What it is, and what it is not
The official title says most of it, « Cybersecurity, Artificial Intelligence, Guidance for addressing security threats and compromises to artificial intelligence systems ». First edition, fifty-six pages, published on 14 October 2026.
This is guidance. The standard sets no requirements and leads to no certification. Nobody will issue you an ISO 27090 certificate, and anyone offering one should give you pause. It complements ISO/IEC 27001 and ISO/IEC 27002 rather than replacing them.
Why your ISMS is not enough
A well-run information security management system protects servers, networks, access rights and data. It does nothing about a training set that has been corrupted to skew a model. It will not notice a third party reconstructing your data from the answers your model gives. Those threats are absent from Annex A of ISO 27001, because they did not exist when it was written.
That is the gap ISO 27090 fills.
The threats it covers
- Corruption of the training data, and of the model itself.
- Evasion, where a carefully built input pushes the model into the wrong decision.
- Model theft and exfiltration.
- Model inversion and membership inference, which rebuild training data from the outputs.
- Hijacking the system through its inputs, and through its outputs.
Each threat is characterised, its possible consequences described, then the known defences. The shape is that of a usable catalogue, not an essay.
How it is built
Clause 5 applies information security principles to the AI context. It covers governance, zero trust thinking, supply chain security, threat modelling and red teaming. Clause 6 describes the types of compromise. Clause 7 deals with the defences and how they work together.
Three annexes round out the text. The first maps attacks against the system life cycle and the assets at stake. The second takes classic attacks and shows their AI versions. The third covers federated learning.
One misreading is worth heading off. ISO 27090 is not a harmonised standard under the AI Act. Following it does not make you compliant with the regulation, and it does not replace Article 15 on the accuracy, robustness and cybersecurity of high-risk systems.
Where it sits
Three standards, three jobs. ISO 27001 certifies your information security management system. ISO 42001 certifies your AI management system. ISO 27090 certifies nothing. It tells you what to defend against where the first two meet.
If you already run an ISMS and you are deploying AI, this is the document that was missing between the two.
What we do with it
We bring these threats into our audits whenever an AI system falls inside the scope. In practice that means checking where the training data comes from, who can reach the model, how inputs and outputs are handled, and how an AI-specific incident would be detected at all.
Sources
- ISO/IEC 27090:2026, Cybersecurity, Artificial Intelligence, Guidance for addressing security threats and compromises to artificial intelligence systems, first edition, 14 October 2026.
- ISO/IEC 27001:2022 and ISO/IEC 27002:2022.
- ISO/IEC 42001:2023, Artificial intelligence management systems.
- Regulation (EU) 2024/1689, Article 15.