In Depth: How trustees can manage AI risks in their schemes

With artificial intelligence (AI) technologies affecting every aspect of financial services, it is vital that trustees and others in the pensions industry get on top of developments as much as possible.

That was the message from the Pensions Regulator’s (TPR) Cliodhna Judge at the Pensions UK Annual Conference in Liverpool this week. The regulator’s AI and cyber governance strategy leader set out six core principles for AI governance that will inform its work with trustees.

“The technology may be new, but the foundations and the fundamentals are the same: good governance, good data oversight in place, and oversight mechanisms.”

Cliodhna Judge, TPR

The regulator plans to publish more detailed guidance on AI governance later this year, but Judge made its overall expectations clear.

She explained that, while the regulator did not expect trustees to “understand every single line of code”, they remain accountable for how the technology is used by service providers.

“The technology may be new, but the foundations and the fundamentals are the same,” Judge said. “Good governance, good data oversight in place, and oversight mechanisms.”

Judge added that AI should “sit within existing frameworks” governing resilience and supplier oversight, and should not be pushed to the side as an IT project.

“Models evolve, risks evolve, and governance must evolve in parallel,” she said.

TPR’s six principles of AI governance

The six principles, which will be expanded upon in the forthcoming guidance, are:

• Start with the problem, not the solution

“There’s a tendency for AI to be a solution looking for a problem to solve,” Judge said. “Instead, ask yourself how you will use AI to make things better for members. What is specifically being used to deliver better outcomes?

“Success is not adoption. It is about being able to say ‘members are better off because of what we did’.”

• Human responsibility for AI remains central

Judge was clear on accountability: “Whether AI is visible to members or remains behind the scenes, trustees are accountable for its use – including where they use outsourced services.

“It’s not about being an AI expert. Trustees need to exercise informed oversight, be able to ask the right questions, and challenge the answers… You can outsource the task, but not the responsibility.”

• Governance of AI use must be continuous, not a ‘one and done’ approach

Overseeing AI will require continuous work as the technology is developing particularly fast, Judge told delegates. “Initial approvals and due diligence are important, but these will not show how a tool will perform or react when it meets real data, real processes, and real members – or how that performance will change over time.

“Continuous governance means clear ownership, monitoring outcomes, and reviewing controls when something material or unexpected happens.”

• Transparency and explainability underpin trust

“This matters, particularly where the technology is less visible,” Judge said. “A useful test is, if AI supported a member outcome, could you explain how that outcome came about?

“This requires appropriate documentation, audit trails, testing of evidence, and escalation routes. You don’t need to build the model, but you do need to understand its impact.”

• Good AI starts with good data

As with many other areas of pensions, good outcomes will depend on good starting points – and accurate member data is key.

Judge said: “Data always matters; AI just raises the stakes. If the data going in isn’t accurate, complete, or well governed, the outputs won’t be either.

“Before trusting an AI-generated answer, understand the information behind it. What data is being used? Is it reliable?

“AI can improve your data, but only good governance can make it dependable.”

• Shared response to the challenges of members’ AI use

Finally, Judge highlighted the need for industry-wide collaboration to understand how members are using AI and how to mitigate the risks of poor outcomes.

“These tools are available to us around the clock,” she said. “They are certain. They are convincing. They are sometimes wrong. They don’t bear the consequences of the advice they give…

“Trustees, providers, regulators – we all have a role to play. TPR’s AI plan commits us to engaging with industry and regulatory partners to understand the impact of AI on the pension system and to help shape a shared response.”

Judge concluded that a scheme’s readiness was not measured by whether or not it has adopted AI, but “how its use is understood, how well it’s governed, and very importantly, how it’s delivering better outcomes for members”.

“These are really exciting times for pensions and for technology,” she added. “AI creates real opportunities to make pensions work better for members. The challenge is to seize these opportunities responsibly. AI is shaping the outcome. Readiness will make it work for members.”

Do trustee boards need new AI policies?

While the regulator was clear in its expectations, law firm Sackers sought to reassure trustees that AI governance can be incorporated into existing frameworks – something TPR’s Judge supported.

Hannah Savill, partner at Sackers, explained to delegates at the conference in Liverpool that recently updated governance rules – in particular TPR’s effective system of governance regulations – provided the “building blocks” for AI oversight.

She said many trustee boards had been considering whether new policies or documentation were needed for AI risks and usage, but emphasised that this was not necessary.

“The effective system of governance will already give you the basic building blocks of a good AI governance structure: your risk management framework, data protection arrangements, cyber controls, and management of third parties,” Savill explained.

“The key thing is to take each of these elements and add a layer on top that addresses the AI angle. You may still have some AI policies and risk assessments, but [in practice it is] a wrapper to sit on top of existing policies.”

Third-party providers will likely have their own governance processes for AI use, but Savill said trustees still needed to ensure they were aware of what these are and how they may change as AI technology develops.

“Ensuring adequate oversight of how those third-party providers are using AI is likely to be a core part of a good governance structure,” Savill continued.

“Beyond initial due diligence, there’s a separate question of whether regular information is reaching you about how providers’ use is changing over time. The pace of change is extremely high, but are you actually being notified of material changes?”

Savill said trustees could build in reporting requirements and other “guardrails” into agreements to ensure that they are kept informed of developments.

“AI adoption is very much here, and as trustees, you are responsible for compliance,” she concluded. “But while the technology is new, a lot of how you govern it will build on principles you are already very familiar with – you don’t need to start from scratch.”