Lesson 4 of 10 · 13 min read
Where ISO/IEC 27090 fits: standards, frameworks and regulation
Last updated:
ISO/IEC 27090 sits on top of ISO/IEC 27001 and 27002, which supply the management system and the baseline controls. ISO/IEC 42001 provides the AI management system, ISO/IEC 23894 the AI risk management process, ISO/IEC 38507 the board-level governance view, and ISO/IEC 27091, still in development, the privacy companion. The standard is voluntary and gives no presumption of conformity with the EU AI Act.
In this lesson you will learn to
- 01
Place ISO/IEC 27090 within the ISO/IEC 27000 and 42000 families
- 02
Describe how the document is organised into clauses and annexes
- 03
Explain the relationship to the EU AI Act and European harmonised standards
- 04
Compare the standard with NIST AI 100-2, the OWASP Top 10 for LLM applications and MITRE ATLAS
The standards family
ISO/IEC 27090 is one node in a connected set. Reading it alone misses how it is meant to be used: as the threat and mitigation reference that plugs into an organization’s existing management system and risk process.
| Standard | What it provides | Relationship to ISO/IEC 27090 |
|---|---|---|
| ISO/IEC 27001 and 27002 | Information security management system and the control set | The foundation. ISO/IEC 27090 assumes the 27002 controls are in place and extends them to AI assets |
| ISO/IEC 42001 | AI management system (certifiable) | The implementation home for AI governance; ISO/IEC 27090 supplies the security threats the system must manage |
| ISO/IEC 23894 | AI risk management | The risk process into which the threat catalogue feeds |
| ISO/IEC 38507 | Governance implications of AI for boards | The governance perspective; where AI security risk is reported |
| ISO/IEC 22989 and 23053 | AI concepts, terminology, life cycle; machine learning framework | Normative references; supply the vocabulary and stages |
| ISO/IEC 27091 | Privacy threats to AI systems | Companion document, in development at publication |
| ISO/IEC 27005 and 42005 | Information security risk management; AI impact assessment | Related processes referenced in practice |
How the document is organised
Like every ISO standard, the first clauses carry the scope, the normative references and the terms. The substance begins at clause 5, the application of information security to AI systems, which the previous lesson covered. Clause 6 is the threat catalogue: nine threats described in detail, each with its characterisation, consequences, detection and mitigation. Clause 7 covers mitigations and their interactions, including the warning that controls can weaken one another.
Two annexes follow. Annex A maps the attacks to the life-cycle stages and to the assets they hit. Annex B describes AI-specific versions of conventional attacks, such as direct theft of a model file or leakage of training data, which existing ISO/IEC 27002 controls already address. A bibliography closes the document.
Clauses 1 to 4: scope, normative references, terms and definitions, abbreviations
Clause 5: application of information security to AI systems
Clause 6: threats to AI systems (nine detailed entries)
Clause 7: mitigations and their interactions with threats and with each other
Annex A: attacks mapped to life-cycle stages and assets
Annex B: AI-specific versions of conventional attacks
Regulation: the EU AI Act and harmonised standards
The EU AI Act places obligations on providers of high-risk AI systems, including a risk management system under Article 9 and requirements for accuracy, robustness and cybersecurity under Article 15. Those obligations apply from 2 August 2026. Compliance is demonstrated most easily through European harmonised standards, which are being prepared by CEN and CENELEC, with the AI cybersecurity document carrying the working reference prEN 18282.
ISO/IEC 27090 was developed independently of the EU AI Act and gives no presumption of conformity. It remains useful to a regulated organization as the international reference for which threats exist and how to mitigate them, and the European documents draw on the same body of work. ETSI EN 304 223 is the other document to know: a baseline set of cybersecurity requirements for AI models and systems that is normative and testable where ISO/IEC 27090 is guidance.
Use ISO/IEC 27090 to decide what to protect against and how. Use the European harmonised standards or ETSI EN 304 223 where a certifiable or regulatory route is required.
Complementary frameworks
Three other sources cover the same ground from different angles and are worth pairing with the standard.
| Source | What it offers | Best use |
|---|---|---|
| NIST AI 100-2 E2025 | A taxonomy of adversarial machine learning attacks and mitigations | Engineering depth on each threat family |
| OWASP Top 10 for LLM applications | An application-level checklist; prompt injection is ranked first | Developers and testers of generative applications |
| MITRE ATLAS | Adversary tactics and techniques against AI systems | Red-team scenario design and detection engineering |
| NIST AI Risk Management Framework | Govern, map, measure and manage functions | Organizational risk structure, especially outside the EU |
When ISO/IEC 27090 is the right reference
Choose ISO/IEC 27090 when the organization wants internationally agreed best-practice guidance to shape its security approach, when it is writing AI security policy and wants a vendor-neutral reference, when it operates across jurisdictions, and when certification against the AI security document itself is not the goal. Pair it with ISO/IEC 42001 if a certifiable AI management system is wanted, and with the European documents if regulatory conformity is required.
Key terms
- Normative reference
- A document that must be consulted to apply a standard; for ISO/IEC 27090 these are ISO/IEC 22989 and ISO/IEC 23053.
- Harmonised standard
- A European standard whose use gives a presumption of conformity with an EU regulation such as the AI Act.
- ISO/IEC 42001
- The certifiable AI management system standard, the AI counterpart of ISO/IEC 27001.
- MITRE ATLAS
- A knowledge base of adversary tactics and techniques against AI systems, modelled on MITRE ATT&CK.
- OWASP Top 10 for LLM applications
- A community list of the most common security weaknesses in applications built on large language models.
In one paragraph
ISO/IEC 27090 is the threat and mitigation reference that plugs into ISO/IEC 27001 and 27002, with ISO/IEC 42001 for AI management, 23894 for AI risk and 38507 for governance. Its substance is in clauses 5 to 7 and Annexes A and B. It is voluntary, gives no presumption of conformity with the EU AI Act, and pairs well with NIST AI 100-2, the OWASP Top 10 for LLM applications and MITRE ATLAS.
Lesson 4 quiz
Five questions. Score 4 or more to mark the lesson complete. Each answer shows an explanation, so a wrong answer teaches as much as a right one.
Questions people ask
- What is the difference between ISO/IEC 27090 and ISO/IEC 42001?
- ISO/IEC 42001 is a certifiable management system standard for AI governance. ISO/IEC 27090 is guidance on the security threats to AI systems and how to mitigate them. The first says how to manage AI; the second says what security threats the management system must address.
- Does ISO/IEC 27090 help with EU AI Act compliance?
- Indirectly. It is the international reference for AI security threats, but it was developed independently of the Act and gives no presumption of conformity. The European harmonised standards serve that role.
- What are the normative references of ISO/IEC 27090?
- ISO/IEC 22989:2022, which defines AI concepts, terminology and the life cycle, and ISO/IEC 23053:2022, the framework for AI systems using machine learning.
Shahzad Asghar
Senior IT Strategy and Portfolio Officer at UNRWA, with more than twenty years building and securing data and AI systems across UN agencies. He holds the CISM and CISSP security certifications and writes on AI governance, AI security and assurance, and digital transformation. Connect on LinkedIn.
This course is an independent educational resource by Shahzad Asghar. It is not affiliated with, endorsed by or published by ISO or IEC. ISO/IEC 27090:2026 is copyrighted and is sold through the ISO Store and national standards bodies; this course summarises it and does not reproduce its text. Last reviewed: .