Status: Non-binding PCI SSC guidance. It does not amend PCI DSS or introduce additional assessment requirements.
On 7 October 2026, the PCI Security Standards Council (PCI SSC) formally announced new guidance on securing AI in payment environments. The document, Security Considerations for AI Systems, was first posted on 15 September. The announcement confirms its role: it is advisory, and where it differs from official PCI standards, the standards always take precedence.
PCI SSC's core position is that AI should generally be treated like any other technology when determining which PCI requirements apply. Scope follows data and connectivity, not the label on the tool.
The supplement covers five areas:
For a real-world example of how quickly AI-assisted attacks now move, see When Your Attacker Has an AI Coding Agent Too: Lessons from the CyberXero Campaign.
PCI SSC lists four factors for scoping an AI system: how it is deployed, how well it is isolated, its access to account data (including training data), and its ability to affect the security of systems that handle cardholder data. In practice, an AI service, model, data pipeline or agent enters scope in one of two ways: it stores, processes or transmits payment data, or it can affect the security of the cardholder-data environment (CDE).
The second test is where many organisations will get caught out. An AI tool is not "out of scope" simply because it never sees a card number. Assessors will look at what it is connected to and what it can do:
A customer-service chatbot with read access to order history, or a security copilot that can change firewall rules, may be in scope even if neither handles a PAN directly.
Tokenisation is not an automatic way out either. The guidance treats access to encrypted or tokenised data, combined with tools that can decrypt or detokenise it, as access to readable data.
These steps draw on the guidance's recommendations. Like the guidance itself, they are advisory, not new PCI DSS requirements.
1. Build an AI inventory. Create an AI inventory, or bill of materials, covering models, versions, hosting, integrations, data use and retention, and intended users.
2. Map connections to the CDE. Assess whether each AI component can connect to or affect the CDE, including through its training data.
3. Apply "least agency". Give each AI system only the access and capabilities its task needs, enforced by independent controls such as identity management and network isolation.
4. Split risky combinations. Avoid giving one AI system sensitive data access, external communications and untrusted input together. Where a workflow needs all three, split it across agents with different permissions.
5. Keep secrets and card data out. Keep cardholder data, passwords and keys out of prompts, AI context, outputs, logs and training datasets. Use tokenised data where possible, with data-loss prevention that runs independently of the AI.
6. Define human approval points. Specify which AI-driven actions need human sign-off. For agents with access to cleartext cardholder data, require explicit approval for any action involving that data.
7. Treat AI providers as service providers. Assess hosted models and AI platform providers as third-party service providers, and prohibit use of your data for model training in contracts.
8. Test adversarially. Test controls for prompt injection, unsafe actions and data leakage, and cover prompt injection, model poisoning and unapproved AI tools in incident response plans.
9. Record scope decisions. Retain evidence showing how AI-related scope decisions were reached.
10. Update awareness training. Cover AI-assisted phishing, data leakage and inappropriate use of public AI services.
PCI SSC has not created new rules for AI. It has made clear that existing rules already apply, and that a weak scoping rationale for AI will not survive an assessment.
Organisations that document their AI inventory and scope decisions now will face fewer surprises at their next QSA review.
Cycubix helps merchants and service providers scope AI-enabled environments, test AI integrations for prompt injection and data leakage, and update developer and awareness training, including our Secure Coding for PCI DSS course. Talk to us about what this guidance means for your PCI programme.
