AI News · AI Security · 21 October 2026
ISO/IEC 27090 was published on 14 October 2026. It sets out how AI systems get attacked, from poisoned training data to prompt injection, and the controls to detect and mitigate each threat across the AI life cycle.
Why it matters
Most organizations already secure AI with the controls they use for any other system: access control, patching, logging. Those still matter, and the standard is clear that AI security starts with the fundamentals. But AI systems can also be attacked through the data they learn from, the instructions they read, and the answers they give. Those threats need controls that traditional security programs weren’t designed to provide.
The 9 categories of AI compromise
Clause 6 of the standard covers nine categories. Here they are, with a plain-language summary of each in my own words:
| Clause | Attack | In plain language |
|---|---|---|
| 6.2 | Data poisoning | Manipulated data slipped into what a model learns from, so it makes mistakes or hides a backdoor |
| 6.3 | Evasion | Inputs crafted to fool a model, such as a slightly altered input that slips past an AI filter |
| 6.4 | Membership inference | Working out whether a specific person’s data was used to train a model |
| 6.5 | Model exfiltration | Stealing a model, or copying its behavior, without authorization |
| 6.6 | Model inversion | Reconstructing sensitive training data from a model’s outputs |
| 6.7 | Direct model poisoning | Tampering with the model itself rather than its data |
| 6.8 | Sensitive model output | A model revealing confidential or personal information in its answers |
| 6.9 | Prompt injection | Hidden or malicious instructions that hijack what an AI assistant does |
| 6.10 | Output containing injection attacks | AI output that carries an attack into another system, such as code or commands |
Where it fits with 27001 and 42001
| Standard | Focus | Certifiable? |
|---|---|---|
| ISO/IEC 27001 | Information security management system | Yes |
| ISO/IEC 42001 | AI management system | Yes |
| ISO/IEC 27090 | Security threats specific to AI systems | No, guidance |
Clause 5 of the standard grounds AI security in fundamentals you may already have: an AI governance programme, zero trust principles, secure software engineering, supply chain management, threat modelling, and red teaming.
What to do now
- Update your AI risk assessments so they cover AI-specific threats, not just traditional cybersecurity risks. Risk assessment is Step 5 of my 8 steps to build an AI governance program.
- Start with your AI inventory. You can’t assess threats to AI systems you don’t know about. The free AI System Inventory Template is a practical starting point.
- Ask your AI vendors how they defend against prompt injection, data poisoning, and sensitive data leakage, and ask for evidence, not just assurances.
- Review where AI connects to other systems. The more an AI tool can read and do, the more prompt injection and output injection matter.
AI Attacks Explained: the series. I’m breaking down each of the nine attacks, one episode at a time.
- Data poisoning (Clause 6.2)
- Evasion (Clause 6.3), coming soon
- Membership inference (Clause 6.4), coming soon
- Model exfiltration (Clause 6.5), coming soon
- Model inversion (Clause 6.6), coming soon
- Direct model poisoning (Clause 6.7), coming soon
- Sensitive model output (Clause 6.8), coming soon
- Prompt injection (Clause 6.9), coming soon
- Output containing injection attacks (Clause 6.10), coming soon
Subscribe on YouTube to follow along.
This is my summary of ISO/IEC 27090:2026. For the full guidance, obtain the standard from ISO. General education, not legal advice.