On a Sunday evening a participant in an industry pension fund logs in to find out what the new pension rules mean for her. The portal carries the fund's name and colours. The answers come from an assistant that the administrator added to its platform earlier this year, built on a language model that the administrator buys from a company outside the European Union. The board learned of the assistant from a paragraph in a quarterly service report.
The fund in this picture manages a large pool of assets with a board office of a few people. Administration, fiduciary management and asset management are contracted out. Its own inventory of artificial intelligence is close to empty. What is used in its name is another matter: participant records pass through the administrator's assistant, and the asset managers use models for research and reporting.
The Digital Operational Resilience Act has applied since 17 January 2025 and covers pension funds; only schemes with no more than 15 members in total fall outside it. Article 28 says that a financial entity which uses outside providers of information and communication technology services remains fully responsible at all times. Before signing, the fund must carry out due diligence. The contract must state where data is processed and stored, and the arrangement goes into the fund's register of information. In 2025 De Nederlandsche Bank concentrated at pension funds on risk management, outsourcing and incident handling under this Act. In the same review it wrote, about its integrity supervision, that incidents at administration organisations had made clear that pension funds monitor their service providers insufficiently. For 2026 it announced closer examination of the risks of contracted out technology services at a selection of funds and administration organisations. The document also notes that administration organisations are not under its direct supervision. Its formal grip is on the fund.
The European Union Artificial Intelligence Act adds two duties that already apply. Since 2 February 2025 providers and deployers must take measures to support the artificial intelligence literacy of their staff. Since 2 August 2026 a person who deals with an artificial intelligence system must be told so, and the Autoriteit Financiële Markten wrote on 11 June 2026 that, once it is formally designated under the Dutch implementing act, it will check this at the licence holders of both supervisors, pension funds among them. The Act lists two uses in finance as high risk, credit scoring of natural persons and the pricing of life and health insurance. Pension administration is neither, so the obligations that apply from 2 December 2027 are unlikely to reach the portal.
The usual response is the administrator's yearly assurance report and a contract clause stating that the administrator complies with all applicable law. The report describes the controls that were in scope when the audit was planned, and an assistant added in spring is not among them. The clause is silent on which model reads participant letters and where that model runs. The board's calendar does the rest: the transition to the new pension system must be complete on 1 January 2028, and only 30 funds had made the move by 1 January 2026.
What the board can do in one meeting is decide the routes and write them into the outsourcing agreements. Participant records and correspondence may be processed by a model only in a private deployment in a European region or on the administrator's own premises. Board papers without personal data may go through the online interface of a model provider under contract. Investment research that contains no participant data is left to the asset manager, on condition that the manager discloses which models it uses. A private deployment in a European region keeps processing in the Union and leaves the provider subject to the law of its home country. A model on the administrator's premises removes the outside processor, and every other duty towards participants stays where it was.
The same eight questions then go to every supplier. What is in use in the fund's name. Who is provider and who is deployer; here the administrator uses the assistant under its own authority, and the fund stays answerable to its participants. Where the supplier file is. How the assistant was evaluated on real questions about this fund's scheme. What is logged, who reads samples of the answers, how the staff concerned were trained, and how fast a wrong answer reaches the fund as an incident.
The AI Guys, a Dutch firm that works on compliance for artificial intelligence in regulated industries, helps boards put these questions to their suppliers and act on the answers.
By the board meeting of November the member who holds outsourcing should have in hand a letter to the administrator, the fiduciary manager and each asset manager asking for every artificial intelligence system used in the fund's name and the data route of each. Next to it belongs a one page route decision adopted by the board. The third paper is a list of amendments to the outsourcing agreements: notice before a new system goes live, data locations, subcontractors including the model provider, access to logs and a term for incident reports. The fourth is an updated register of information.