ISO/IEC 27090 (addressing security threats and compromises to AI systems)

What it is

ISO lists ISO/IEC 27090:2026, Cybersecurity — Artificial intelligence (AI) — Addressing security threats and compromises to AI systems, as Published, edition 1, 56 pages, with a publication date of 2026-10 and stage 60.60, International Standard published. The technical committee is ISO/IEC JTC 1/SC 27.

ISO says the standard provides guidance on understanding, detecting and mitigating security threats specific to artificial intelligence (AI) systems throughout their life cycle, and that it addresses threats such as data poisoning and model theft, while recognizing that established cybersecurity practices remain essential. ISO sells the full text; we do not reproduce it.

What it covers

ISO’s explainer says it draws on the final draft and that the published edition should be consulted for the final content. With that caveat, ISO describes three connected areas: applying information security to AI, understanding potential compromises and considering how safeguards work together.

• Applying information security to AI. Topics include AI governance, zero trust principles, software engineering practices and supply-chain security, plus threat modelling and red teaming.
• AI-specific threats. ISO names data poisoning, model exfiltration, evasion attacks, membership inference, model inversion and direct model poisoning, and input and output threats including prompt injection, sensitive model output and outputs containing injection attacks.
• Maintaining protection over time. Topics include logging and monitoring, protecting development environments, detecting malicious inputs and limiting model use. ISO describes the approach as defence in depth.

ISO says the scope is not limited to generative AI or chatbots, and that the document is intended for organizations of all sizes that develop or use AI. It names ISO/IEC 22989 and ISO/IEC 23053:2022 as normative references in the final draft.

What it is not

ISO says its focus is protecting AI systems against security threats, rather than using AI to defend other systems, and that it provides security guidance, not requirements for an AI management system. ISO also says it does not guarantee immunity from attack.

We found no certification scheme for ISO/IEC 27090 on the ISO pages cited here. Treat a vendor’s “27090-aligned” claim as a self-description unless it names an assessor and scope.

How it relates to ISO/IEC 27001 and ISO/IEC 42001

ISO says the introduction to ISO/IEC 27090 recommends established practices from ISO/IEC 27001 and ISO/IEC 27002, and that its AI-specific guidance adds detail about threats and assets that may need additional attention.

On ISO/IEC 42001, ISO puts the difference this way: ISO/IEC 42001 addresses organizational management of AI, while ISO/IEC 27090 examines security threats to AI systems and ways to address them.

For safety-critical programs

ISO notes that where AI influences decisions or operates in safety-critical settings, compromised behaviour can also harm people.

Editorial judgment: ISO/IEC 27090 is a security-threat catalogue and mitigation guide. It does not replace functional-safety or airworthiness assurance such as IEC 61508 or DO-178C, and no ISO page we cite says it does. For OT and control systems, read it alongside IEC 62443. For the threat taxonomy in testing terms, see MITRE ATLAS for AI red teaming and NIST AI 100-2 adversarial ML.

Tagging rule

We tag a listing with ISO/IEC 27090 only when the vendor’s own page names ISO/IEC 27090 for that product.