Summary

  • The Pensions Regulator says trustees remain responsible for AI in both in-house and outsourced pension-scheme processes.
  • AI can enter through an update to existing software; trustees must track significant use, changes, human review and routes to correct member harm.

If a pension provider adds AI to existing software through an update, which board remains answerable for the service? The Pensions Regulator’s answer is the trustees. Its detailed guidance, published on 29 October, says existing duties continue to apply whether a system is run inside the scheme or supplied by an administrator, adviser or other provider.

The exposure can arrive with a software release, not a new purchase. TPR says AI may be embedded in software a scheme already uses, introduced during an agreement, and not presented as a separate AI tool. The agreement can stay in place while the service changes. Trustees should assess significant AI use before entering an agreement and when relevant changes occur, including changes to the model, data, function, access or scale.

That makes the service—not the product label—the control point. Trustees should know what AI is used, why it is there, which decisions it can influence, what data it handles, who owns the use, how it is tested and how a person can challenge or override its output. TPR expects trustees to keep records of the checks and of the reasons for accepting or rejecting AI-informed material.

Providers cannot answer with a glossy corporate policy alone when the system could affect a scheme or its members. TPR says assurance should relate to the service the scheme receives; generic information may not be enough. Trustees should ask how the provider controls access and data, who reviews outputs, what logs are kept, how issues are escalated, and whether the service can continue if the AI fails or disappears.

The guidance connects those questions to a member’s remedy. Trustees should be able to identify when AI contributed to an error or harm, escalate it, correct the record or process, and provide appropriate redress. Where AI affects a member’s experience or outcome, trustees should consider what the member needs to understand and where to get help. TPR does not set a general notice requirement for every AI use; it keeps the focus on the effect on the member.

TPR presents this as applying existing trustee duties, not creating a separate AI rulebook. It suggests practical records such as an AI register, risk log, continuity plan, escalation route and ongoing evaluation, sized to the system’s likely impact. A board-paper summarizer checked by staff does not need the same controls as a system that interacts with members or can shape a consequential process.

TPR’s published guidance gives no scheme-by-scheme AI inventory or total system count; that record would show how widely the technology is used. Its assignment of responsibility is already clear: trustees need to know what their software does before an update turns an unseen feature into a member-facing decision.

Sources: TPR’s detailed AI guidance; 29 October announcement; TPR AI plan.