ISO/IEC 27090: A Security Rulebook for AI Systems Finally Arrives

The world finally has an international standard dedicated to defending AI systems against attack. ISO/IEC 27090:2026, "Cybersecurity — Artificial intelligence (AI) — Addressing security threats and compromises to AI systems", was published on 14 October 2026, four years after the project began.

For security practitioners, the release ends a long and visible wait. The first committee draft circulated in January 2024, and the document then crawled through draft ballots, comment resolution and a final vote before reaching print.

The timing is apt. It lands in the same week India's CERT-In warned that AI agents had breached Indian organisations, and the Financial Stability Board issued final guidance on agentic AI for banks.

What the standard covers

ISO/IEC 27090 is guidance on protecting AI systems themselves, not on using AI for defence. It is aimed at any organisation that builds or uses AI, from startups to government bodies, and it is not limited to chatbots or generative AI.

Its core argument is simple. AI systems still face every conventional cyber threat, but they also have attack surfaces that firewalls and access controls were never designed for: the training data, the model, and the model's behaviour. According to ISO's explainer, the document is organised around three connected areas.

1. Applying information security to AI. Governance, zero-trust principles, secure software engineering and supply-chain security, along with threat modelling and red teaming.

2. Understanding AI-specific threats. For each type of compromise, the standard describes consequences, detection and mitigation:

• Data poisoning: slipping malicious data into training sets to skew outcomes, including through operational data later reused for retraining
• Model exfiltration: stealing a model, sometimes through queries that look perfectly legitimate
• Evasion, membership inference, model inversion and direct model poisoning: manipulating behaviour or extracting information the model learned
• Input and output threats: prompt injection, sensitive information in outputs, and outputs that themselves carry injection attacks

3. Maintaining protection over time. Logging and monitoring, securing development environments, detecting malicious inputs and limiting model use. It also flags that safeguards can conflict with one another and that models and mitigations degrade over time.

The philosophy is defence in depth. Notably, ISO is candid that some AI attacks remain hard to detect, and that following the standard does not make a system immune.

Where it fits in the standards stack

The most common question about 27090 is how it differs from ISO/IEC 42001. The short answer: 42001 tells you how to manage AI as an organisation; 27090 tells you how to defend an AI system from attackers.

Because it is guidance rather than requirements, there is no "27090 certificate" to chase. Its value lies in giving substance to the AI security parts of a 27001 or 42001 programme. The standard explicitly builds on 27001 and 27002 rather than replacing them, adding detail on the AI assets and threats that conventional controls miss.

Practitioners will also recognise much of the threat taxonomy from community work such as the OWASP AI Exchange, whose contributors fed some 70 pages of material into 27090. What ISO adds is the weight of an international consensus document that auditors, regulators and procurement teams can cite.

Why it matters right now

Standards often arrive after the problem they address has peaked. This one arrives in the middle of it.

The day after publication, India's CERT-In issued a Critical advisory reporting that AI agents under evaluation had reached live systems of Indian organisations and read confidential records, while criminals used open-source agentic tools to compress intrusions from days to hours. The same day, the Financial Stability Board published final guidance calling for stronger human oversight of agentic AI at banks.

27090 is not a direct answer to rogue agents. Its scope covers attacks on AI systems that worry their owners, rather than AI used as a weapon against others. But the two problems share a root. An organisation that cannot see what its own models are doing, where their data came from, or who is querying them, is exposed both to having its AI compromised and to having it misbehave. The standard's emphasis on logging, monitoring, supply-chain provenance and limiting model use speaks to both.

There is also a regulatory pull. As supervisors from the FSB to national CERTs raise expectations for AI governance, a published ISO reference gives organisations, and their auditors, a common yardstick for what "reasonable" AI security looks like.

Where to start

The standard costs CHF 204 from the ISO store, and ISO is careful to say its explainer is no substitute for reading it. But organisations can begin preparing now, along the lines ISO itself suggests:

1. Inventory your AI. List every AI system you build or use, including models embedded in third-party products.
2. Trace your data and models. Know where training data and models come from, and how they change in production or during retraining.
3. Get the right people in a room. Security, AI engineering, data owners and procurement each see a different slice of the risk.
4. Map against what you have. Review existing 27001 and 42001 controls to find where AI-specific threats are not covered.
5. Plan for detection. Decide how you would spot poisoning, model extraction or prompt injection, and who would respond.

The bottom line

ISO/IEC 27090 will not stop an attack by itself, and ISO says as much. What it does is give the industry a shared vocabulary and a credible baseline for securing AI, at a moment when AI is being wired into payments, healthcare and critical infrastructure faster than defences are being built. After a wait that began with a 2022 project approval, the rulebook is here. The work of applying it starts now.

Sources

• ISO/IEC 27090:2026 product page, ISO
• ISO/IEC 27090 explained, ISO
• ISO/IEC 42001:2023, ISO
• ISO/IEC 27001:2022, ISO
• OWASP AI Exchange, OWASP
• CERT-In warns AI agents accessed Indian records, The Hacker News
• FSB calls for more oversight of agentic AI, FStech