Pension trustees need to know when a provider adds AI to a service they already use. The Pensions Regulator's October 29 guidance makes that a practical oversight question: what changed, how does it affect the scheme's service, and is the existing assurance still relevant? Maetra recommends making the route from a provider's change notice to the scheme's review record explicit.
The regulator's guidance on AI use in pension schemes explains how existing duties apply. It expressly says it is not establishing new, separate regulatory requirements. A new guidance publication should not be described as a new AI law or a universal certification obligation.
A software update can change the assurance question
TPR says AI can be embedded in existing software or introduced through updates during an agreement's lifecycle. It asks trustees to obtain information about relevant provider features and consider their significance before an agreement and when changes occur. Provider assurance should reflect the service and risk; generic material may be insufficient where member outcomes could be significantly affected.
The guidance also emphasizes continuing human responsibility and proportionate oversight. Pensions Age's independent reporting confirms the October 29 publication and its distinction between existing duties and new requirements. Neither source establishes that any particular provider's controls are adequate.
Maetra's analysis concerns the evidence needed to review a changing service. The examples below are suggested implementation practices, not additional TPR requirements or a legal assessment of a scheme.
Route the change to the person who understands its effect
An update notice may reach an administrator or procurement inbox while the consequence belongs with the scheme's governance owner. Define who receives notices, who identifies potentially material changes and who can obtain further information. A software release number alone rarely explains which member process changed.
Consider a hypothetical administration system that adds an AI function for drafting personalized member replies. Ask whether it only prepares text for staff review, can send a reply, or can change a member record. Those capabilities create different review questions even if the provider presents them as one feature.
Record what is known and what remains unclear. Identify the affected service, relevant data, users and accountable provider contact. A trustee board does not need to reverse-engineer a model to ask whether its provider has changed the way a scheme process operates.
Request evidence for the service the scheme receives
Use the changed workflow to frame an assurance request. For the hypothetical reply assistant, ask which version and configuration the supplier assessed, who checks the draft and how staff can correct it. Establish whether the evidence covers the actual service being supplied rather than an unrelated product demonstration.
Maetra suggests keeping a compact record with these fields:
- The provider feature and the scheme process it affects.
- The stated change, its implementation date and the version reviewed.
- The evidence supplied, its scope and any limitations.
- The scheme's assessment, responsible owner and unresolved questions.
This proposed record is not a compliance checklist. TPR itself warns that obtaining information does not, by itself, demonstrate that legal or regulatory obligations have been met. The assessment needs judgement about the particular use, with professional advice where appropriate.
Follow dependencies through a service interruption
A new AI feature can also alter how the service continues when a component is unavailable. In the evaluation, ask which part of the member process depends on the feature and what happens if the provider disables it or changes the underlying service. Identify the people who can operate the fallback and the evidence needed to understand an interruption.
For the hypothetical drafting function, a bounded test could establish whether staff can still prepare replies without it. Record the tested conditions and remaining dependencies. Do not generalize a successful test into proof that every outage or provider exit will be manageable.
Keep the continuity question connected to the service description. An AI inventory checklist can help identify the tools, owners and dependencies involved. That description provides context for the assurance review; it does not replace the trustee's assessment.
Close the review with a reasoned decision
After a material change, record what was accepted, what needs further enquiry and what control or contractual follow-up remains open. Name the next review trigger so the same evidence is not silently reused after another significant change. Access to member information within the review record should remain appropriate to its purpose.
Maetra Comply supports evidence management and framework mapping. Use Maetra's framework resources to connect one applicable control to its owner, supporting evidence and review state. This helps organize the discussion; it does not certify a provider or determine whether a scheme has discharged its duties.
Sources
- The Pensions Regulator: AI use in pension schemes, published October 29, 2026. Primary detailed guidance on existing duties and proportionate oversight.
- Pensions Age: guidance publication coverage, October 29, 2026. Independent reporting confirming publication and scope.