Just Published: Security Considerations for AI Systems

What happened

On 15 September 2026 the PCI Security Standards Council published an information supplement that addresses security considerations for artificial intelligence systems in payment contexts. The document, created with input from the Global Executive Assessor Roundtable and the PCI Board of Advisors, offers high‑level AI guidelines and outlines how AI can be used both within payment systems and as an attack vector against them. It explicitly states the supplement is advisory and does not create new mandatory PCI requirements. When guidance conflicts with existing PCI standards, the standards prevail.

Why it matters

Entities that must comply with PCI standards should review the supplement to identify AI‑related risks and incorporate its recommendations into existing security programs, but they are not required to adopt any new controls.

Business impact

Adopting the guidance can improve threat detection and mitigation for AI‑enabled attacks, potentially reducing fraud losses without altering compliance obligations.

Who reported it

Discussion