ISO and IEC have published ISO/IEC 27090:2026, Cybersecurity – Artificial intelligence – Addressing security threats and compromises to AI systems. It gives guidance, rather than requirements, on understanding, detecting, and mitigating security threats that are specific to AI systems throughout their life cycle, and is designed to complement ISO/IEC 27001 and ISO/IEC 27002.
Key points
- It covers AI-specific threats such as data poisoning, model poisoning, evasion, membership inference, model inversion, model exfiltration, and prompt injection, with their likely consequences and mitigations.
- It is organised in three parts: applying information security to AI (including supply chain security, threat modelling, and red teaming), AI-specific threats and how to detect and mitigate them, and keeping protection effective over time through logging, monitoring, and protecting development environments.
- It takes a defence-in-depth approach and uses ISO/IEC 22989 and ISO/IEC 23053 for AI terminology and the machine learning framework.
- It complements ISO/IEC 42001: 42001 covers how an organisation manages AI, while 27090 focuses on security threats to the AI systems themselves.
Any organisation that develops, buys, or uses AI can use it, including security teams, AI developers, and those overseeing AI procurement. If you hold or are working towards ISO/IEC 27001 certification, consider using ISO/IEC 27090 to extend your risk assessment, Statement of Applicability, threat modelling, and supplier assurance to cover AI models, data, and pipelines, and align it with any ISO/IEC 42001 AI management system.
Source: ISO: ISO/IEC 27090:2026
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
