ISO/IEC 27090:2026 is an international cybersecurity standard that helps organizations understand, detect, and mitigate security threats specific to artificial intelligence systems. Published on 14 October 2026, it addresses risks across the AI system life cycle, including threats to training data and AI models. Its relevance extends beyond technology teams: executives, cybersecurity leaders, risk professionals, auditors, and regulators all need to understand how AI-specific attacks can affect organizational security. This guide explains the standard’s purpose, the threats it addresses, and practical steps organizations can take to strengthen AI security.
What Is ISO/IEC 27090:2026?
ISO/IEC 27090:2026, titled Cybersecurity — Artificial intelligence (AI) — Addressing security threats and compromises to AI systems, provides guidance for organizations that develop or use AI systems. It focuses on understanding the consequences of AI-specific security threats and identifying ways to detect and mitigate them throughout the system life cycle.
The standard applies to organizations of different sizes and types, including private companies, public-sector entities, and not-for-profit organizations. Its scope recognizes that AI security is not limited to model development. It also involves the data, infrastructure, processes, and operational environments that support an AI system.
The standard helps organizations consider questions such as:
- What assets within an AI system need protection?
- How could attackers manipulate training or operational data?
- How might an AI model be stolen, altered, or misused?
- Which security measures are appropriate at different stages of the AI life cycle?
- How should organizations detect and respond to AI-specific compromises?
ISO/IEC 27090 complements established information security practices, including those associated with ISO/IEC 27001 and ISO/IEC 27002. It does not make conventional cybersecurity controls unnecessary. Instead, it helps organizations recognize where AI systems introduce additional security considerations.
For the official scope and publication information, consult the ISO/IEC 27090:2026 standard page.
Why AI Systems Need Specific Cybersecurity Protection
AI systems have many of the same security needs as conventional digital systems. They require access controls, secure infrastructure, vulnerability management, monitoring, and incident response. However, AI introduces additional attack opportunities because its behaviour depends on data, models, training processes, and interactions with users or other systems.
A security incident involving an AI system may affect more than the availability of an application. It can influence the accuracy of outputs, compromise sensitive information, undermine automated decisions, or introduce vulnerabilities into future model versions.
For example, an organization may operate an AI-supported fraud detection system. If an attacker manipulates data used for training or updating the model, the system may become less effective at identifying suspicious activity. If an attacker extracts the model, proprietary capabilities may be exposed. If an AI application has excessive permissions, an attacker may exploit its access to reach other organizational resources.
These risks make AI security a business and governance concern, not simply a technical issue.
The Difference Between Conventional Cybersecurity and AI Security
Conventional cybersecurity focuses on protecting systems, networks, applications, identities, and information. AI security includes these responsibilities but also considers the specific characteristics of AI components.
Important areas include:
- Data integrity: Ensuring that training, validation, and operational data have not been manipulated.
- Model integrity: Protecting models from unauthorized modification, replacement, or tampering.
- Model confidentiality: Preventing unauthorized access to proprietary models and their parameters.
- AI pipeline security: Protecting data collection, preparation, training, testing, deployment, and updating processes.
- Output reliability: Identifying attempts to manipulate system behaviour through crafted inputs or other attack techniques.
- Operational protection: Monitoring AI systems after deployment and managing risks introduced by updates, integrations, and changing data.
An effective AI security programme therefore combines established information security controls with measures designed for AI-specific threats.
Key AI Security Threats Addressed by ISO/IEC 27090
Organizations need to understand how attackers may target different AI assets and processes. The following threats illustrate important areas of concern.
1. Data Poisoning
Data poisoning occurs when an attacker manipulates data used to train, fine-tune, or update an AI model. The purpose may be to influence model behaviour, reduce accuracy, create hidden weaknesses, or cause the model to respond in a particular way under certain conditions.
For example, a malicious actor may introduce manipulated records into a dataset used by a fraud detection model. The resulting model could learn misleading patterns and become less reliable when identifying suspicious transactions.
Organizations can reduce this risk through:
- Verifying the origin and integrity of datasets.
- Restricting access to data preparation and training environments.
- Reviewing unusual changes in data distributions.
- Maintaining records of dataset versions and transformations.
- Testing model behaviour before approving deployment.
- Controlling the use of operational data in retraining processes.
Data governance and cybersecurity must work together. A dataset may be properly documented but still be vulnerable if its integrity is not protected.
2. AI Model Theft
AI models can represent valuable intellectual property and contain commercially sensitive capabilities. Attackers may attempt to obtain model files, parameters, or information that allows them to reproduce the model.
Model theft can result in financial loss, competitive disadvantage, exposure of proprietary technology, and possible misuse of the stolen model.
Organizations should consider:
- Strong authentication and authorization for model repositories.
- Encryption of model files and sensitive artifacts.
- Monitoring access to model storage and deployment environments.
- Restricting model downloads and administrative privileges.
- Reviewing external API access and usage patterns.
- Applying contractual and technical safeguards when models are shared with suppliers.
Model protection should extend beyond the development environment. Deployed models, supporting APIs, and backup repositories also require security controls.
3. Unauthorized Model Modification
Attackers may attempt to alter a model or replace it with an unauthorized version. Such changes can affect the system's outputs and compromise the decisions that depend on them.
This risk is particularly important when models are updated frequently or obtained from external sources.
Organizations should establish controlled model release processes. Each approved model should have an identifiable version, documented source, authorized owner, and defined validation process. Changes should be reviewed and tested before deployment.
4. Attacks Through Inputs and Interfaces
AI systems receive information through prompts, files, APIs, sensors, and other interfaces. Attackers may use specially designed inputs to manipulate system behaviour, expose information, or exploit weaknesses in connected applications.
For example, an AI assistant connected to internal business tools may receive instructions designed to make it disclose information or perform actions outside its intended purpose.
Security measures should include input validation, access restrictions, output monitoring, safe integration design, and clear limits on the actions an AI system can perform. Organizations should also test how the system behaves when it receives unexpected or malicious inputs.
5. Risks During Model Updates and Retraining
AI security does not end when a model enters production. Organizations may update models using new datasets, feedback, or operational information. If these sources are compromised, weaknesses may be introduced into later model versions.
A secure update process should therefore include data validation, approval controls, testing, version management, and rollback procedures. Organizations should also monitor changes in model behaviour after each update.
Applying ISO/IEC 27090 Across the AI System Life Cycle
AI security needs to be integrated into the full life cycle rather than treated as a final deployment check.
1. Planning and Requirements
Before developing or adopting an AI system, organizations should identify its purpose, users, business importance, information assets, and potential consequences of compromise.
Key questions include:
- What decisions or services will depend on the system?
- What types of information will it process?
- Will it use confidential, personal, financial, or regulated data?
- Which internal and external systems will it access?
- What could happen if its outputs were manipulated or unavailable?
The answers help determine the level of protection required.
2. Data Collection and Preparation
Data collection and preparation create important security dependencies. Organizations should know where datasets originate, who can access them, how they are transformed, and whether their integrity can be verified.
Practical controls include documented data sources, restricted access, secure storage, validation procedures, and traceable dataset versions.
3. Model Development and Training
Development environments should be protected against unauthorized access and modification. Organizations should secure code repositories, training infrastructure, model artifacts, credentials, and development tools.
Security testing should examine whether the model behaves as expected under normal and adversarial conditions. Development teams should also document known limitations and the assumptions used during testing.
4. Testing and Validation
Before deployment, organizations should assess both functional performance and security.
Testing may include:
- Reviewing access permissions and system configurations.
- Checking the integrity of datasets and model files.
- Evaluating resistance to manipulated inputs.
- Examining possible information leakage.
- Testing connected services and external interfaces.
- Confirming that security monitoring and response procedures work.
The depth of testing should reflect the system's intended use and potential impact.
5. Deployment and Integration
Deployment introduces new risks because AI systems become connected to users, business applications, cloud services, and operational data.
Organizations should apply least-privilege access, secure API configurations, network protections, secrets management, logging, and controlled release procedures. They should also define who can approve changes and who is responsible for responding to security incidents.
6. Monitoring, Maintenance, and Retirement
After deployment, organizations should monitor system activity, access patterns, model behaviour, data changes, and security alerts.
They should establish procedures for investigating suspicious activity, updating models securely, managing vulnerabilities, and withdrawing systems that are no longer safe or necessary.
Retirement also requires attention. Organizations should revoke credentials, remove unnecessary access, manage retained data, and protect or securely dispose of model artifacts.
How ISO/IEC 27090 Relates to ISO/IEC 27001 and Other Security Practices
ISO/IEC 27090 should be understood as part of a broader information security approach. Organizations that already operate an information security management system can use their existing governance and risk management processes as a foundation for addressing AI-specific threats.
ISO/IEC 27001 provides requirements for establishing, implementing, maintaining, and continually improving an information security management system. ISO/IEC 27002 provides guidance on information security controls. ISO/IEC 27090 adds AI-focused security guidance that helps organizations consider threats affecting AI systems and their life cycles.
These standards have complementary roles:
- ISO/IEC 27001: Establishes the management system approach for information security.
- ISO/IEC 27002: Provides guidance on selecting and implementing information security controls.
- ISO/IEC 27090: Addresses security threats and compromises specific to AI systems.
Organizations should avoid treating the publication of an AI security standard as automatic evidence of compliance or certification. They need to assess their own systems, risks, obligations, and control effectiveness. The appropriate approach is to integrate relevant guidance into existing governance and security processes.
A Practical AI Security Risk Assessment Framework
Organizations can translate the principles of AI security into a structured assessment. The following approach provides a practical starting point for cybersecurity, technology, and risk teams.
Step 1: Identify AI Assets and Dependencies
Create an inventory of AI systems and their supporting components. Include:
- Training and operational datasets.
- Models and model repositories.
- Development and testing environments.
- APIs and external integrations.
- Cloud infrastructure and computing resources.
- User identities and service accounts.
- Third-party AI services and suppliers.
An incomplete inventory makes it difficult to identify exposure and assign responsibility.
Step 2: Identify Threat Scenarios
For each system, consider realistic ways it could be compromised. Examples include data poisoning, model theft, unauthorized modification, malicious inputs, excessive permissions, and insecure third-party dependencies.
Threat scenarios should reflect the system's actual architecture and business use rather than relying on generic risk statements.
Step 3: Assess Likelihood and Business Impact
Evaluate how plausible each threat is and what consequences it could create. Consider:
- Confidentiality of information.
- Integrity and reliability of outputs.
- Availability of critical services.
- Financial and operational consequences.
- Legal and regulatory exposure.
- Customer, employee, and public trust.
- Safety or service continuity where relevant.
Risk assessments should consider both technical consequences and organizational impact.
Step 4: Select and Assign Security Controls
Choose controls that address the identified risks. These may include access restrictions, encryption, data validation, model version control, secure development practices, monitoring, testing, and incident response procedures.
Each control should have a responsible owner, implementation status, and method for verifying effectiveness.
Step 5: Test and Monitor
Security controls need ongoing validation. Conduct periodic assessments, review alerts, test response procedures, and reassess risks when the system, data, model, or business environment changes.
Step 6: Report and Improve
Provide decision-makers with clear information about significant risks, unresolved weaknesses, control effectiveness, and required investment. Use assessment findings to improve security practices and update risk treatment plans.
Executive Checklist: Questions Leaders Should Ask
Senior leaders do not need to inspect model code to exercise effective oversight. They do need reliable information about the organization's AI assets, risk exposure, and security responsibilities.
Executives and board members should ask:
- Do we know which AI systems are used across the organization, including systems introduced by business units?
- Who is accountable for the security of each AI system?
- How do we verify the integrity and origin of training and operational data?
- Are model repositories, development environments, and AI interfaces protected by appropriate access controls?
- Have we assessed the consequences of model theft, data poisoning, or unauthorized modification?
- Do suppliers and external AI providers meet our security expectations?
- Can we detect suspicious changes in model behaviour or unusual access patterns?
- Are AI-related incidents included in our incident response and business continuity arrangements?
- Do we reassess risks when models are updated or connected to new systems?
- Does management receive meaningful reporting on AI security risks and corrective actions?
These questions help connect technical controls with business accountability. They also support informed decisions about investment, risk acceptance, and operational readiness.
Common Implementation Challenges
Organizations may face practical obstacles when introducing AI-specific security measures.
Limited Visibility of AI Systems
AI tools may be adopted by different departments without central oversight. This creates gaps in asset inventories, security reviews, and accountability.
A clear AI system inventory and an approval process for new deployments can improve visibility.
Unclear Ownership
AI security often involves cybersecurity, data science, IT, legal, compliance, procurement, and business teams. Without defined responsibilities, important risks may remain unaddressed.
Organizations should assign system owners and establish shared responsibilities across the AI life cycle.
Dependence on External Providers
Third-party models, cloud platforms, datasets, and AI services introduce dependencies that may not be fully visible to internal teams.
Supplier assessments should address security practices, data handling, access, incident notification, model updates, and service continuity.
Security Testing That Stops at Deployment
A model that passed testing before release may become vulnerable after changes to data, integrations, or operating conditions.
Organizations need continuous monitoring and risk reassessment rather than relying on a single pre-deployment review.
Treating AI Security as a Separate Programme
Creating an isolated AI security process can lead to duplicated controls and inconsistent governance.
A more effective approach connects AI security with existing information security management, enterprise risk management, supplier governance, and incident response.
Expert Perspective: Make AI Security a Continuous Management Responsibility
The practical value of ISO/IEC 27090 lies in helping organizations recognize that AI systems have security needs throughout their life cycles. A model is not protected simply because its hosting platform is secure. The data used to train it, the processes that update it, the interfaces through which it operates, and the permissions granted to it can all create exposure.
For executives, the priority is to establish clear accountability and ensure that AI security risks are visible within organizational risk management. For technical teams, the priority is to translate those expectations into secure engineering, controlled data processes, testing, and monitoring.
The most effective programmes bring these responsibilities together. They connect business objectives with technical safeguards and make security part of AI system design, procurement, deployment, and ongoing operation.
Related Professional Development
Professionals responsible for identifying, evaluating, and treating technology risks can strengthen their capabilities through the Cyber Security Risk Assessment & Management training course. The programme supports a structured understanding of cybersecurity risk assessment, control selection, and risk management practices. It is relevant to cybersecurity professionals, IT security managers, technology risk officers, auditors, and managers involved in protecting organizational systems.
Explore the Cybersecurity Governance and Risk Management course to develop a broader understanding of security oversight and organizational risk responsibilities.
Frequently Asked Questions
What is the main purpose of ISO/IEC 27090:2026?
ISO/IEC 27090:2026 provides guidance for understanding, detecting, and mitigating security threats specific to AI systems. It addresses risks across the AI life cycle and helps organizations protect assets such as training data and models.
Does ISO/IEC 27090 replace ISO/IEC 27001?
No. ISO/IEC 27090 addresses AI-specific security threats and complements established information security practices. ISO/IEC 27001 provides requirements for an information security management system, while ISO/IEC 27090 focuses on threats and compromises affecting AI systems.
What is data poisoning in artificial intelligence?
Data poisoning is the manipulation of data used to train, fine-tune, or update an AI model. It can cause the model to learn misleading patterns or behave in ways that benefit an attacker. Data provenance, integrity checks, access controls, and testing help reduce this risk.
How can organizations protect AI models from theft?
Organizations can protect models through restricted access, strong authentication, encryption, secure repositories, monitoring, and controlled deployment processes. They should also review API exposure, administrative privileges, supplier access, and model-sharing arrangements.
Who should be responsible for AI cybersecurity?
AI cybersecurity requires shared responsibility. Cybersecurity teams manage security controls, technology teams protect infrastructure, data and AI teams secure models and datasets, and business leaders oversee risk and accountability. Clear ownership is essential throughout the AI system life cycle.
Conclusion
ISO/IEC 27090:2026 gives organizations a focused way to understand and address security threats that affect AI systems. Its practical significance is the recognition that protecting AI requires attention to data, models, development processes, integrations, and operational environments. Organizations should begin by identifying their AI assets, assessing realistic threat scenarios, assigning accountable owners, and integrating appropriate safeguards into existing security and risk management processes. As AI becomes more embedded in critical business activities, continuous security assessment will be essential to maintaining trust and resilience.
About the Author
Amir
AI Cybersecurity Expert at Gentex Training