.webp)
The International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) have published ISO/IEC 27090:2026, an international standard addressing security threats to artificial intelligence systems. ISO’s official record confirms publication on 14 October 2026, following the final production stage reported earlier this month.
The first edition provides guidance for understanding, detecting and mitigating AI-specific threats throughout a system’s lifecycle. Developed through ISO/IEC JTC 1/SC 27, the subcommittee responsible for information security, cybersecurity and privacy protection, the 56-page standard focuses on protecting AI systems themselves, rather than using AI to defend other technology.
What ISO/IEC 27090 addresses
The standard responds to vulnerabilities that conventional cybersecurity protections may not fully address. AI systems depend on training data and models whose integrity can be compromised even when surrounding software and infrastructure remain protected.
Data poisoning and model theft are two examples highlighted by ISO. Data poisoning involves manipulating data used to train or update a model, potentially changing its behavior. Model theft involves extracting or reproducing a model, including through repeated queries that appear legitimate. These attacks can affect system reliability or expose intellectual property without requiring a conventional infrastructure breach.
ISO’s explanation of AI security threats describes the need to consider attacks against data and model behavior alongside established cybersecurity risks. The guidance is intended for organizations of all sizes developing or using AI, and its scope extends beyond generative AI and chatbots.
For manufacturers and product developers using AI in safety-critical applications, the consequences are not limited to information loss. ISO identifies potential impacts on businesses and individuals when compromised systems influence decisions or operate in settings where failures can cause harm.
Security continues through model updates
ISO/IEC 27090 treats security as a lifecycle issue, covering development, operation and model updates. Data collected during use may later be fed into retraining. If that information has been corrupted, it can introduce vulnerabilities into subsequent model versions.
This links operational monitoring with development security: the data entering a deployed system can also become part of its future training process. The relationship between AI governance and cybersecurity is therefore relevant to teams overseeing model changes, data handling and responsibility for security controls.
Complementing existing management frameworks
The new standard complements, rather than replaces, established information-security practices. ISO/IEC 27001’s information-security management framework provides management-system requirements, while ISO/IEC 27002 offers guidance on information-security controls. ISO/IEC 27090 adds detail on threats affecting AI data, models and workflows.
Its purpose also differs from ISO/IEC 42001’s AI management-system requirements, which address organizational responsibilities, risks and opportunities associated with AI. ISO/IEC 27090 provides security guidance rather than a new set of AI management-system requirements. Publication does not mean that existing management frameworks are obsolete or that adopting the guidance guarantees protection against attacks.
Regulatory relevance for high-risk AI
The publication arrives within a wider regulatory focus on AI security. Under the EU AI Act’s risk-based framework, high-risk AI systems face specific cybersecurity requirements.
Article 15 of the EU AI Act requires appropriate accuracy, robustness and cybersecurity throughout those systems’ lifecycle. It explicitly addresses AI-specific vulnerabilities, including data poisoning, model poisoning and adversarial inputs. ISO/IEC 27090’s publication does not, by itself, establish compliance with those legal obligations.
With publication complete, organizations can now consult the final edition rather than draft-stage descriptions. For cybersecurity, product and compliance teams, the next step is assessing its AI-specific guidance alongside existing controls and the legal requirements applicable to their systems.
