The Pensions Regulator Sets Out Seven Principles for Trustees' Use of AI

The Pensions Regulator (TPR) has published guidance on the use of artificial intelligence (AI) in pension schemes. The guidance does not create new legal requirements or change trustees' existing duties. It explains how those duties apply when AI is used by the trustee board or the scheme's advisers and service providers and sets out seven principles that TPR expects trustees to follow.

1. Start with the problem, not the technology

AI should be used to solve real problems and improve member outcomes, efficiency, and value for money.

2. Human Responsibility Remains Central

Trustees remain accountable for everything done for the scheme, including outsourced work. They should ensure their use of AI is consistent with their legal duties and does not create risks for the scheme or members. For each significant use of AI, whether by the trustee board or a service provider, trustees should be able to say:

• What AI is used and why;
• What it improves and what decisions it may influence;
• What data it uses and how that data is handled;
• Who is accountable and how it is tested;
• How its decisions can be challenged and overridden by a person; and
• What happens if it fails.

Trustees do not need to be AI experts, but they should understand enough to follow what they are told, spot risks, ask challenging questions and know when to take outside advice. They should consider whether they need AI training.

AI should support, not replace, trustee judgement, professional advice and meaningful challenge. Trustees should remember that AI outputs can look convincing even when they are wrong. Where AI significantly influences a decision, including where used by advisers or service providers, trustees should be able to explain what service was used, what it relied on, what human checks were made, why the output was accepted or rejected, and who made the decision.

Data protection law contains specific rules on decisions with significant effects on individuals that are made solely by automated means. The Information Commission has produced draft guidance on automated decision-making which states that, when assessing the level of "automated decisions", human approvals or oversight must be active and meaningful.

3. Governance Is Ongoing, Not One-Off

Trustees should establish clear governance and accountability for significant AI use and AI-related risks and controls should be incorporated into the scheme's risk management framework, keeping them under regular review.

Oversight should be proportionate to the risk. A narrowly focused administrative tool may need lighter controls than a system that interacts with members, or which is integral to trustee decision-making. Predictive, generative and more autonomous AI tools may also raise different risks.

Trustees should obtain scheme-specific information and assurance from service providers on their AI use, and ensure contracts align with the scheme's AI governance arrangements.

4. Plan for Disruption

Trustees should understand the scheme's AI dependencies, and business continuity plans should cover AI failing or becoming unavailable. Relevant AI risks should also be reflected in exit planning, service provider oversight, and change management.

5. Good AI Starts With Good Data

AI magnifies the effect of poor-quality data, so trustees should consider whether data used for AI is suitable and of sufficient quality. Data protection law requires data controllers to ensure that personal data is accurate, and individuals have a right to object to inaccurate processing.

They should also protect scheme and member data through effective data handling and data protection arrangements: knowing where data goes, checking data protection responsibilities before introducing a new service, and guarding against "shadow AI" (use of unapproved public AI services).

6. Transparency and Explainability Underpin Trust

There is no general requirement to tell members about every use of AI. However, where AI directly affects members' experience or outcomes, trustees should consider what members need to understand, be able to explain AI-informed decisions, and ensure members can access human support. Under data protection law, automated decisions must also be transparent, and individuals may opt out of certain automated decisions.

7. Support Fair and Accessible Outcomes

AI can repeat or amplify unfair bias, so outcomes should be tested across different groups where relevant. Trustees should also consider the needs of vulnerable and digitally excluded members.

In addition, trustees should take into account members' own use of AI. Members increasingly use AI to understand financial information and plan for retirement, but these services can produce information that looks correct, but is wrong or based on misinterpretation. Members may also input personal information into unsuitable AI services, and AI can make scams more convincing. Schemes could warn members about these risks and signpost them to trusted sources.

AI-Related Investment Exposure

TPR has also published separate guidance to help trustees identify and manage potential hidden AI-related investment exposure. It has been produced in light of the increasing influence of AI and the companies developing AI on global markets which TPR believes has potential to create concentration risks that could leave investors more vulnerable in the event of a market downturn. The guidance sets out steps for trustees to take to ensure they understand their scheme's aggregate exposure and to test whether diversification will remain effective under stressed market conditions.

What Trustees Should Do

Although the guidance imposes no new legal requirements, trustees should review it and consider whether their existing arrangements for using AI in scheme business meet TPR's expectations and whether they should act to fill any gaps.

How Mayer Brown Can Help

We can assist trustees by:

• Advising on service provider contracts (including for administration services and AI tools) to ensure appropriate AI-related governance, risk allocation, and compliance measures are in place;
• Advising on other stages of service provider procurement including due diligence questionnaires relating to AI;
• Reviewing and drafting trustee policies on the use of AI;
• Reviewing and drafting related internal policies and risk management processes, such as business continuity procedures or incident response policies;
• Advising on specific AI-related legal issues, such as data protection, intellectual property, cyber security, governance, and risk management;
• Responding to and managing AI or technology-related security incidents or personal data breaches;
• Providing training on AI governance best practice, including identifying the types of AI use that carry legal risk; and
• Providing broader training and knowledge sessions, including cyber wargames with AI-related scenarios.