Use of artificial intelligence (AI) in pension schemes

This guidance is for trustees and scheme managers and may also help pension service providers understand and prepare for the questions trustees are likely to ask. It builds on our existing AI plan to explain how existing duties apply to the use of AI and supports its responsible use in members’ interests.

Published: 29 October 2026

Overview

The term AI, as used in this guidance, means the design and use of machine-based systems that can perform tasks that would previously have needed human intelligence. These tasks can include learning, reasoning, pattern recognition, communication, and problem-solving. AI can vary in how independently it operates and how much it adapts after it is put in place.

Recent advances in AI and the widespread availability of AI software and tools have led to increased adoption across many sectors, including in the pensions industry. AI is already being used, or considered, across areas such as scheme administration, member communications, data analysis, governance support and provider services – as well as by members. It can create opportunities to improve efficiency and member outcomes. However, AI can also introduce new and amplified risks and potential harms, particularly where AI affects members, supports decisions, or uses scheme or member data.

Understand AI-related terms

Discussions around AI can include a lot of technical language. Our data and digital industry working group has produced a jargon buster to help you understand some of the terminology used when talking about AI. This tool can help provide a consistent base of terminology for discussions with service providers and advisers.

About this guidance

The focus of this guidance is the responsible use of AI to support the running of pension schemes. It does not provide detailed guidance on wider scheme risks related to the use of AI by third parties, such as cyber attacks, scams, or fraud. Trustees should continue to manage those risks through existing cyber and scam controls. See our cyber security principles and scams guidance.

This guidance is intended to help trustees ask the right questions, apply oversight, manage risks and support responsible innovation in members’ interests. It is not intended to establish new and separate regulatory requirements, but to help you apply existing regulatory expectations to AI use in a practical and proportionate way.

The topics and examples included are intended to illustrate key considerations and are not exhaustive. As AI technologies, uses, and regulatory frameworks continue to develop, trustees should keep their approach under review. We will continue to monitor developments and engage with relevant regulators and organisations to help identify emerging risks, share good practice and support a co-ordinated approach where appropriate.

Key principles

When considering how AI use impacts your work as a trustee or scheme manager, these key principles should guide your approach.

Start with the problem, not the technology: Use AI to solve real problems and support better member outcomes, efficiency and value for money.
Human responsibility remains central: Trustees remain accountable, including where work is outsourced. AI should support, not replace, trustee judgement and meaningful challenge.
Governance is ongoing, not one-off: Keep AI risks and controls under review throughout its lifecycle. Oversight and human involvement should be proportionate to the risks.
Plan for disruption: Understand AI dependencies and include them in business continuity planning, so the scheme can keep operating if AI fails or becomes unavailable.
Good AI starts with good data: Use accurate and appropriate data. You should understand its limitations and protect it through effective data handling and data protection arrangements.
Transparency and explainability underpin trust: Consider what members need to understand where AI affects them and be able to explain AI-informed decisions.
Support fair and accessible outcomes: Address bias, reflect vulnerable and digitally excluded members’ needs, and ensure outcomes comply with scheme rules.

Trustee duties and accountability

The use of AI does not change your existing duties and responsibilities as a trustee, including your fiduciary duties. You remain responsible for making sure your scheme is governed and administered effectively and in line with legal and regulatory requirements, regardless of which technologies are being used.

Trustees must continue to act:

in line with the trust deed and rules
in members’ best interests
in accordance with legislation
impartially, prudently, responsibly and honestly

You should also be satisfied that arrangements are in place to identify when the scheme’s use of AI has contributed to an error or has caused member harm. When this happens, there should be processes in place to escalate and address these issues quickly. There should also be clear routes for correction and appropriate redress where needed.

Trustees are responsible for all scheme processes, whether outsourced or internal, and should obtain assurance that providers’ AI use is appropriately governed and controlled. You should ensure that your own use of AI is consistent with these duties and does not create risks for the scheme or its members.

Every trustee or scheme manager should be able to answer the following questions for each significant use of AI. This covers use of AI internally and from service providers:

What AI do we use?
Why do we use it?
What member outcome or internal process does it improve?
What decisions may it influence?
What data does it use and how is the data handled?
Who is accountable?
How is it tested?
How can a decision be challenged by the users, or by members?
How can humans override it?
What happens to the process if the AI fails or becomes unavailable?

Knowledge, skills, and understanding

Trustees do not need to become AI experts or understand every technical detail of each system used. However, you should have enough understanding to:

interpret what you are told about AI use
identify risks and challenge it where needed
recognise when it may have significant consequences for the scheme or members
know when it is appropriate to take external advice

In line with the trustee knowledge and understanding requirements, you should consider if the board, or specific individuals, require specific training or advisory support on AI. You should also seek assurance that providers have the necessary skills and training to use and govern AI. You should assess whether the level of assurance is appropriate for how the provider uses AI.

For example: if a provider says that member complaints are triaged by an independent AI system, trustees should understand enough to ask what that means in practice. This includes knowing:

what the system does
what personal data it accesses
how the data is processed and stored
how it affects members
where people remain involved
what could go wrong
how employees are trained to use it
what legal requirements must be considered by using AI in this way

You should know when further advice or assurance is needed. This level of understanding should be enough to ensure strategic oversight and risk management.

Governance and oversight

Existing expectations for trustees include having systems of governance and internal controls that are proportionate to the size, nature, and complexity of their scheme. This applies where AI is used throughout the scheme, whether it is used by trustees, scheme staff, advisers, or external providers.

As set out in our AI plan, trustees should establish clear governance and accountability for significant AI use. You should consider both the likelihood of harm and the impact to members if the system fails. The aim is to make sure you can:

identify where AI is being used
understand and mitigate the risks
allocate responsibility
monitor changes
respond if something goes wrong

This expectation is in line with existing trustee knowledge and understanding, governance, and systems and processes requirements. You may also want to consider how your use of AI aligns with your environmental, social and governance (ESG) policies, where relevant.

AI may be embedded within existing software or introduced through system updates and may not always be presented as a separate AI tool. This could happen at any time during an agreement’s lifecycle. You should request information from providers about relevant AI-enabled features and assess their significance using governance frameworks. This assessment should happen both prior to entering into an agreement and when there are changes.

A narrowly focused administrative tool may need lighter controls than a system that interacts with members or is integral to trustee decision-making. Predictive tools, generative tools, and more independent AI tools may also raise different risks. Once you have assessed the use, you should decide what governance arrangements need to be updated or created. As a starting point, you may be able to use existing governance documents and processes to support initial evaluation, rather than creating separate AI-specific documents.

The Financial Conduct Authority’s guidance on good and poor practice in the use of AI may also provide useful practical examples.

What might different levels of risk look like?

These examples are non-exhaustive and illustrative only. You should consider risks within the context of your scheme.

Low risk: An enterprise-level internal AI tool is used for routine first-drafting of internal documents, summarising meetings, or other efficiency tasks. It is not used for activities affecting member outcomes, decision making or external communications.

Medium risk: AI produces first-draft benefit specifications from scheme rules, deeds and amendments. The source material and outputs affect benefit administration, so an incorrect interpretation could later affect calculations or member outcomes. However, the AI supports rather than makes the final decision, and human quality assurance and sign-off reduce the risk.

High risk: An AI customer service system provides 24/7 member support using highly sensitive information. It can independently carry out multi-step interactions at scale, potentially including changing records or initiating transactions. Incorrect or incomplete responses could affect member choices and outcomes, particularly if escalation controls are weak. The system and its outputs would be reviewed periodically or if an issue is reported.

You should consider governance before any significant new AI uses are adopted. Where a provider may have already implemented these uses, trustees should identify and consider these within their governance processes.

Governance arrangements should include a way to identify significant changes to the model, data, function, access, or scale of use. They should also define how decisions are made on whether those changes require further scrutiny, assurance, or updates to controls.

Depending on the use, governance tools you could consider include:

an AI register – to record where significant AI is used and for what purpose
risk logs – to track AI-related risks, controls, and review points
AI policies – to set expectations for use by trustees, advisers, staff, or providers
business continuity and disaster response plans – to cover AI-related dependencies, failures, or service disruption
clear escalation routes – so issues can be reviewed, and addressed quickly
an AI committee, or other central group – to consider AI across the business
evaluation frameworks and ongoing monitoring tools

Managing providers and AI use

As outlined, trustees are accountable for AI use throughout the scheme. Where AI is used by external providers, trustees will usually oversee these providers through relevant information, assurance, contractual arrangements and regular review – rather than by directly controlling the provider’s systems.

The level of oversight should reflect the risks and potential impact of the AI use, as well as the size, nature and complexity of the scheme. Information and assurance should be relevant to the services provided to the scheme. Generic information may not be enough where the use could significantly affect the scheme or its members.

Relevant areas may include, but are not limited to:

the provider’s AI policy and where it applies to the service
how staff are trained to use AI appropriately
who owns and oversees AI use and generated content across its lifecycle
what records, audit logs and documentation are kept
where the AI systems are operated from
how AI use is covered in business continuity and resilience plans
how data protection, data handling and access controls apply to AI use
how issues are escalated and managed
what certifications, assurance reports or standards are used

This is not a checklist and obtaining this information does not, by itself, demonstrate that trustees or providers have met their legal or regulatory obligations. You should use your judgement to decide what assurance is appropriate and whether further enquiry or action is needed.

Where you cannot obtain sufficient assurance or are not satisfied that a provider’s AI use is appropriately governed, you should consider what further action is reasonably available. This may include asking for additional information, escalating concerns, or agreeing changes to controls. If existing contractual arrangements do not align with the scheme’s governance arrangements for AI, you should consider what changes are needed when contracts are entered into, renewed or varied, and take legal advice where necessary. Trustees should record their assessment and any limitations on the action they are able to take.

Before entering into an arrangement, you should also consider exit provisions, including how scheme and member data will be transferred or returned if the scheme changes provider or brings the service in-house.

Where possible, you should find out whether AI systems used by the scheme interact with one another. This includes where outputs from one AI system may become inputs into another, and any significant dependencies on AI providers, models or the wider technology supply chain.

Decision-making and human involvement

AI can support decision-making by helping organise information or analysis for review. It should support, rather than replace, trustee judgement, professional advice and meaningful challenge. You should be alert to the risk that AI outputs may appear authoritative even when they are incomplete or inaccurate. They may also change between generations, or when prompts and context change.

As a trustee, you should be able to show how you reached a decision. This includes demonstrating that you understood the relevant information, applied appropriate scrutiny, took professional, technical, and/or legal advice where needed, kept suitable records, and used your own judgement.

Where AI has significant influence on a decision, you should be able to explain:

what AI tool or system was used and for what purpose
what information and assumptions the output was based on
what human checks or reviews were made against the AI output
the reasons for accepting, rejecting, or departing from the AI-informed output
who was responsible for making the decision

This includes where AI has been used by advisers or other service providers to contribute to decision-making.

Example of AI use by a board

A trustee board agrees to use an approved AI tool to summarise board papers and identify themes for discussion. The tool does not make decisions or provide recommendations. However, its outputs could influence the issues trustees focus on, so the board treats the use as medium risk.

Before using it, the trustees confirm what information may be entered into the tool and check the provider’s data-handling arrangements. They also agree that secretariat staff will review summaries. The board:

records the purpose and limitations of the tool
makes clear that trustees remain responsible for reading relevant papers and using their own judgement
keeps the arrangement under review

If summaries are significantly inaccurate or do not include important context, use of the tool is paused while the issue is investigated.

Trustees could consider safeguards such as checking important outputs against trusted sources, keeping suitable human review, and understanding limitations before AI-supported analysis informs a significant decision.

As good practice, trustees could consider whether there is clear documentation on:

what the AI system can do
where a person must review an output
which activities require meaningful human involvement
what meaningful human involvement means in each circumstance
when AI activity can be paused or overridden
who remains responsible for the outcome

This is particularly important where AI goes beyond producing information or analysis and begins to plan and complete a chain of tasks with limited human involvement.

The aim is to preserve clear human responsibility and effective oversight as AI becomes more capable, without assuming that every AI-supported process needs the same level of human involvement.

Managing key risks

Risk management

The level of risk will depend on how and where AI is used. A low-risk use is likely to be narrow in scope and unlikely to either affect members or result in a reportable regulatory breach if something goes wrong. A higher-risk use is more likely to interact with members or regulatory or legal requirements (such as UK GDPR, see the data protection section below). It could also impact investment, member, or trustee decisions. The level of oversight, challenge and assurance should be proportionate to that risk.

As with other risks, you should:

identify, record, evaluate and regularly review AI-related risks to the scheme
maintain documented internal controls in response to relevant AI risks
review arrangements for recording AI incidents

Risk assessment should not be a one-off exercise. AI-related risks should be reviewed as part of the scheme’s risk management cycle. This includes whether existing controls remain effective as the technology, uses, provider arrangements, law, regulation, or industry practice changes.

Business continuity considerations

Governing bodies are expected to have continuity plans that help schemes keep operating during disruption. You need to be able to identify when things go wrong with the application of AI or if the AI changes or becomes unavailable. Relevant AI risks should feed into continuity planning, exit planning, provider oversight, and change management. Testing and scenario planning can help trustees understand whether controls are likely to work in practice.

You should also consider whether increased use of AI could lead to higher volumes or greater complexity of member complaints. Assess whether the scheme and its providers have suitable processes and enough capacity to manage and respond during periods of increased demand.

Cyber controls

AI can affect cyber risk in both directions. It can increase risk by enabling more convincing scams, including phishing or social engineering. AI can also introduce new routes for data leakage or increase reliance on connected systems and third-party technology. AI may also support cyber resilience, for example by helping detect unusual activity, identify vulnerabilities or monitor threats. Where AI is used in this way, you should be satisfied that outputs are monitored through appropriate controls and human oversight.

You should also consider whether existing scam and fraud controls remain effective against AI-enabled fraud. This may include checking how payment instructions, bank-detail changes, transfer requests and other high-risk actions are verified, and whether staff and providers are trained to recognise more convincing impersonation or scam attempts.

Trustees should consider whether existing cyber controls remain effective where AI is used by the scheme, its providers, or advisers. This includes:

whether there are clear rules on approved AI tools
how data is protected
how AI use internally and externally affects cyber resilience
how AI-related risks are identified and escalated

This guidance does not cover wider cyber threats in detail. See cyber security principles for pension schemes for guidance on managing cyber risk.

Data and AI use

This section covers the data issues that sit beneath wider governance, provider oversight, and risk management arrangements.

Data quality

Data quality has always been important, but using AI can increase the impact of poor-quality data. AI systems process large volumes of information based on the data available. Where underlying data is inaccurate, incomplete or inappropriate for the purpose, this may contribute to poor member outcomes. Where AI is used, you should consider whether the relevant data is suitable and of good enough quality.

AI may also help improve data quality, for example by identifying gaps or inconsistencies in scheme data. Where AI is used in this way you should be satisfied that outputs are reviewed appropriately and that changes to member data are made through controlled and auditable processes. You can find out more about managing data in our data quality guidance.

Scheme use of data

AI tools process data that is fed into them to complete the relevant tasks. How data is stored and what happens to it will depend on the service and configuration. Some AI tools, especially freely available versions, may store the data shared with them. They may then use this data to train their models, or it could be stored or shared contrary to your data policy, depending on their terms and settings. You should know where data is stored and how it is used if it is shared with an AI tool. You should also understand how data can be extracted if the scheme exits the arrangement or stops using the tool.

Before introducing a new AI tool, trustees should establish whether the tool changes who acts as the data controller, joint controller, or processor for the relevant processing. You should check whether existing data governance and monitoring arrangements remain effective with AI use. This may include considering:

what data the AI is using and why
whether policies clearly set out what data may be entered into which approved AI tools, and limit use to only the minimum data necessary
whether data limitations could affect outputs or member outcomes
whether those responsible for AI use understand the limitations of the data
where data is stored and processed by service providers, throughout the process
whether there are appropriate controls around data access, handling, retention, and oversight – including training staff and providers
what new or updated data policies and agreements may be required

Trustees should also be aware of the risk of staff or advisers using public AI tools outside approved processes (also known as shadow AI). As these are not under the control of the scheme this could mean personal or business sensitive data is used in an unsafe tool, with potential negative legal and/or financial consequences. Documented policies around AI use and access to suitable tools and training can reduce this risk.

Data protection

If you are a controller under data protection legislation, you are responsible for complying with data protection law and for demonstrating the compliance of AI systems that process personal data.

For example, automated decision-making is a term that is defined in data protection legislation. It means using personal data to make a significant decision about someone using solely automated processing (ie there is no meaningful human involvement). Where automated decisions have a legal or similarly significant effect on people, you must ensure you do this lawfully and have appropriate safeguards in place. You should refer to ICO guidance on automated decision-making, including profiling and take advice if needed to ensure you meet your legal obligations.

There are many obligations outside of those relating to automated decision-making which apply when using AI systems that process personal data. You should seek appropriate legal advice where needed and refer to the ICO’s guidance on relevant technologies and issues where appropriate, for example:

Supporting and protecting members

Transparency, accessibility, and equity

Under our regulatory expectations, the use of AI does not, by itself, create a general requirement for schemes to tell members about every use of AI. Other legal or regulatory requirements may, however, require disclosure in particular circumstances.

AI use should support clear, accessible, and fair outcomes for members. Where AI directly affects a member’s experience or outcomes, trustees should consider what members need to understand, how they can access support, and whether any groups could be disadvantaged.

AI models may be trained on data that contains historical biases or harmful material, or that does not adequately represent the people affected by its use. They can reproduce or amplify these biases, leading to unfair or harmful outputs and outcomes. Bias can also arise from how a system is designed or used. This includes where it is applied in circumstances different from those it was developed for. You should consider potential sources of bias throughout the AI lifecycle, including:

what data is used
where that data comes from
whether the system is suitable for your members

Outcomes should be tested for different populations where relevant. For example, test whether bespoke communications give members the same information, regardless of their accessibility needs or how the information is presented.

Schemes should be member focused about transparency. This may be particularly relevant where a member receives personalised information generated using AI, where AI is used in a direct member interaction, or where a member may reasonably assume they are dealing with a person.

Where AI is used in a way that directly affects members, you should consider:

whether members should be told when AI significantly informs a personalised communication, interaction or outcome – including where legally required
whether information is accessible and useful – rather than technical or generic
whether AI-enabled services meet the needs of vulnerable or digitally excluded members and those who need adjustments
whether AI could affect member groups differently or reinforce bias
whether members can ask questions, access non-digital support, or request human involvement where appropriate
whether there is sufficient documentation of AI use to effectively respond to questions or complaints from members

Trustees should be fully aware of the legal requirements that apply across all areas. The Equality Act 2010 and EU AI Act may be particularly relevant. Trustees should assure themselves, including through additional legal and professional advice where needed, that they have appropriately considered relevant requirements.

Examples of how AI can support communications

AI can support call handlers by providing prompts during live calls and identifying signals for potential vulnerabilities, such as repeated requests for information which could indicate hearing difficulties or other support needs. Used in this way, AI augments staff rather than replacing their judgement and can help schemes target support more effectively.

Inclusive features such as speech-to-text and alternative formats can also help members who have hearing difficulties or struggle with written communications, without requiring them to self-identify as vulnerable. AI should not be the only method to identify vulnerable members.

Supporting members in the age of AI

Members are already using AI tools to help them understand financial information and plan for retirement. AI tools can produce information that looks correct but may be wrong or based on misinterpretations or assumptions that do not fit the member’s circumstances. This can be a risk where a tool gives information from the wrong jurisdiction or misses important scheme context.

Members may also input personal or pension information, including sensitive personal data, into AI tools that are not suitable. This creates a risk that their data is retained, used or shared in ways they do not expect.

AI can also make scams and fraud more convincing by creating realistic impersonations that appear to come from trusted organisations. This can make it harder for members to identify suspicious contact.

Schemes could warn members about the enhanced risk of fraud, the risks of using AI tools and signpost members to trusted sources. Trustees should continue to refer to our avoid and report pension scams guidance and wider scams materials when considering how to protect members from third-party scams and fraud.

Schemes may want to consider whether members are turning to AI because existing communications or support do not meet their needs. It might also be helpful to consider how communications could be interpreted or summarised by AI tools used by members, and whether important information, qualifications or context could be lost or misunderstood.

Member story

A member used an AI chatbot to help plan how to draw down their pension. The chatbot suggested a course of action but did not consider (or understand) the tax implications. This could have left the member with an unexpected tax liability. When the member contacted the scheme to carry out the plan, staff asked questions about whether they understood the wider implications. This prompted the member to seek advice from a regulated financial adviser and change their plan before taking any action. The example shows the value of clear warnings about the limitations of AI-generated guidance, access to human support, and appropriate signposting to regulated financial advice.