Leveraging AI for Retirement Plans: Cautionary Advice

Do you know any businesses that are not on a quest to use artificial intelligence (AI) to enhance efficiency and outrun the competition? As AI makes its way further and further into our days (and data) it’s wise to remember that it does in fact require human oversight, and that goes at least double for AI use with employer sponsored retirement plans. As fiduciaries, plan sponsors have an obligation to ensure cybersecurity best practices are in use not just by their own employees (and beneficiaries accessing the plan), but by each and every vendor contracted to provide plan services. 

Human Accountability

At Invesco, Bonnie Treichel, Founder and Chief Solutions Officer at Endeavor Retirement, acknowledges that “AI can do many things to help support the fulfillment of fiduciary obligations,” but underscores: “AI cannot be a substitute for a fiduciary who is, under ERISA, responsible for the discretion over the plan assets and plan decisions, ensuring that they are in the best interests of participants and beneficiaries.” Treichel 

urges “human accountability for AI,” and points out: “AI can inform and support analysis, but fiduciaries retain ultimate responsibility for all decisions and client outcomes. If there is a problem or concern, plaintiffs’ attorneys, the Department of Labor (DOL), and the Internal Revenue Service will be looking for a firm or person to hold accountable, not AI.” Four additional key principles Treichel suggests for retirement plan fiduciaries related to the use of AI are: 

1. Understand and assess the source data environment: Fiduciaries should know what information the AI relies on, whether it draws from a closed, curated dataset (and which one[s]) or a broader, open environment. 

1. Evaluate model integrity and currency: Confidence in the information a fiduciary gathers from AI depends on how the AI platform is trained, tested, updated, and prompted for those results. 

1. Monitor risks, bias, and controls: Effective use of AI requires awareness of error rates, safeguards to mitigate bias, and the ability to override or challenge outputs. Just like humans, AI has been known to make mistakes due to bad data or inaccurate “prompts.” 

1. Ensure strong governance and oversight: Fiduciaries…should maintain clear internal policies, controls, and accountability frameworks governing AI use. Also, remember some AI tools…store inquiries and results in an unsecured environment.

Good To Know: Documenting Decisions

Because the standards for ERISA fiduciaries are process oriented, documenting how decisions are made has always been a critical task for plan sponsors. AI, of course is a great tool for helping with this, and Treichel offers these pointers for leveraging it appropriately: 

• There are two key benefits for fiduciaries when leveraging an AI notetaker during meetings. First, fiduciaries can gain efficiencies and save time in the meeting follow-up. Second, fiduciaries can focus more on the discussion and less on taking notes, which ensures a more productive and thoughtful meeting.

• The fiduciary risks of virtual notetakers and recording meetings include the potential for multiple sets of minutes that may be contradictory, as well as the potential for mis-transcribing or mis-transcribing recording more than was intended. 

• Best practices: Fiduciaries might want to consider the following with AI notetakers for meeting minutes:

• Ensure all parties have agreed to the use of the virtual notetakers.
• Do not save as a transcript from the meeting; rather ensure the fiduciaries are using a version that provides a summary and removes the recording.
• Leverage as a summary to support drafting minutes and not the final record.

Who Has Cyber Insurance? What Does It Cover

Although the Department of Labor (DOL) does not yet explicitly provide guidance about the use of AI with retirement plans, it does expect plan sponsors to attend to all three prongs of the cybersecurity protocols issued in 2021, and further clarified in 2024. Here are the links: 

• Cybersecurity Program Best Practices
• Tips for Hiring a Service Provider with Strong Security Practices
• Online Security Tips

When reviewing the DOL cybersecurity expectations, plan sponsors should pay particular attention to the protocols for monitoring the cybersecurity practices of all vendors. Risk management experts at Eisner Amper further underscore that given the “vendor heavy environment” most plans rely on, sponsors need to find out exactly how each vendor addresses cybersecurity—and that includes inquiring specifically about what their cyber liability insurance policies cover. When assessing insurance coverages (for vendors and their own businesses and liabilities) plan sponsors should keep in mind: 

• Vendor Policies Protect the Vendor: It’s likely that a recordkeeper’s insurance policy is primarily designed to defend their organization, not yours. If plan participants file a lawsuit naming you the plan sponsor or employer as defendants for imprudent vendor oversight, the recordkeeper’s policy may not cover your legal defense or settlement costs. 
• Coverage Limits Can Be Exhausted: Third party service providers probably aggregate data for many, many plans. If a major breach affects multiple clients at once, the vendor’s policy limits may be drained before all claims are satisfied.
• Disputed Fault & Slow Payouts: Insurers can dispute liability, arguing the breach originated from stolen participant credentials or a breach at the employer level (e.g., compromised HR emails). While third-party insurers litigate who is at fault, you and your business may be left funding defense costs out-of-pocket.
• Direct Plan Exposure: Most plan sponsors hold sensitive employee data on internal servers, HR systems, and payroll software. If a cyberattack originates inside your own network, a recordkeeper’s insurance may not be helpful.

Closing The Gaps

Because plan sponsors from small businesses tend to face the biggest hurdles implementing cybersecurity practices, Colonial Surety Company offers an efficient, affordable and clear solution. For a few dollars a day, plan sponsors can obtain protection for the company, the plan, and themselves, with a Cyber Liability+Fiduciary Liability Insurance package. In addition to providing defense costs and penalty limits up to $1,000,000 for the sponsor, this package addresses numerous DOL recommendations by explicitly covering the plan and the business with: 

• Expert-led response services following a data breach.
• Protection from lawsuits and regulatory actions related to the breach
• Legal services.
• Computer forensic services.
• Public relations and crisis management expenses.
• Notification services.
• Call Center services.
• Credit and Identity monitoring 

Protect your retirement plan, your business, and your personal assets in one smart move: bundle your ERISA Bond with Fiduciary and Cyber Liability Insurance at Colonial Surety Company. 

👉 Get Your Instant Quote & Download Proof of Coverage In Minutes

Why Choose Colonial Surety Company?

• Trusted & Reliable: U.S. Treasury Listed, Rated “A” (Excellent) by A.M. Best Company, and in business since 1930.
• Direct & Digital: Skip the middleman. Quote, purchase, and download your full protection package entirely online in minutes.
• The Carrier, Not a Broker: No agent markups, no waiting for a callback, and no unnecessary fees.
• National Reach, Local Support: Licensed nationwide with a knowledgeable, US-based customer service team ready to assist you.