What is ISO/IEC 27090:2026?

The standard in one paragraph

ISO/IEC 27090:2026 carries the title “Cybersecurity — Artificial intelligence (AI) — Addressing security threats and compromises to AI systems”. It was published on 14 October 2026 as edition 1, runs to 56 pages in English, and belongs to ISO/IEC JTC 1/SC 27, the joint committee that also owns ISO/IEC 27001 and ISO/IEC 27002. Work on the document began in 2022, the draft international standard was approved in July 2025, and the final draft was balloted in early 2026.

The number places it inside the ISO/IEC 27000 family of information security standards. That placement is deliberate. The standard does not create a parallel discipline called AI security. It extends the information security practice an organization already runs to a new class of assets and a new class of attacks.

Scope: what the standard addresses

The scope statement is short. The document addresses security threats and compromises specific to AI systems, describes the consequences of those threats across the AI system life cycle, and explains how to detect and mitigate them. It applies to organizations of all types and sizes that develop or use AI systems.

Three verbs carry the scope. Describe: the standard characterises each threat and what it does to an organization. Detect: for each threat it discusses the signals and tests that reveal an attack. Mitigate: it sets out the controls that reduce likelihood or impact, and, unusually for a standard, how those controls interact with each other.

The phrase “specific to AI systems” matters. Attacks that work the same way against any software system, such as stealing a file from a server, are covered only where the AI context changes them. The standard moves those cases into an informative annex and spends its main text on the attacks that exist only because a system learns from data and answers open-ended inputs.

Who should use it

The standard names two kinds of organization: those that develop AI systems and those that use them. Most organizations are the second kind. They buy a model through an API, deploy a vendor product with an AI feature, or fine-tune an open model on their own data. The standard is written so that a deployer can apply it without access to the vendor’s training process.

Inside an organization the readers are the security function, which owns threat assessment and controls; the CIO or technology function, which owns the inventory and life cycle; product owners who run individual AI systems; internal audit, which needs criteria to test against; and procurement, which has to ask vendors the right questions.

Guidance, not certification

ISO/IEC 27090 is an informative standard. It contains recommendations and explanations rather than auditable “shall” requirements. Nobody can be certified against it, and a product cannot carry an ISO/IEC 27090 mark. This is the same relationship ISO/IEC 27002 has to ISO/IEC 27001: 27001 holds the certifiable requirements, 27002 explains the controls, and 27090 now adds the AI-specific threats and mitigations those controls must address.

Reviewers of the final draft point out that the standard still carries two firm expectations for any reader. First, the controls of ISO/IEC 27002 are assumed to be in place; the AI-specific guidance sits on top of them rather than replacing them. Second, AI-specific attacks are to be considered at every stage of the life cycle, not only once the system is in production.

What the standard does not cover

The standard is about attacks on AI systems, seen from the owner’s side. It is not about AI used as an attack tool by criminals, and it is not about AI used to defend networks. It is not a general AI safety or ethics document. Privacy threats to AI systems are the subject of a companion document, ISO/IEC 27091, still in development at the time of publication.

Independent reviewers also note that the standard concentrates on deliberate attacks by capable adversaries. Accidental failures, design flaws and insider misuse receive less attention, so organizations should supplement it with their own risk management process and with ISO/IEC 23894 on AI risk management.

Finally, applying ISO/IEC 27090 does not create a legal presumption of conformity with the European Union AI Act or the Cyber Resilience Act. It was developed independently of European regulation. Where a certifiable or regulatory route is needed, the European harmonised standards and ETSI EN 304 223 serve that purpose, with ISO/IEC 27090 as the international reference behind them.

Why the standard was written

Before 2026 an organization that wanted to secure a machine learning system had to assemble its own threat list from research papers, vendor advisories and community projects such as the OWASP Top 10 for large language model applications. Those sources are valuable but they disagree on terminology, change monthly and carry no formal standing with auditors or regulators.

ISO/IEC 27090 gives the field a stable, internationally agreed vocabulary: a fixed list of threats, each with an agreed name, an agreed description of consequences, and agreed detection and mitigation guidance. That stability is what lets a security team, an auditor and a vendor talk about data poisoning or prompt injection and mean the same thing.

Lesson 1 quiz

Five questions. Score 4 or more to mark the lesson complete. Each answer shows an explanation, so a wrong answer teaches as much as a right one.