Recidivism & offender risk assessment in criminal justice (probation, prisons)

Prisons and probation services must decide how intensively to supervise, which programmes to offer and whether release is responsible. For decades this has used actuarial and structured-judgement tools; ML adds flexibility but rarely accuracy. This use case is legally sensitive: in the EU, a score based solely on profiling or personality traits is prohibited (AI Act Art. 5(1)(d)), and assessments supporting a human decision are high-risk. Only validated, transparent, audited, advisory tools are lawful.

Problem & value

• Today: staff combine file review, interviews and instruments such as OASys/OGRS (England & Wales), RISc (Netherlands) or RisCanvi (Catalonia, Spain). Resources for supervision and programmes are scarce and must be allocated by need.
• AI value: consistent, evidence-based triage (low-risk cases get lighter supervision), better targeting of treatment, and an auditable basis for decisions. The value is allocation and consistency, not prophecy.
• Sobering evidence: in the widely studied COMPAS tool, ProPublica's analysis of over 7,000 people arrested in Broward County found only about 61 % of those scored as likely to reoffend were arrested again within two years, and false-positive rates differed strongly by group (44.9 % for Black vs 23.5 % for white defendants) [3]. Dressel & Farid found COMPAS (137 features) reached ~65 % accuracy, comparable to laypeople (~62 %) and a logistic regression on just age and prior convictions (~66.8 %) [4]. Complex ML does not reliably beat simple models here.

Variants

• Static actuarial scores (age, prior offences): simple, transparent, long-validated (OGRS-style).
• Dynamic / needs-based tools (structured professional judgement): staff-rated needs that can change with treatment (OASys, RISc, RisCanvi).
• Violence-specific or sexual-offence tools: narrower populations, higher stakes.
• Prison regime and early-release support: classification, release-planning, parole-board dossiers.
• Research use / evaluation: service-level cohort studies and programme-effect evaluation (see causal-inference) without individual scoring.
• Not lawful in the EU in typical form: a pure ML score from behavioural, social-media or personality data used to label a person as likely criminal (see Risks).
• Private use: none.

How it works

1. case file + structured assessment (trained assessor interview)
2. feature construction (criminal history, age, needs items) — no protected-attribute proxies without legal basis
3. validated model (logistic regression / gradient boosting, calibrated)
4. risk band + factor explanation + uncertainty
5. human assessor / probation officer / board decides, may override with documented reasons
6. monitoring: calibration, group fairness, override rates, outcome follow-up

• Models: regularised logistic regression and gradient-boosted trees (tabular-ml) with monotonic constraints and calibration; transparent scorecards are favoured by regulators and courts.
• LLMs (llm-general) are suitable only for ancillary tasks such as summarising case files for the assessor, never for producing the score; hallucination and bias risks are unacceptable in this setting.
• Human-in-the-loop: the score is advisory; the decision-maker must be able to understand, challenge and override it, and the person concerned must be able to contest it.

Data preparation

The data are small but legally delicate. Typical sources: the case-management system, criminal-record registers, sentence and custody records (often several systems per state), assessor interview forms (partly paper or PDF scans) and later reconviction data from a separate register.

Typical gaps: fragmented identifiers across systems, free-text needs assessments, inconsistent coding of offences over time, missing or delayed outcome data, historic bias in the records, unclear access rights and purpose limitation.

Preparation steps: 1. Inventory sources and owners, then map fields to the instrument's items (PREP-002, PREP-004). 2. Link records with a pseudonymised key and agree legal basis and purpose (PREP-022, PREP-025). 3. Digitise paper assessment forms and recode offence categories consistently (PREP-006, PREP-019). 4. Harvest outcome labels (reconviction, return to custody) with a fixed follow-up window (PREP-020). 5. Build a held-out temporal and subgroup test set with forensic experts (PREP-018).

Effort: data linkage, cleaning and validation set-up typically take well over half of the project (rating: high). See also GUIDE-003 for a readiness check.

Implementation paths

Which path for whom

• Public (probation, prisons, justice ministries): Path C — offender data is highly sensitive and must stay in the ministry's secure environment; a transparent scorecard or boosted-tree model on HW1 is enough and can be validated locally.
• Enterprise (private providers, forensic and rehabilitation services): Path C — the same sensitivity applies and local validation on the actual population is the core of the work, so a bought foreign tool rarely fits.
• Developer: Path C — scikit-learn, Fairlearn and MLflow cover modelling, fairness audits and audit trails without sending data to third parties.

Path A — Buy (off-the-shelf)

• Public bodies mostly use state-owned or in-house instruments (OASys/OGRS in England & Wales, RISc in the Netherlands, RisCanvi in Catalonia). Commercial tools such as COMPAS (Equivant) or Static-99R/LS/CMI-family are widely used in the US/Canada; their use in the EU needs a full AI Act conformity assessment and justice-ministry validation on local data. No EU-vendor market leader exists; procurement is government-led. Choose A only if a validated tool exists for your jurisdiction and population.

Path B — Build on cloud APIs

Not sensible for scoring: sending offender data to third-party cloud APIs raises data-protection, security and legal-basis problems, and general-purpose LLMs add no validated accuracy. Cloud tabular AutoML inside a government-controlled EU region is the most that is defensible. LLM APIs may only help with non-decisive document summarisation under strict DPA.

Path C — Self-host (open source)

• Stack: scikit-learn, XGBoost/LightGBM, statsmodels; calibration and fairness tooling such as Fairlearn, AIF360, SHAP/InterpretML for explanations; MLflow for versioning and audit trail.
• Hardware: HW1 (CPU server); the data are small, tabular and sensitive, so on-prem within the ministry's secure environment is the norm.
• Effort: a data-science team plus forensic psychologists and legal counsel; operations are modest.

Path D — Custom training

This is the core of the use case: models must be trained and validated locally on reconviction outcomes of the actual population (temporal validation, external validation, calibration by subgroup). Needs thousands of cases with multi-year follow-up. Scandinavian registry-based tools such as OxRec (Sweden-derived, validated in several countries) show the registry-linkage route; check publications for current validation status before citing figures.

State of the art (2026)

• Accuracy plateau: predictive discrimination of well-built instruments is moderate; adding ML complexity or hundreds of features yields little over a handful of factors [4].
• Fairness is a trade-off, not a bug to fix: when base rates differ between groups, calibration and equal error rates cannot be satisfied simultaneously [5]. Choices must be made, documented and politically legitimate; they cannot be left to the vendor.
• Evidence on use: debate has moved from "can it predict" to "does it change decisions fairly and reduce harm", with external audits (e.g. of RisCanvi) and calls for transparency and contestability.
• Regulatory shift: the AI Act makes bias testing, logging, human oversight and documentation mandatory for high-risk systems; Art. 5(1)(d) bans solely profiling-based crime prediction [1][2].
• Limits: base-rate effects, label bias (reconviction measures policing, not offending), feedback loops, dataset shift after policy changes, automation bias in assessors, and low individual-level certainty.

Shared resources & combinations

• Shared building blocks: tabular-ml, calibration/fairness tooling, causal-inference and guardrails, all on HW1 CPU servers; MLflow/audit infrastructure is reusable.
• Related: PRED-029 (welfare/jobseeker profiling: same method family, same bias and Art. 6 issues), PRED-039 (place-based hotspot forecasting: different data, equally sensitive), PRED-028 (risk-based case selection), PRED-038 (legal analytics), SEC-022 (AI governance, FRIA, AI inventory).
• Combines naturally with: programme-effect evaluation (causal-inference) to decide which interventions work, and case-file summarisation for assessors.

Effort, cost & KPIs

• Path A: months of procurement and local validation; licence cost varies by contract.
• Path C/D: 12–24 months including data linkage, validation study, legal review and staff training; main costs are people, not compute.
• KPIs: discrimination (AUC) and calibration on local data, by subgroup; false-positive/negative rates by group; override rate and reasons; share of cases contested; reconviction outcomes by supervision level; assessor training coverage; documentation completeness.

People & change

Involve management and the ministry or authority leadership first, then the data owners and legal-compliance before any data is linked. The DPO must be in from the start: this is systematic evaluation of people with special-category-like data, so a DPIA (Art. 35 GDPR) is required and a legal basis must exist (GUIDE-005). Assessors and probation officers (end-users) co-design the instrument and the override process.

Works/staff council: yes. In public bodies the staff council (Personalrat, BPersVG/state laws) is involved; in private providers the works council under §87(1) no. 6 BetrVG applies because override rates and assessor behaviour can be logged, and §90(1) no. 3 requires early information about AI-supported work processes. §80(3) allows an AI expert to be engaged (GUIDE-004).

AI literacy: support assessors with training on what the score means, calibration, bias and when to override; AI Act Art. 4 requires measures to support literacy, not a guaranteed level (GUIDE-006).

Pilot and concerns: start with one region or unit in parallel running, without effect on decisions. Staff fear de-skilling and blame; address this by documenting that the score is advisory and the decision always stays with a human who can override with reasons. The person concerned must be able to contest (GUIDE-008, GUIDE-009).

Risks, regulation & compliance

• EU AI Act (classification: depends):
• Prohibited (Art. 5(1)(d)): risk assessments of natural persons predicting criminal offences based solely on profiling or on assessing personality traits. The prohibition does not apply to systems that support a human assessment already based on objective and verifiable facts directly linked to criminal activity [1].
• High-risk (Annex III, point 6): systems assessing the risk of a person offending or re-offending not solely based on profiling, or assessing personality traits or past criminal behaviour [2]. Providers and deployers must meet Arts. 9-15 and 26 (risk management, data governance, logging, human oversight, accuracy), registration, and a fundamental-rights impact assessment (Art. 27) for public bodies. Obligations for Annex III systems apply from 2 December 2027 (postponed from August 2026 by the Digital Omnibus on AI, Reg. (EU) 2026/1744).
• Typical lawful designs: validated instruments built on criminal history and assessed needs, advisory only. Pure behavioural or personality-trait scoring (e.g. from social data) cannot be implemented in the EU.
• GDPR / Law Enforcement Directive (EU 2016/680): criminal-offence data are specially protected; automated individual decisions with adverse legal effect are restricted; need legal basis, DPIA, purpose limitation, and transparency. National penal-execution law (e.g. German StVollzG and state laws, Bewährungshilfe rules) sets further limits.
• Discrimination: protected attributes and close proxies (postcode, nationality) require legal and statistical scrutiny; group fairness audits are mandatory in practice.
• Mitigations: advisory use only, documented override, contestation channel, independent audit, public model documentation, regular revalidation, ban on use of the score as sole ground.

Getting started

1. Establish the legal basis with the justice ministry and data-protection authority; run the AI Act classification and a DPIA/FRIA first (SEC-022).
2. Inventory the instruments already in use and assess local validity against reconviction data.
3. Build a transparent baseline (logistic scorecard on age and criminal history) and compare any ML model against it, by subgroup and over time.
4. Train assessors on interpretation and overriding; set up logging and an appeals route.
5. Plan yearly calibration and fairness audits with external reviewers.

Sources

1. AI Act, Article 5 (prohibited practices, 5(1)(d)) — https://artificialintelligenceact.eu/article/5/
2. AI Act, Annex III (high-risk systems, point 6 law enforcement) — https://artificialintelligenceact.eu/annex/3/
3. ProPublica — Machine Bias: risk assessments in criminal sentencing — https://www.propublica.org/article/machine-bias-risk-assessments-in-criminal-sentencing
4. Dressel & Farid — The accuracy, fairness, and limits of predicting recidivism (Science Advances, 2018) — https://pmc.ncbi.nlm.nih.gov/articles/PMC5777393/
5. Kleinberg, Mullainathan, Raghavan — Inherent Trade-Offs in the Fair Determination of Risk Scores — https://arxiv.org/abs/1609.05807