PCI SSC issues guidance on AI security, mandates human approval for cardholder data actions

The PCI Security Standards Council (PCI SSC) has published new guidance titled "Security Considerations for AI Systems," addressing the growing use of artificial intelligence in payment environments. According to Help Net Security, the document outlines protections for data supplied to AI systems and defenses against AI-assisted attacks, with a specific recommendation for human approval of AI agent actions involving cardholder data.

The guidance was developed with input from industry stakeholders and covers governance, deployment, access controls, testing, and the application of existing PCI standards. The PCI SSC emphasizes that these recommendations are advisory in nature. Crucially, the council stated that existing PCI requirements take precedence over the new AI-specific guidance. This ensures that organizations maintaining compliance with current standards remain protected while integrating new technologies.

Context and Background

As AI technologies become increasingly prevalent in payment processing and related security functions, the risks associated with data handling and automated decision-making have grown. The PCI SSC’s new document aims to address these evolving threats by providing a framework for the secure integration of AI. The guidance specifically targets the protection of cardholder data when it is supplied to AI systems, recognizing that these systems can introduce new vectors for compromise or data leakage.

The council notes that there is an obligation for all parties involved in payment environments to ensure the security of cardholder data, even when leveraging AI. The document serves as a resource for organizations looking to align their AI deployments with broader security goals, without replacing the foundational requirements of the PCI Data Security Standard (PCI DSS). By focusing on governance and access controls, the guidance seeks to mitigate risks such as unauthorized access, data exfiltration, and manipulation of AI outputs.

Who Is Affected

This guidance primarily affects organizations that handle cardholder data and are considering or currently using AI systems in their payment environments. This includes merchants, service providers, and any entity within the payment ecosystem that integrates AI for fraud detection, customer service, data analysis, or other functions. While the recommendations are advisory, entities subject to PCI DSS compliance must ensure that their AI implementations do not violate existing security requirements.

Security professionals and technology leaders responsible for AI deployment need to review this guidance to ensure their systems adhere to best practices for data protection. The emphasis on human approval for actions involving cardholder data suggests that fully autonomous AI agents handling sensitive information may pose compliance risks if not properly supervised. Organizations must assess their current AI workflows to identify where human oversight is necessary to maintain security and compliance.

What should you do?

Organizations should begin by reviewing their current AI deployments to identify any processes that involve cardholder data. Security teams should evaluate whether human approval mechanisms are in place for critical actions performed by AI agents. Additionally, entities should ensure that their AI systems are tested for vulnerabilities and that access controls are strictly enforced. Monitoring for AI-assisted attacks should also be integrated into existing security operations.

What to do and how to stay safe: PCI SSC

• Review current AI system deployments to identify any handling of cardholder data.
• Implement human approval workflows for AI agent actions involving sensitive payment information.
• Ensure AI systems are subject to regular security testing and access control reviews.
• Monitor for potential AI-assisted attacks and update detection rules accordingly.

Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does the PCI SSC mandate the use of AI in payment environments?

No, the PCI SSC has published advisory guidance on securing AI systems, but it does not mandate their use. Existing PCI standards take precedence.

Is human approval required for all AI actions?

The guidance specifically recommends human approval for AI agent actions involving cardholder data, not necessarily all AI actions.

Do these new recommendations replace existing PCI DSS requirements?

No, the PCI SSC states that existing PCI requirements take precedence over the new advisory recommendations.