A Guide to ISO/IEC 27090:2026

Your firewall cannot see a poisoned dataset. Your antivirus cannot detect a model being copied one query at a time. The newly published ISO/IEC 27090:2026 names these threats, and the organisations that act on it first will be the ones customers trust with AI.

In October 2026, ISO and IEC published Edition 1 of ISO/IEC 27090, Cybersecurity: Artificial intelligence (AI): Addressing security threats and compromises to AI systems. It is the first International Standard dedicated to the security threats that target AI itself, from training data to deployed models.

For any organisation building, buying or deploying AI, the message is clear. Conventional cybersecurity still matters, but it is no longer the whole story.

What Is ISO/IEC 27090?

ISO/IEC 27090 is international guidance on understanding, detecting and mitigating security threats specific to AI systems across their entire life cycle. It explains how AI vulnerabilities can be exploited, what the consequences can be, and which measures address them.

The standard applies to every type and size of organisation, public or private, commercial or not for profit, that develops or uses AI. It builds on two companion standards: ISO/IEC 22989 for AI concepts and terminology, and ISO/IEC 23053 for AI systems using machine learning.

At its core, ISO/IEC 27090 answers one question every board should now be asking: what exactly in our AI needs protecting, and from whom? The answer runs from training data and model parameters through to user prompts and model outputs.

Why AI Needs Its Own Security Standard

AI systems inherit every traditional cybersecurity weakness, and then add new ones. Because AI is built on data and learns from it, attackers can strike at points conventional controls were never designed to watch.

The standard is direct about the gap. Manipulated training data can quietly change how a system behaves. Queries that look entirely legitimate can be used to reconstruct and steal a model. These attacks are hard to detect and can succeed even when conventional protections are fully in place.

The stakes rise as AI moves into finance, healthcare, critical infrastructure and government services. When AI fails in a safety critical setting, the consequences reach both businesses and individuals. ISO/IEC 27090 links each threat to its potential impact, so decisions on detection and protection are made on evidence rather than assumption.

The AI Threats ISO/IEC 27090 Puts on the Record

The standard defines a vocabulary of AI specific attacks. These are the ones every risk register should now name.

The standard also defines attacks by how much the attacker knows: zero knowledge, partial knowledge and perfect knowledge. Even an attacker with no insight into your model can probe it from outside to find weaknesses.

It formally recognises data provenance, the record of where data came from and who owns it, and out of distribution data, inputs a model was never trained to handle. Both are now firmly security questions, not just data science ones.

Security Across the Whole AI Life Cycle

ISO/IEC 27090 treats AI security as continuous, not a one time check at launch. Threats appear at every stage.

1. Development: training data can be poisoned, corrupted or sourced without verified provenance.
2. Operation: live models face evasion, prompt injection, model theft through repeated querying, and leakage of inputs and outputs.
3. Updates and retraining: data collected in operation often becomes tomorrow’s training data. If that data is corrupted, vulnerabilities are carried into every future version.

The third stage is where many organisations are exposed. In systems that learn continuously, every user input is a potential training input, which means data poisoning is possible long after development ends. The standard calls for defence in depth, where layered measures protect AI assets at each stage.

How ISO/IEC 27090 Fits With ISO/IEC 27001, 27002 and 42001

ISO/IEC 27090 does not replace your information security management system. It complements the established controls in ISO/IEC 27001 and ISO/IEC 27002, showing where conventional measures still work and where AI data, models and workflows need additional protection.

One point matters for anyone planning a certificate. ISO/IEC 27090 is a guidance standard, so organisations are not certified against it directly. Assurance comes through the management system standards it supports:

In practice, ISO/IEC 27090 gives organisations a recognised reference for the AI threats their ISO/IEC 27001 risk assessment and ISO/IEC 42001 AI management system should account for. An independently audited certificate then verifies that those systems are in place and working.

Turning AI Security Into Verified Assurance With RACERT

RACERT is a UKAS accredited certification body (Accreditation No. 10720). We assess your business against internationally recognised ISO and ISO/IEC Standards, and through rigorous, impartial audits we verify that your organisation meets them.

For organisations putting AI to work, RACERT certifies:

• ISO/IEC 42001, independent assurance that your AI management system is governed, risk assessed and controlled.
• ISO/IEC 27001, verified information security management across your people, processes and technology, including the AI assets ISO/IEC 27090 identifies.
• ISO/IEC 27701, certified privacy management, increasingly vital where models are trained on personal data.

A certificate from a UKAS accredited body is recognised by customers, regulators and partners worldwide. It tells the market your AI security is not a claim. It has been independently audited.

Your competitors are already deploying AI. The question is who will be first to prove it is secure.

Frequently Asked Questions

Recent Post