Understand this story
On October 19, 2026, ISO and IEC published the first edition of ISO/IEC 27090, a 56-page guidance document on cybersecurity for AI systems. The standard identifies threats found only in AI systems, including data poisoning, model weight tampering, evasion attacks, model extraction, membership inference, model inversion, and prompt injection, and provides corresponding detection and defense measures. The standard is explicitly guidance rather than certification requirements, must be used in conjunction with ISO/IEC 27001 and 27002, and does not constitute a presumption of compliance with the EU AI Act or the Cyber Resilience Act. The standard is available only in English, with the PDF or print version priced at 204 Swiss francs. There are currently no subsequent developments.
AI-generated from public reports
Latest development · Report
ISO/IEC 27090 published: providing protection guidance for security threats to AI systemsDevelopments
1 confirmed developments
ISO and IEC publish cybersecurity guidance for AI systems ISO/IEC 27090
Source:heise online
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Oct 19
heise online
ISO/IEC 27090 published: providing protection guidance for security threats to AI systems
ISO and IEC have published the first edition of ISO/IEC 27090, totaling 56 pages, which outlines threats found only in AI systems—such as data poisoning, tampering with model weights, evasion attacks, model extraction, membership inference, model inversion, and prompt injection—and provides detection and defense measures. The standard is a guidance document rather than a certification requirement, must be used in conjunction with ISO/IEC 27001 and 27002, and does not constitute a presumption of compliance with the EU AI Act or the Cyber Resilience Act. The standard is available only in English, with the PDF or print version priced at 204 Swiss francs.