Designing for model uncertainty
Shape an experience that stays trustworthy when the model is confident, wrong, or unsure.
A model that's right 90% of the time is confidently wrong the other 10%. Your interface decides which number the user remembers.
A probabilistic engine inside a deterministic-feeling UI
Traditional software either works or throws an error. AI features do neither cleanly — they return an answer that's usually good, sometimes subtly wrong, and occasionally confidently disastrous, all rendered in the same calm interface. Users can't see the probability. They only see the output, and they'll trust it exactly as much as your design invites them to.
So the design question isn't 'how do we make the model more accurate.' It's 'how does the experience behave across the model's three states — confident and right, confident and wrong, and unsure — so that trust survives the wrong answers.' A feature that only works when the model is right isn't designed; it's hoping.
Designing across the three states
- 01
Size the cost of a wrong answer
A wrong autocomplete is a shrug; a wrong dosage or wrong wire transfer is a catastrophe. Cost of error sets everything else.
- 02
Match commitment to cost
Low-cost errors can auto-apply. High-cost ones must stay a suggestion the user actively confirms — keep the human on the hook for the expensive mistakes.
- 03
Make correction cheaper than being wrong
If undo, edit, and override are one click, an occasional wrong answer costs seconds. Trust survives errors that are trivial to fix.
- 04
Show the seams, not false confidence
Surface sources, let users verify, and let the feature say "I'm not sure." A system that admits uncertainty is trusted more than one that's always sure and sometimes wrong.
- 05
Design the failure, not just the success
Decide what the empty, low-confidence, and clearly-wrong states look like before launch. That's where trust is actually won or lost.
Cost of error shaping the design
Gmail Smart Compose
Near zero — a bad suggestion is ignored mid-keystroke.
Ghost text you accept with Tab or simply type past. Maximum convenience, no confirmation.
GitHub Copilot
Moderate — bad code is caught in review or tests, but wastes time.
Suggestions you explicitly accept or reject; the human stays the author of record.
An AI medical or legal draft
Severe — a confident error can cause real harm.
Framed as a draft requiring expert review, with sources exposed and verification built into the flow, never auto-final.
For an AI feature you use, what happens when it's confidently wrong? How much does the design make that mistake cost you — and how easily can you catch and undo it?
Design for the wrong answer, not the right one. Match how much the product commits to how much a mistake costs, and make being wrong cheap to catch and cheaper to fix.