The Pensions Regulator (TPR) has published guidance on the use of artificial intelligence (AI) in pension schemes. The guidance does not create new legal requirements or change trustees' existing duties. It explains how those duties apply when AI is used by the trustee board or the scheme's advisers and service providers and sets out seven principles that TPR expects trustees to follow.
AI should be used to solve real problems and improve member outcomes, efficiency, and value for money.
Trustees remain accountable for everything done for the scheme, including outsourced work. They should ensure their use of AI is consistent with their legal duties and does not create risks for the scheme or members. For each significant use of AI, whether by the trustee board or a service provider, trustees should be able to say:
Trustees do not need to be AI experts, but they should understand enough to follow what they are told, spot risks, ask challenging questions and know when to take outside advice. They should consider whether they need AI training.
AI should support, not replace, trustee judgement, professional advice and meaningful challenge. Trustees should remember that AI outputs can look convincing even when they are wrong.
Where AI significantly influences a decision, including where used by advisers or service providers, trustees should be able to explain what service was used, what it relied on, what human checks were made, why the output was accepted or rejected, and who made the decision.
Data protection law contains specific rules on decisions with significant effects on individuals that are made solely by automated means. The Information Commission has produced draft guidance on automated decision-making which states that, when assessing the level of "automated decisions", human approvals or oversight must be active and meaningful.
Trustees should establish clear governance and accountability for significant AI use and AI-related risks and controls should be incorporated into the scheme's risk management framework, keeping them under regular review.
Oversight should be proportionate to the risk. A narrowly focused administrative tool may need lighter controls than a system that interacts with members, or which is integral to trustee decision-making. Predictive, generative and more autonomous AI tools may also raise different risks.
Trustees should obtain scheme-specific information and assurance from service providers on their AI use, and ensure contracts align with the scheme's AI governance arrangements.
Trustees should understand the scheme's AI dependencies, and business continuity plans should cover AI failing or becoming unavailable. Relevant AI risks should also be reflected in exit planning, service provider oversight, and change management.
AI magnifies the effect of poor-quality data, so trustees should consider whether data used for AI is suitable and of sufficient quality. Data protection law requires data controllers to ensure that personal data is accurate, and individuals have a right to object to inaccurate processing.
They should also protect scheme and member data through effective data handling and data protection arrangements: knowing where data goes, checking data protection responsibilities before introducing a new service, and guarding against "shadow AI" (use of unapproved public AI services).
There is no general requirement to tell members about every use of AI. However, where AI directly…
