ISO/IEC 27090:2026 Cybersecurity, Artificial Intelligence, Addressing Security Threats and Compromises to AI Systems

Applies To

Overview

ISO/IEC 27090:2026 was published on 14 October 2026 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) as part of the established 27000-series information security standards family. The standard provides structured guidance for identifying and responding to security threats that are unique to AI systems, including attacks that manipulate the instructions or data an AI system receives, commonly known as prompt injection. It is designed to complement existing organizational practices around access control, credential management, system monitoring, and AI management systems rather than replace them. Organizations using AI agents, meaning AI systems that can take actions or use external tools autonomously, are specifically directed to use this standard to map and address the particular risks those agents introduce. The standard does not impose legally binding obligations but serves as an internationally recognized reference that can be cited in procurement requirements, audit frameworks, and regulatory compliance programs. Adoption is voluntary, though regulators and enterprise procurement teams in multiple jurisdictions may reference or require alignment with it.

Key Requirements

• •Identify and document security threats specific to each AI system across its life cycle, covering data, models, prompts, outputs and connected services.
• •Address attacks on training and models, including data poisoning, evasion and direct model poisoning.
• •Address attacks on privacy and intellectual property, including membership inference, model inversion, model exfiltration and model theft.
• •Address attacks on prompts and outputs, including prompt injection and output-based injection, and tool misuse by AI agents that call external services.
• •Integrate AI-specific security controls with existing access-control, credential-management and monitoring practices rather than treating AI security as a separate silo.
• •Align AI security practices with any existing AI management system the organization operates, such as one built on ISO/IEC 42001.

What Your Organization Must Do

• →Inventory all AI systems and AI agents currently deployed, noting which ones interact with external tools, data sources, or APIs, as these carry the highest exposure under this standard.
• →Conduct a gap assessment comparing existing information security controls against the AI-specific threat categories identified in ISO/IEC 27090:2026, prioritizing prompt injection and tool misuse scenarios.
• →Update information security policies and risk registers to explicitly include AI system threats, ensuring AI risks are reviewed alongside conventional cybersecurity risks.
• →Revise vendor and technology procurement contracts to require suppliers of AI systems or AI-enabled services to demonstrate alignment with ISO/IEC 27090:2026 controls.
• →Coordinate with security and engineering teams to implement monitoring capable of detecting anomalous AI system behavior, using the standard as a reference checklist for coverage gaps.
• →Reference ISO/IEC 27090:2026 in internal audit scope and board-level AI risk reporting to demonstrate a structured, internationally recognized approach to AI security governance.

Playbook Guidance

Step-by-step implementation guidance for compliance teams.

Frequently Asked Questions

Is ISO/IEC 27090:2026 legally binding, and can regulators require compliance with it?

ISO/IEC 27090:2026 is a voluntary guidance standard with no legally binding obligations on its own. However, regulators, procurement authorities, and enterprise clients in multiple jurisdictions may reference or contractually require alignment with it, making de facto compliance necessary in certain regulated or government supply chain contexts.

What is the official publication date for ISO/IEC 27090:2026 and what is its current status?

The standard is currently under draft review and is scheduled for publication on 14 October 2026. Organizations should monitor ISO and IEC channels for the finalized text, as requirements may shift before the official release date.

How does ISO/IEC 27090:2026 address prompt injection attacks specifically?

The standard explicitly categorizes prompt injection, including output-based injection variants, as a distinct AI security threat requiring dedicated controls. Organizations must map these attack vectors during their AI system life cycle assessment and integrate mitigations with existing monitoring and access-control practices.

How does ISO 27090 relate to ISO/IEC 42001, and do organizations need both standards?

ISO/IEC 27090 is designed to complement rather than replace ISO/IEC 42001, which covers AI management systems. Organizations already operating under ISO/IEC 42001 should use ISO/IEC 27090 to extend their AI governance into security-specific threat identification and control, treating the two standards as layered rather than competing frameworks.

Does ISO/IEC 27090:2026 impose specific requirements for organizations using autonomous AI agents?

Yes. The standard specifically directs organizations deploying AI agents, meaning systems that autonomously call external tools, APIs, or services, to map and address the particular risks those agents introduce. Tool misuse and external service exploitation are treated as priority threat scenarios requiring explicit controls and monitoring coverage.

Should vendor contracts be updated to reference ISO/IEC 27090:2026 before it is finalized?

Compliance teams should begin revising procurement and supplier contract templates now to include alignment with ISO/IEC 27090:2026 as a forward-looking requirement. Referencing the forthcoming standard in contracts signals governance maturity and positions organizations to enforce supplier compliance once the standard is formally published.