A model can advise a trustee. It cannot be one.
On 30 April 2026, APRA published its letter to industry on artificial intelligence, drawn from what it describes as a targeted engagement on a group of selected large banks, insurers and superannuation trustees in late 2025. The letter is not a prudential standard and it does not need to be. It sets out what APRA now expects regulated entities to have in place, and superannuation trustees are squarely inside its scope.
The expectations are sensible and, by now, familiar. APRA wants ownership and accountability across the AI lifecycle, an inventory of AI tooling and use cases, human involvement for high-risk decisions and accountability, and staff trained on the use, misuse and limitations of AI. It also delivered a pointed observation about boards. Many boards, APRA said, are still developing the technical literacy required to provide effective challenge on AI related risks, and there is an overreliance on vendor presentations and summaries without sufficient examination of the key risks.
For a superannuation trustee, though, the letter is the softer of the two constraints in the room. The harder one is written into the SIS Act, and it has been there for a long time.
The duty AI runs into
A registrable superannuation entity licensee holds members' retirement savings on trust. The covenants in section 52 of the Superannuation Industry (Supervision) Act 1993 are the core of what that means in practice, and three of them matter directly the moment an AI system starts touching a decision.
Section 52(2)(b) requires the trustee to exercise, in relation to all matters affecting the entity, the same degree of care, skill and diligence as a prudent superannuation trustee would exercise. Section 52(2)(c) requires the trustee to perform its duties and exercise its powers in the best financial interests of the beneficiaries. And section 52(2)(h) requires the trustee not to enter into any contract, or do anything else, that would prevent it from, or hinder it in, properly performing or exercising its functions and powers.
Read those together and the AI problem comes into focus. The care and diligence covenant assumes a mind is being applied. The best financial interests covenant assumes a judgement is being made in members' interests. And the covenant against hindering the trustee's own functions is the one that a poorly bounded AI most easily offends, because a system that makes or effectively dictates a decision the trustee is meant to make itself is, in substance, something the trustee has done that hinders it from exercising its function properly.
This is not an argument that AI is forbidden in super. It plainly is not, and APRA itself warns that failing to embrace AI may put a business at a strategic disadvantage. It is an argument that the SIS Act draws a line the vendor's product roadmap does not. Some decisions can be supported by a model. Some decisions the trustee has to make, and be able to explain, itself.
Support the decision, or make it
The single most useful thing a super fund's risk and compliance function can do with AI is to keep clear which side of that line each use case sits on.
On one side are the systems that support a discretion. A model that summarises a long external manager report, drafts a member communication for a person to approve, flags an unusual pattern in unit pricing for a human to investigate, or organises the evidence in a complaint before an officer reads it. In each case a person still forms the judgement and can explain it. The AI made the person faster or better informed. The discretion stayed with the trustee.
On the other side are the systems that make or dictate a discretion. A model that sets or rebalances asset allocation without a person exercising investment judgement. A tool that prices or declines insurance in super on an individual member. An automated process that resolves a financial hardship application, or determines the outcome of a member complaint, with no person applying their mind to the decision. Here the discretion has moved. Even where the model is accurate, the trustee is now in the position of having done something that hinders its own proper exercise of a function, and of making a decision it may not be able to explain in the terms the covenants assume.
The distinction is not about how sophisticated the AI is. It is about whether a decision reserved to the trustee has quietly become a decision made by a system.
The spend is a duty too
There is a second, less obvious way AI meets the best financial interests duty, and it is the one that catches trustees who think of AI as an IT decision rather than a governance one.
Section 52(3A) of the SIS Act puts it beyond doubt: the best financial interests obligation applies in respect of payments to a third party by, or on behalf of, the entity. The cost of a large AI platform, an enterprise licence, an implementation program, or a build, is a payment. Like any other fund expenditure, it has to be justifiable as being in members' best financial interests, and the burden of showing that sits with the trustee.
APRA has reinforced the same discipline through the member outcomes framework. When it strengthened SPS 515 in July 2024, effective from 1 July 2025, it pointed to better practice of an annual attestation that controls are in place and operating effectively to prevent expenditure that would be unjustifiable against the duty to act in members' best financial interests. An unbounded AI spend, adopted on the strength of a vendor deck and a promise of efficiency, is exactly the kind of expenditure that framework exists to test.
So the AI business case in a super fund is not only a technology and risk document. It is a best financial interests document, and it has to survive as one.
What this means for GRC practitioners
The instinct in some funds will be to treat AI adoption as an operational efficiency program that risk signs off at the end. For a superannuation trustee, that sequence is backwards. The duties bite at the point of adoption and at the point of every consequential decision, not at the point of review.
Three shifts follow. First, the compliance question moves from is the model accurate to has a decision moved. Accuracy matters, but a highly accurate system that has taken a discretion the trustee must exercise is a governance problem regardless of its error rate. Second, procurement becomes a covenant event. The moment the fund commits spend, the best financial interests duty is engaged, so the business case has to be built to that standard before the contract is signed, not reconstructed afterward if APRA asks. Third, board challenge becomes the control APRA is watching. The letter's remark about overreliance on vendor summaries is a direct instruction: the board has to be equipped to ask what decision this system makes, who is accountable for it, and why the spend is in members' interests, and to be dissatisfied with a demo as the answer.
Five controls to put around AI in a super fund
- Build an AI-decision register, not just an AI inventory. APRA wants an inventory of AI tooling and use cases. Go one step further and record, for each use case, what decision it touches and who is accountable. The register is the artefact everything else hangs off.
- Classify every use case as supports or decides. For each entry, make a documented call: does this support a trustee discretion, or make or dictate it? The classification is the control. Anything that decides is escalated before it goes live.
- Put a hard human gate on anything that decides. Where a use case would make or dictate a decision reserved to the trustee, either redesign it so a person forms and can explain the judgement, or do not deploy it for that purpose. Meaningful human involvement here is not a review screen no one reads. It is a person exercising the discretion.
- Write the spend as a best financial interests case. For any material AI expenditure, hold a business case that states the expected member benefit, the cost, and why the payment is justifiable in members' best financial interests under section 52(3A). Tie it into the SPS 515 expenditure controls, not a separate IT approval.
- Equip the board to challenge. Give directors a plain-language map of the fund's AI decisions and the accountable owners, so board challenge rests on more than a vendor summary. The literacy APRA flagged is not optional now that it has been named.
A worked example: the pricing tool that crossed the line
Consider a de-identified fund, call it [ORGANISATION], reviewing an AI tool that promises faster insurance-in-super decisions on individual members.
Presented as an efficiency win, the tool assesses a member's circumstances and returns a decision to offer, load or decline cover. Under the old sequence, that ships as an operations project. Under a governance process built for the SIS Act, three things happen first. The use case is classified, and because the tool would determine an outcome on an individual member with no person exercising judgement, it lands on the decides side of the line. It is escalated, and the design is changed so the model prepares the assessment and a delegated person makes and records the decision, keeping the discretion with the trustee. And the spend is written as a best financial interests case, so if APRA asks why members' money bought this system, the answer is a document rather than a demonstration.
The tool still does most of the work. A person still makes the decision the law reserves to the trustee. That is the whole point.
Do this Monday
- Pull your AI use-case list and add a decision column. For every current or proposed AI use case, write in one line what decision it touches. If the column is empty, you have an inventory, not a register.
- Find the one that decides. Look for any use case where an outcome reaches a member without a person forming the judgement. That is your first escalation, today.
- Ask for one business case. Take your largest AI spend and ask whether it is documented as being in members' best financial interests under section 52(3A). If it is not, that is this week's gap.
- Give the board the map. Draft a one-page list of the fund's AI decisions and who owns each, so the next board conversation is a challenge, not a briefing.
APRA's letter tells trustees to keep humans involved in high-risk decisions. The SIS Act tells them why they must. A model can make a trustee faster, better informed and more consistent. It cannot hold the discretion the law gives to the trustee alone, and it cannot spend members' money on a promise. Keeping those two lines visible is the governance job that AI just made urgent.
Content disclaimer: This article is for general educational and informational purposes only. It does not constitute legal advice, regulatory guidance, or a substitute for professional compliance judgement. Regulatory obligations vary by entity type, licence, and circumstance. Always refer to primary source guidance from APRA or the relevant regulatory authority.
Primary sources
- APRA, Letter to Industry on Artificial Intelligence (AI), 30 April 2026. https://www.apra.gov.au/news-and-publications/apra-letter-industry-artificial-intelligence-ai
- Superannuation Industry (Supervision) Act 1993 (Cth), s 52 covenants, including s 52(2)(b), (c), (h) and s 52(3A) (best financial interests, care and diligence, non-hindrance; third-party payments). https://www.legislation.gov.au/C2004A04633
- APRA, Prudential Standard SPS 515 Strategic Planning and Member Outcomes (member outcomes and expenditure controls), strengthened 4 July 2024, effective 1 July 2025. https://www.apra.gov.au/news-and-publications/apra-strengthens-core-prudential-standard-support-outcomes-members-super
- Department of Industry, Science and Resources, Voluntary AI Safety Standard, Guardrail 5 (human oversight), September 2024. https://www.industry.gov.au/publications/voluntary-ai-safety-standard/10-guardrails
TheAICommand. Intelligence, At Your Command.
