TPR reinforces expectations on the use of AI in pension schemes

Many trustees have been reviewing the use of AI by, and on behalf of, their scheme and the governance that sits around this, following publication of the Pension Regulator’s AI plan in May this year.

The Regulator has now published new guidance on the use of artificial intelligence (AI) in pension schemes. It is not intended to establish new and separate regulatory requirements. Instead it builds on the Regulator’s AI plan and explains how trustees’ existing duties apply to the use of AI.

It’s intended to help trustees ask the right questions, oversee the use of AI and manage the risks effectively and in a practical and proportionate way. So, what does this mean for pension scheme trustees? 

What are the key principles? 

The guidance outlines seven key principles which should guide trustees’ approach: 

1. start with the problem, not the technology: AI should be used to solve real problems and support better member outcomes, efficiency and value for money 
2. human responsibility remains central: Trustees remain accountable, including where work is outsourced. AI should support, not replace, trustee judgment and meaningful challenge 
3. governance is ongoing, not one-off: Trustees should keep AI risks and controls under review on an ongoing basis. Oversight and human involvement should be proportionate to the risks
4. plan for disruption: Trustees should understand AI dependencies and include them in business continuity planning, so their scheme can keep operating if AI fails or becomes unavailable
5. good AI starts with good data: Trustees should use accurate and appropriate data, understand its limitations and protect it through effective data handling and data protection arrangements
6. transparency and explainability underpin trust: Trustees should consider what members need to understand, where AI affects them, and be able to explain AI-informed decisions 
7. support fair and accessible outcomes: Trustees should address bias, reflect vulnerable and digitally-excluded members’ needs, and ensure outcomes comply with scheme rules

What role and accountability do trustees have? 

The use of AI does not change trustees’ existing duties. The guidance makes clear that trustees remain responsible for making sure their scheme is governed and administered effectively and in line with legal and regulatory requirements, regardless of which technologies are being used or whether scheme processes are outsourced or managed internally.

Where AI is being used by service providers and advisers, trustees should obtain assurance that it is appropriately governed and controlled.  

The guidance lists ten questions the Regulator expects trustees to be able to answer for any significant use of AI, whether internally or by service providers. These include: 

• what AI do we use and why? 

• what data does it use? 

• who is accountable?

• what happens if it fails? 

Trustees do not need to become AI experts. However, they should be in a position to understand what they are told, identify risks, challenge where needed, and know when to take external advice. This may require specific training or advisory support on AI.  

A proportionate, risk-based approach 

In line with the Regulator’s AI plan, trustees are expected to establish clear governance and accountability for any significant AI use. They should consider both the likelihood of harm and the impact on members if the system fails.  

Helpfully, the guidance makes clear that the level of oversight should be proportionate to the risk. For example, a narrowly-focused administrative tool may need lighter controls than a system that interacts with members or is integral to trustee decision-making. Predictive, generative and more independent AI tools may also raise different risks. 

Governance tools could include: 

• an AI register – to record where significant AI is used and for what purpose 

• risk logs – to track AI-related risks, controls, and review points 

• AI policies – to set expectations for use by trustees, advisers, staff, or providers 

• business continuity and disaster response plans – to cover AI-related dependencies, failures, or service disruption 

• clear escalation routes – so issues can be reviewed, and addressed quickly, and 

• an AI committee, or other central group – to consider AI across the business

Some of these might be AI-specific, while others could be built into existing governance arrangements.

Trustees should also have arrangements to identify when AI may have contributed to an error or caused member harm, with processes to escalate and address issues quickly. 

Managing service providers

Trustees should request information from service providers and advisers about AI use (including AI-enabled features within existing software) and assess its significance. They should seek assurances about the provider’s governance arrangements and how risks are managed.

This should happen both before entering into an agreement and on an ongoing basis, including when there are changes.

The level of oversight and the information and assurance that is sought (and how quickly) should reflect the risks and potential impact of the AI use, as well as the size, nature and complexity of the scheme.

Relevant considerations may include (among other things): 

• how staff are trained to use AI appropriately 
• who owns and oversees AI use and the outputs from it 
• where the AI systems are operated from 
• how AI use is covered in business continuity and resilience plans 
• how data protection, data handling and access controls apply to AI use 
• how issues are escalated and managed, and 
• what certifications, assurance reports or standards are used

Ultimately, the Regulator expects trustees to use their judgment to decide what assurance is appropriate and whether further information or action is needed. It also expects trustees to consider how this should be reflected in their contracts with service providers.

Decision-making and members 

AI should support, rather than replace, trustee judgement, professional advice and meaningful challenge, and trustees should be alert to the risk that AI outputs may appear authoritative even when they are incomplete or inaccurate.

Where AI has significant influence on a decision, trustees should be able to explain the tool used and its purpose, the information and any assumptions the output was based on, the human checks made, the reasons for accepting or departing from the output, and who made the decision. This includes AI used by advisers and other service providers. 

There is no general requirement to tell members about every use of AI, although particular legal requirements may require disclosure in some circumstances.

Data, resilience and cyber security 

Using AI can increase the impact of poor-quality data. Before using AI, trustees should consider the data protection implications and policies should limit the data entered into approved AI tools to the minimum necessary.

Trustees should also be alert to staff or advisers using public AI tools outside approved processes. AI risks should feed into business continuity and exit planning, and trustees should check that existing cyber and scam controls (for example, how bank-detail changes and transfer requests are verified) remain effective against AI-enabled fraud and cyber-attacks.

Trustees also need to understand how AI impacts their digital resilience and consider ‘war game’ type testing to help them to better understand the steps needed to ensure their scheme is managing AI-related cyber risks appropriately (including the speed at which mitigating actions need to be taken, which may be far faster than current processes envisage).

What should trustees do now? 

Trustees who have not yet mapped their scheme’s use of AI and put in place suitable governance arrangements should do so now. A good starting point is for trustees to take steps to: 

• understand how AI works, how it is developing, the potential benefits, and the associated risks and regulatory expectations, and 
• understand how AI is currently being used by and on behalf of their scheme 

Trustees should then: 

• put in place a governance framework which works for their scheme now and which is capable of evolving as the technologies and their uses develop
• review and, where necessary, update their agreements with their scheme administrator, advisers and other service providers to cover the use of AI
• build AI into existing cyber reviews of advisers and service providers
• test whether controls and business continuity plans are likely to work in practice, for example through scenario planning, and
• strengthen the quality of scheme and member data used by AI, where necessary

Trustees need to build reviewing AI-related risks into their scheme’s risk management cycle, so that they can harness the opportunities this creates while continuing to manage the risks effectively. They should also explore with their investment advisers how AI might impact scheme investments (as the Regulator has also recently highlighted the importance of trustees managing AI concentration risk). 

They will also need to decide where it may be necessary to inform members about AI use. 

Comment 

Many of these expectations will be familiar from the Regulator’s AI plan, but the guidance adds more detail and practical examples which trustees should consider.

The FCA has also recently shared examples of good and poor practice relating to AI use by financial services firms, includes examples of AI governance frameworks. Schemes may want to take these into account when designing their own governance arrangements. 

The Regulator’s guidance highlights the fact that the use of AI by, and on behalf of, schemes is evolving rapidly, as is the impact of AI on businesses, investments, financial markets and cyber security. It is vital trustees understand the opportunities and risks and takes steps to harness and manage these.

How can we help? 

Our pensions, commercial and data protection teams have extensive experience helping organisations (including pension schemes) harness AI and manage the risks. Speak to your usual Eversheds Sutherland adviser to discuss how we can help you put in place effective and proportionate measures for your scheme. 

Webinar 

8 December 2026 12.00pm - 1:00pm GMT 

Join our webinar on the Use and Oversight of AI by pension schemes to gain practical insights into the steps you should be taking to understand and manage the risks for your scheme.

Register here