: Eunoia Consulting Co. | Published: July 27, 2026
Not all AI systems in healthcare carry the same risk. This guide introduces a practical four-tier risk stratification framework that helps healthcare organisations calibrate governance requirements — avoiding over-governance of low-risk tools and under-governance of high-risk ones.
Not all AI systems in healthcare carry the same risk. A scheduling chatbot that helps patients book appointments operates in a fundamentally different risk environment than a clinical decision support tool that influences diagnostic conclusions or treatment recommendations. Yet many healthcare organisations apply the same governance processes — or no governance processes — across all AI deployments regardless of their risk profile.
AI risk stratification is the practice of categorising AI systems according to their potential to cause harm, and calibrating governance requirements accordingly. It is the foundation of any mature, scalable AI governance programme. Without it, organisations either over-govern low-risk tools (creating bureaucratic friction that slows adoption) or under-govern high-risk ones (creating patient safety and regulatory exposure).
The NIST AI Risk Management Framework and the EU AI Act both recognise that AI risk is not uniform. The EU AI Act explicitly creates a tiered classification system — prohibited AI, high-risk AI, limited-risk AI, and minimal-risk AI — with governance obligations scaled to each tier. Healthcare organisations operating in or serving EU markets must align their internal governance frameworks with this classification.
In the United States, the FDA's framework for AI-enabled medical devices applies a similar logic: software that influences clinical decisions receives more rigorous oversight than software that supports administrative functions. HIPAA's risk analysis requirements under the Security Rule also implicitly require organisations to assess the risk profile of systems that process protected health information — including AI systems.
For healthcare organisations, the practical imperative is clear: governance resources are finite, and they must be directed where the risk is highest.
The following framework provides a practical starting point for risk stratification. It is designed to be adapted to your organisation's specific context, regulatory environment, and AI portfolio.
Tier 1 — Critical Risk
AI systems that directly influence clinical decisions with patient safety implications. This includes clinical decision support tools that recommend diagnoses, treatments, or medications; AI systems that interpret diagnostic imaging or pathology results; predictive models used in triage or deterioration detection; and any AI system whose output is used without mandatory human review in a clinical context.
Governance requirements at this tier are the most stringent: mandatory clinical validation before deployment, ongoing performance monitoring with defined thresholds for intervention, documented human oversight protocols, bias testing across patient demographics, and regular third-party audits.
Tier 2 — High Risk
AI systems that influence clinical workflows or patient outcomes indirectly, or that process sensitive patient data at scale. This includes AI-assisted documentation tools (ambient scribing, automated coding), patient communication and engagement platforms that personalise clinical messaging, revenue cycle AI that makes billing and coding recommendations, and predictive analytics used for resource allocation or staffing decisions.
Governance requirements include pre-deployment validation, defined performance metrics with monitoring, documented data governance controls, and periodic review cycles.
Tier 3 — Moderate Risk
AI systems that support administrative operations without direct clinical implications. This includes scheduling optimisation tools, supply chain and inventory AI, HR and workforce management tools, and financial forecasting models.
Governance requirements focus on data quality, vendor due diligence, and periodic performance review.
Tier 4 — Low Risk
AI systems with limited scope and low potential for harm. This includes general-purpose productivity tools (AI writing assistants, meeting summarisation), marketing automation, and internal knowledge management tools that do not process patient data.
Governance requirements are minimal: standard vendor assessment, acceptable use policy acknowledgement, and inclusion in the AI inventory.
Risk stratification begins with knowing what AI systems your organisation is actually using. This sounds obvious, but in practice most healthcare organisations significantly underestimate their AI footprint. AI capabilities are embedded in EHR systems, practice management platforms, billing software, communication tools, and productivity suites — often without explicit disclosure by vendors.
A comprehensive AI inventory should capture: the system name and vendor, the function it performs, the data it processes, the clinical or administrative workflow it touches, who approved its deployment, and its current risk tier assignment.
The inventory is a living document. New AI capabilities are released continuously by existing vendors, and new tools are adopted through departmental purchasing decisions that may not surface to governance teams. Establishing a process for ongoing inventory maintenance — including a requirement that new AI tool adoptions trigger a governance review — is as important as the initial inventory exercise.
Several patterns consistently lead to misclassification and governance gaps.
Underestimating embedded AI. Organisations frequently classify their EHR as a Tier 3 or Tier 4 system without accounting for the AI capabilities embedded within it. If your EHR includes a sepsis prediction model, a deterioration alert, or an AI-assisted coding tool, those capabilities warrant Tier 1 or Tier 2 classification regardless of the overall system classification.
Conflating vendor compliance with governance. A vendor's SOC 2 certification or HIPAA Business Associate Agreement does not constitute AI governance. These frameworks address data security and privacy, not AI performance, bias, or clinical validity. Vendor compliance is necessary but not sufficient.
Ignoring aggregate risk. A single low-risk AI tool may be genuinely low risk in isolation. But an organisation running 40 low-risk AI tools across clinical and administrative functions has created a complex, interdependent AI environment that warrants a higher level of systemic governance attention than any individual tool would suggest.
Failing to reassess after updates. AI systems change. A model update, a new training dataset, or an expanded use case can materially alter a system's risk profile. Governance frameworks must include a trigger for re-stratification when significant changes occur.
Risk stratification is not a one-time exercise — it is a governance capability that must be embedded into your organisation's AI lifecycle management processes.
At the intake stage, every new AI tool or capability should be assessed against the risk framework before deployment approval. The stratification outcome determines the governance pathway: Tier 1 systems require clinical validation and executive sign-off; Tier 4 systems may proceed with a streamlined review.
At the monitoring stage, risk tier determines the frequency and intensity of ongoing performance review. Tier 1 systems should be monitored continuously with defined performance thresholds and escalation protocols. Tier 4 systems may require only annual review.
At the retirement stage, risk tier informs the decommissioning process. High-risk systems require careful transition planning to ensure continuity of care and data integrity.
Eunoia Consulting Co. helps healthcare and veterinary organisations design and implement AI risk stratification frameworks that are practical, scalable, and aligned with NIST AI RMF, EU AI Act, and FDA guidance. Our AI Governance service provides the strategic foundation your organisation needs to govern AI at scale — without creating bureaucratic barriers to innovation.
This article was produced by the Eunoia Consulting Co. Editorial Team. Eunoia Consulting Co. specialises in AI governance, healthcare operations, and data strategy for healthcare and veterinary organisations.