ISO/IEC 27090: Security for AI systems

What this is about

Many companies already use AI: in customer service, in quality inspection or as an office assistant. Their security concepts, however, mostly date from before AI. They cover servers, networks and identities, not training data and models. ISO/IEC 27090, published on 14 October 2026, addresses exactly this gap. We show what the standard covers, how it relates to ISO/IEC 27001 and ISO/IEC 42001, and where it makes sense for you to start.

What ISO/IEC 27090 is

The full title is “Cybersecurity – Artificial intelligence (AI) – Addressing security threats and compromises to AI systems”. The standard was developed by the joint committee ISO/IEC JTC 1/SC 27, which is also responsible for the ISO 27000 family. According to ISO, the first edition has 56 pages.

In terms of content, ISO/IEC 27090 gives guidance on how organisations can understand, detect and mitigate AI-specific threats across the entire lifecycle of an AI system. It explains how vulnerabilities can be exploited, what the consequences can be and which measures help. It is aimed at organisations that develop AI and those that use AI.

Important for context: the standard does not replace existing information security. ISO states explicitly that established cybersecurity practices remain central. ISO/IEC 27090 adds what also needs protecting when AI is involved.

Among the benefits, ISO lists: identifying AI-specific vulnerabilities and their possible consequences, making informed decisions on detection and defence, and better protecting training data, models and intellectual property. The standard gives equal weight to development, operation and model updates. For security leads, it is a common frame of reference for discussing the same risks with data science teams and suppliers.

Which threats the standard focuses on

Classic measures such as firewalls, patching or MFA protect the infrastructure an AI system runs on. But they do not reliably detect when the system itself is manipulated. ISO gives two examples:

• Data poisoning: manipulated training data changes the behaviour of the system. This is often only noticed once incorrect results are already in use.
• Model theft: through seemingly legitimate queries, a model can be replicated and intellectual property extracted.

According to ISO, such attacks are hard to detect and can compromise a system even though conventional safeguards are working. This is particularly critical for safety-critical applications, for example in medical technology or manufacturing.

The lifecycle does not end at go-live

One point the standard particularly highlights: data from live operation is often used later to update or retrain a model. If this data is corrupted, vulnerabilities find their way into future model versions. In systems that keep learning, operational inputs become training data. The attack surface for data poisoning therefore exists not only during development but throughout the entire period of use.

27090, 27001 and 42001: what each one covers

There are now several standards for AI that are often mentioned in the same breath. But they have different roles:

• ISO/IEC 27001:2022 sets out requirements for an information security management system (ISMS). Certification is possible but voluntary.
• ISO/IEC 42001:2023 sets out requirements for an AI management system (AIMS): policies, objectives and processes for the responsible development, provision or use of AI, including how to handle AI risks. It follows the Plan-Do-Check-Act principle.
• ISO/IEC 27090:2026 gives guidance on the security threats that specifically affect AI systems. According to ISO, it complements ISO/IEC 27001 and ISO/IEC 27002 and shows where conventional measures still work and where AI data, models and workflows need additional protection.

In practice, this means: if you already run an ISMS under ISO/IEC 27001, you do not have to start from scratch. ISO/IEC 27090 helps you extend your existing risk assessment and catalogue of controls with AI-specific points. If you are also building an AIMS under ISO/IEC 42001, ISO/IEC 27090 gives you the security view of AI risks.

Link to the EU AI Act

For Swiss companies that offer AI systems in the EU, or whose AI outputs are used there, the EU AI Act is worth a look. Whether your company is affected, and in which role, should be checked case by case.

Article 15 requires high-risk AI systems to achieve an appropriate level of accuracy, robustness and cybersecurity throughout their lifecycle. Paragraph 5 explicitly names AI-specific vulnerabilities that measures should address where appropriate: data poisoning, model poisoning via pre-trained components, adversarial examples or model evasion, confidentiality attacks and flaws in the model itself.

The overlap with the topics of ISO/IEC 27090 is obvious. The standard is not proof of conformity with the AI Act, but it can help you tackle the technical questions behind Article 15 in a structured way.

Tips and tricks

• Create an AI inventory: list which AI systems you develop, buy in or use as a feature in existing software. Without this overview, every risk assessment has gaps.
• Name the assets to protect: add training data, models, prompts and configurations to your asset inventory. ISO explicitly mentions protecting training data, models and intellectual property.
• Secure retraining: define which operational data may be used for new training, who approves it and how you check its quality.
• Monitor queries: for externally reachable models, check whether unusual query patterns are detected, for example a very large number of systematic requests from one source.
• Anchor it in your existing ISMS: include AI-specific threats in your risk assessment under ISO/IEC 27001 instead of building a separate set of rules.

How Cyberopex supports you

With our Risk Management and Compliance Service, we support you in analysing the applicable requirements and implementing security measures under ISO 27001 and ISO 27002. ISO/IEC 27090 builds on exactly this foundation. Together we assess which AI-specific risks are relevant to your systems and how you integrate them into your existing risk management. You can find more on the management system for AI under AI governance under ISO 42001.

Sources

• ISO: ISO/IEC 27090:2026 – Cybersecurity – Artificial intelligence (AI) – Addressing security threats and compromises to AI systems
• ISO: ISO/IEC 42001:2023 – Information technology – Artificial intelligence – Management system
• ISO: ISO/IEC 27001:2022 – Information security management systems – Requirements
• European Commission, AI Act Service Desk: Article 15 – Accuracy, robustness and cybersecurity

Frequently asked questions