Superannuation · AI
Guide

How do you get value from AI that your members can rely on?

A secure member-facing assistant and a trustworthy one are different builds. Authentication and encryption decide whether a request was legitimate; they say nothing about whether the answer was right, and it is the answer a fund has to account for. This guide sets out the serving contract and the invocation record that make an AI answer defensible, traces the AI value chain that connects a member's question to the record that explains it later, and names what changes when a significant share of member records sit with an administrator rather than the trustee.

By Martin Barnier and Todd Noller, Lumaris
September 2026 · Guide
SuperannuationAIAI GovernanceData platformMember dataPrudential obligations
Inside the guide
  1. 01Why is it hard to find out what good looks like?
  2. 02What happens when an assistant answers a member?
  3. 03What is the AI value chain?
  4. 04What has to be true of your member data?
  5. 05How do you know the assistant did what you approved?
  6. 06What do you specify before the first member-facing assistant goes live?

Full guide delivered to your inbox

24%
Of Australian financial and insurance services businesses used AI in 2024-25, a 24-fold increase from 1 per cent in 2021-22.
Source: Australian Bureau of Statistics, Characteristics of Australian Business, 25 June 2026.
$300bn
In platform trustee member benefits across more than 977,000 member accounts, reviewed by ASIC's 2026 data monitoring assessment that found trustees overwhelmingly disappointing on data use.
Source: Australian Securities and Investments Commission, review of platform trustee data monitoring, June 2026.
10 Dec 2026
Commencement date for Australian Privacy Principle 1.7 to 1.9, requiring disclosure of the personal information used in automated decisions that significantly affect a person's rights or interests.
Source: Privacy and Other Legislation Amendment Act 2024 (Cth), Schedule 1 Part 15.

What to specify before the first member-facing assistant goes live, and why superannuation cannot wait for the guidance to catch up.

Covers why AI in superannuation is arriving ahead of a settled reference model, what ASIC's 2026 platform trustee review and the Cursor support-bot incident both show about ungoverned answers, the seven-link AI value chain and where trust attaches to it, what a serving contract needs beyond classification and provenance (authority and status), how to build the record of what an assistant actually did, and the four things to specify before the first assistant answers a member.

The seven-link AI value chain diagram, a reference architecture showing the AI gateway and the administrator boundary, worked examples on retirement projection assumption sets and successor fund transfers, and a four-point specification checklist for the first assistant deployment.

Delivered to your inbox. Name and email only.

No noise. Unsubscribe anytime. Your details are used only to deliver this guide and occasional Lumaris insights on the same topic.

Martin Barnier
Principal Consultant · Lumaris Consulting

Martin Barnier is Principal Consultant at Lumaris, an Australian-owned, vendor-neutral advisory firm specialising in AI, data, cyber security, cloud, and critical infrastructure. He is a security architect and technologist who works across all five domains, where most risk sits in the connections between them, not inside any one. Martin has over a decade of experience architecting security and technology across government, defence, national security, and health. Before Lumaris, he directed a large multidisciplinary practice at a Defence Prime delivering architecture, identity, cloud, and engineering capability for clients bound by APRA, Essential Eight, PSPF, and SOCI Act obligations. At Accenture, he was Lead Enterprise Security Architect for the Department of Health and Aged Care's Aged Care Transformation Program and Vaccines Response, and Lead Enterprise Architect for the National Security Portfolio and Department of Defence. Bachelor of Engineering (Robotics and Mechatronics), Swinburne University of Technology. TOGAF Practitioner, SABSA. Certified across AWS, Azure, and GCP. PRINCE2, Agile Scrum Master, SANS Cyber Incident Response Management.

View LinkedIn profile
Todd Noller
Principal Consultant · Lumaris Consulting

Todd Noller is Principal Consultant at Lumaris, an Australian-owned, vendor-neutral advisory firm specialising in AI, data, cyber security, cloud, and critical infrastructure. Todd is a delivery and operations leader who builds technology functions, governance frameworks, AI platforms, and the teams that run them. With over sixteen years across data, AI, and cyber delivery in regulated environments, Todd led the Complex Programs portfolio at a Defence Prime: a ~$40M book of cyber transformation spanning federal digital identity, enterprise integration, and security uplift. Prior to Thales, he stood up an investment management firm's entire technology function from scratch across New York and Australia, launching multiple SaaS products to SEC, FINRA, APRA CPS 234, and GDPR compliance within two years. At the Department of Defence, he coordinated national-scale cyber incident responses and served as Business Product Owner for a real-time threat intelligence platform. Todd spent three years as a Palantir specialist, including as a Country Manager for Palantir's Australian deployments. Bachelor of Information Technology (Web and Mobile Technologies), Deakin University. Diploma in Project Management. CISM (ISACA, in progress). Microsoft Sentinel, Microsoft Azure Fundamentals, SANS Incident Handling, Palantir Foundry.

View LinkedIn profile
Common questions

Questions about this guide

A serving contract is a short, specific statement of what the data platform will hand one named assistant, and what travels with the data: its classification, provenance, permitted purpose, currency, and for an AI consumer specifically, which source is authoritative and whether it is current or superseded. Most funds have never written this down.

Security controls such as authentication, encryption and tenancy decide whether a request was legitimate. They say nothing about whether the answer the assistant gave was correct, and it is the correctness of the answer, not the legitimacy of the request, that a fund has to account for to a regulator or a member.

A significant share of member records sit with an administrator rather than the trustee, so the fund's serving contract is often describing data it does not hold. CPS 230 already classifies fund administration as a critical operation and material service provider for most RSE licensees, so the specification has to reach across that boundary as a contract term, not just an architecture decision.

Four things: a serving contract per named assistant naming the authoritative and current sources, a record of what happened at every invocation, a named and owned corpus narrower than whatever the assistant's underlying permissions would allow, and proof that any answer a member could act on can be traced back to its sources.

Let us talk

If the guide surfaces something you want to work through, that is a good place to start.

Most conversations begin simply. Someone wants to know whether we are the right fit for what they are navigating.

Talk to usMore insights