1. What ISO/IEC 27090 is

ISO/IEC 27090 addresses security threats and compromises specific to artificial intelligence systems. It is intended to help organizations understand the consequences of these threats and approaches to detecting and mitigating them throughout an AI system’s life cycle.

ISO/IEC 27090 is currently under publication. This guide draws on the final draft; the published edition should be consulted for the final content.

Its focus is protecting AI systems against security threats, rather than using AI to defend other systems. It provides security guidance, not requirements for an AI management system.

2. Who ISO/IEC 27090 is for

The document is intended for organizations of all sizes that develop or use AI, including businesses, public bodies and not-for-profit organizations.

It can inform discussions between cybersecurity teams, AI developers, people responsible for data and those overseeing the procurement or use of AI systems. Their responsibilities differ, but they need a shared understanding of what could be compromised and the consequences.

The scope is not limited to generative AI or chatbots: it addresses security threats to AI systems more broadly.

3. Why AI systems need additional security measures

AI systems remain exposed to conventional cybersecurity threats. Protecting software, infrastructure and access to information is still necessary. AI-specific measures add to that foundation; they do not replace it.

Many AI systems also depend heavily on training data. If an attacker introduces malicious data, the effects can carry through into the model’s behaviour. Data collected during operation can create further exposure when it is later used for retraining.

Other attacks can exploit access that appears legitimate. For example, repeated queries to a model can be used in attempts to extract it. Controlling access alone may therefore be insufficient without ways to detect suspicious use.

The consequences can extend beyond lost information or intellectual property. Where AI influences decisions or operates in safety-critical settings, compromised behaviour can also harm people.

4. What ISO/IEC 27090 covers

The final draft brings together three connected areas: applying information security to AI, understanding potential compromises and considering how safeguards work together.

Applying information security to AI

Topics include AI governance, zero trust principles, software engineering practices and supply-chain security. The draft also covers threat modelling and red teaming: examining how systems might be attacked and testing them from an adversarial perspective.

Understanding AI-specific threats

The draft examines different types of compromise, their potential consequences, detection and mitigation. These include:

• Data poisoning: introducing malicious or unwanted data into training data to influence outcomes.
• Model exfiltration: extracting a model, including through queries that can appear legitimate.
• Other threats involving model behaviour or information exposure, including evasion attacks, membership inference, model inversion and direct model poisoning.
• Threats involving inputs and outputs, including prompt injection, sensitive model output and outputs containing injection attacks.

It also addresses the origins and history of AI systems and their data, and ways to limit the effects of unwanted model behaviour during operation.

Maintaining protection over time

A safeguard cannot be considered only in isolation. The draft addresses interactions between mitigations, including potential conflicts, and the need to maintain protection across the AI life cycle.

Topics include logging and monitoring, protecting development environments, detecting malicious inputs and limiting model use. It also considers how models and mitigations can deteriorate over time.

The underlying approach is defence in depth: using several layers of protection while recognizing that detecting some AI threats remains difficult.

5. How ISO/IEC 27090 relates to other standards

ISO/IEC 27001 and ISO/IEC 27002: the information security foundation

ISO/IEC 27001 sets requirements for an information security management system. ISO/IEC 27002 provides guidance on information security controls.

The introduction to ISO/IEC 27090 recommends established practices from both. Its AI-specific guidance adds detail about threats and assets that may need additional attention.

ISO/IEC 42001: managing AI across the organization

ISO/IEC 42001 sets requirements for an AI management system. It addresses how an organization manages its responsibilities, risks and opportunities relating to AI.

The distinction is one of focus: ISO/IEC 42001 addresses organizational management of AI, while ISO/IEC 27090 examines security threats to AI systems and ways to address them. Security is part of responsible AI management, but it is not the whole picture.

ISO/IEC 22989 and ISO/IEC 23053: shared concepts

The final draft names ISO/IEC 22989 and ISO/IEC 23053:2022 as normative references. They provide AI concepts and terminology, and a framework for describing AI systems that use machine learning, respectively. These foundations help readers understand the systems and concepts discussed in the security guidance.

6. Practical first steps

Organizations preparing to use the guidance can start by:

• Identifying the AI systems they develop or use, including those supplied by third parties.
• Understanding where their data and models come from, and how these change during operation or retraining.
• Bringing together the people responsible for cybersecurity, AI development, data and procurement.
• Reviewing existing security practices to identify where AI-specific threats need closer examination.
• Considering how suspicious behaviour would be detected and who would respond.

These are starting points for discussion and review, not a substitute for assessing a particular system or consulting the published standard.