ISO/IEC 27090: Security for AI Systems

Many companies are already using AI: in customer service, quality control, or as an office assistant. However, security policies typically date from a time before AI and cover servers, networks, and identities—not training data and models. ISO/IEC 27090, published on October 14, 2026, addresses precisely this gap. We’ll explain what the standard covers, how it relates to ISO/IEC 27001 and ISO/IEC 42001, and where you should start.

What ISO/IEC 27090 Is

The full title is “Cybersecurity – Artificial Intelligence (AI) – Addressing Security Threats and Compromises to AI Systems.” The standard was developed by the joint ISO/IEC JTC 1/SC 27 committee, which is also responsible for the ISO 27000 series. According to ISO, the first edition comprises 56 pages.

In terms of content, ISO/IEC 27090 provides guidance on how organizations can understand, detect, and mitigate AI-specific threats throughout the entire lifecycle of an AI system. It explains how vulnerabilities can be exploited, what the consequences may be, and what measures can help. The standard is intended for organizations that develop AI and those that use it.

Important to note: This standard does not replace existing information security measures. ISO explicitly states that established cybersecurity practices remain central. ISO/IEC 27090 supplements these practices by identifying what additional aspects require protection in the context of AI.

Among other benefits, ISO cites the following: identifying AI-specific vulnerabilities and their potential consequences; making informed decisions about detection and defense; and better protecting training data, models, and intellectual property. The standard gives equal consideration to development, operation, and model updates. For security managers, this provides a common framework for discussing the same risks with data science teams and suppliers.

What threats the standard addresses

Traditional measures such as firewalls, patching, and MFA protect the infrastructure on which an AI system runs. However, they do not reliably detect when the system itself is being tampered with. ISO cites two examples of this:

Data Poisoning: Manipulated training data alters the system's behavior. This is often not noticed until incorrect results are already being used.
Model Theft: Through seemingly legitimate queries, a model can be replicated, thereby infringing on intellectual property rights.

According to ISO, such attacks are difficult to detect and can compromise a system even when conventional protective measures are in place. This is particularly problematic for safety-critical applications, such as those in medical technology or manufacturing.

The life cycle does not end with the go-live

One point the standard particularly emphasizes is that data from ongoing operations is often used later to update or retrain a model. If this data is corrupted, vulnerabilities will carry over into future model versions. In systems that continuously learn, operational inputs thus become training data. The attack surface for data poisoning therefore exists not only during development but throughout the entire lifecycle of the system.

Flowchart illustrating the four stages of the AI lifecycle: training data, training and model, operation, and update and retraining—with operational data being recycled back into training data. Below are the threats: data poisoning in the training data, model theft via seemingly legitimate queries during operation, and compromised retraining that introduces vulnerabilities into future model versions. Conclusion: The attack surface exists throughout the entire lifecycle of use. Source: ISO. — The Life Cycle of an AI System: Attacks are possible not only during development, but also during operation and retraining.

27090, 27001, and 42001: Who Regulates What?

There are now several standards for AI that are often mentioned in the same breath. However, they serve different purposes:

ISO/IEC 27001:2022 specifies requirements for an information security management system (ISMS). Certification is possible but voluntary.
ISO/IEC 42001:2023 specifies requirements for an AI management system (AIMS): policies, objectives, and processes for the responsible development, deployment, or use of AI, including the management of AI risks. It follows the Plan-Do-Check-Act principle.
ISO/IEC 27090:2026 provides guidance on security threats that specifically affect AI systems. According to ISO, it complements ISO/IEC 27001 and ISO/IEC 27002 and identifies where traditional measures remain effective and where AI data, models, and workflows require additional protection.

In practice, this means that organizations already operating an ISMS in accordance with ISO/IEC 27001 do not need to start from scratch. ISO/IEC 27090 helps expand the existing risk assessment and catalog of measures to include AI-specific considerations. Those who are also implementing an AIMS in accordance with ISO/IEC 42001 will find the security perspective on AI risks in ISO/IEC 27090.

Comparison of three standards: ISO/IEC 27001:2022 specifies requirements for an ISMS; certification is possible but voluntary; ISO/IEC 42001:2023 specifies requirements for an AI management system based on the Plan-Do-Check-Act cycle; ISO/IEC 27090:2026 provides guidance on AI-specific security threats and supplements ISO/IEC 27001 and 27002. Conclusion: Continue with the existing ISMS and supplement it to address AI-specific risks. Source: ISO. — ISO/IEC 27090 supplements the existing ISMS, while ISO/IEC 42001 governs the management of AI.

Relation to the EU AI Act

Swiss companies that offer AI systems in the EU or whose results are used there should take a look at the EU AI Act. You should assess on a case-by-case basis whether your company is affected and, if so, in what capacity.

Article 15 requires high-risk AI systems to maintain an appropriate level of accuracy, robustness, and cybersecurity throughout their entire lifecycle. Paragraph 5 explicitly lists AI-specific vulnerabilities against which measures should be taken, where appropriate: data poisoning, model poisoning via pre-trained components, adversarial examples or model evasion, attacks on confidentiality, and weaknesses in the model itself.

The overlap with the topics covered in ISO/IEC 27090 is evident. The standard does not serve as proof of compliance with the AI Act, but it can help address the technical issues underlying Section 15 in a structured manner.

List of the five AI-specific vulnerabilities from Article 15(5) of the EU AI Act: data poisoning, model poisoning via pre-trained components, adversarial examples or model evasion, attacks on confidentiality, and model weaknesses. Note: Applies to high-risk AI systems; assess applicability on a case-by-case basis. Source: European Commission, AI Act Service Desk. — Article 15(5) of the EU AI Act identifies five AI-specific vulnerabilities for high-risk AI systems.

Tips and Tricks

Create an AI inventory: List the AI systems you are developing, purchasing, or using as a feature in existing software. Without this overview, any risk assessment will be incomplete.
Identify Assets to Protect: Add training data, models, prompts, and configurations to your asset inventory. ISO explicitly mentions the protection of training data, models, and intellectual property.
Ensure the quality of retraining: Determine which operational data may be incorporated into a new training program, who approves it, and how you will verify its quality.
Monitor Queries: For externally accessible models, check to see if any unusual query patterns are detected, such as a very large number of systematic queries from a single source.
Integrate into the existing ISMS: Include AI-specific threats in your risk assessment in accordance with ISO/IEC 27001, rather than establishing a separate set of rules.

Here's how Cyberopex helps

With our Risk Management and Compliance Service, we help you analyze the applicable requirements and implement security measures in accordance with ISO 27001 and ISO 27002. ISO/IEC 27090 is based precisely on this foundation. Together, we’ll identify which AI-specific risks are relevant to your systems and how you can integrate them into your existing risk management framework.