Skip to content
PCI SSC Issues Guidance on AI Use in Payment Systems

PCI SSC Issues Guidance on AI Use in Payment Systems

First seen 9 Oct 2026, 11:33 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 10, 2026 at 10:36 UTC
  • •PCI SSC emphasizes human approval for AI actions involving cardholder data.
  • •Organizations must define AI system permissions and responsibilities.
  • •The guidance is advisory and complements existing PCI standards.

The PCI Security Standards Council (PCI SSC) has published new guidance on securing AI systems in payment environments, emphasizing the need for human oversight in actions involving cardholder data. The guidance addresses governance, deployment, access controls, and testing of AI systems to mitigate risks associated with AI-assisted attacks. Organizations are advised to define AI system permissions and ensure that a suitable human is responsible for AI outputs. The document highlights the importance of avoiding the combination of sensitive data access and untrusted inputs in a single AI system. Additionally, it recommends that organizations conduct adversarial testing and continuous monitoring of AI systems. The guidance is advisory and does not replace existing PCI requirements. This initiative comes as AI's role in payments grows, prompting a shift in focus towards secure governance and accountability.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 5d ago How this analysis works

Timeline

2026-10-07
PCI SSC publishes AI guidance
New guidance released to help organizations secure AI systems in payment environments, addressing governance and risk mitigation.
Pcisecuritystandards
2026-10-09
Helpnetsecurity reports on AI guidance
Helpnetsecurity highlights PCI SSC's recommendations for human oversight and secure AI implementation in payment systems.
Helpnetsecurity

More articles in this cluster (2)

Extracted Entities (3)

1 / 3

Common questions

What are the key recommendations for AI systems?
Organizations should define AI system permissions, ensure human oversight for actions involving cardholder data, and conduct adversarial testing.
Is the new guidance mandatory?
No, the guidance is advisory and does not replace existing PCI requirements.
What should organizations do to secure AI systems?
Organizations should implement access controls, monitor AI behavior, and separate sensitive data handling from untrusted inputs.