On 7 October 2026, the PCI Security Standards Council (PCI SSC) formally announced new guidance on securing AI in payment environments. The document, Security Considerations for AI Systems, is an information supplement that was first posted on 15 September.
The announcement confirms its role: it is advisory, and where it differs from official PCI standards, the standards always take precedence. This is non-binding PCI SSC guidance. It does not amend PCI DSS or introduce additional assessment requirements.
PCI SSC's core position is that AI should generally be treated like any other technology when determining which PCI requirements apply. Scope follows data and connectivity, not the label on the tool.
The information supplement covers four areas:
PCI SSC lists four factors for scoping an AI system: how it is deployed, how well it is isolated, its access to account data (including training data), and its ability to affect the security of systems that handle cardholder data. In practice, an AI service, model, data pipeline or agent enters scope in one of two ways: it stores, processes or transmits cardholder data, or it can affect the security of the cardholder-data environment (CDE).
The second test is the one that needs the closest attention. An AI tool is not "out of scope" simply because it never sees a card number. Assessors will look at what it is connected to and what it can do:
A customer-service chatbot with read access to order history, or a security copilot that can change firewall rules, may be in scope even if neither handles a primary account number (PAN) directly.
Tokenisation is not an automatic way out either. The guidance treats access to encrypted or tokenised data, combined with tools that can decrypt or detokenise it, as access to readable data.
These steps draw on the guidance's recommendations. Like the guidance itself, they are advisory, not new PCI DSS requirements.
1. Build an AI inventory. Maintain an inventory, or bill of materials, covering models, versions, hosting, integrations, data use and retention, and intended users.
2. Map connections to the CDE. Assess whether each AI component can connect to or affect the CDE, including through its training data.
3. Apply "least agency". Give each AI system only the access and capabilities its task needs, enforced by independent controls such as identity management and network isolation.
4. Split risky combinations. Avoid giving one AI system sensitive data access, external communications and untrusted input together. Where a workflow needs all three, split it across agents with different permissions.
5. Keep secrets out and minimise card data. Keep passwords and keys out of prompts, AI context, outputs and logs. Minimise cardholder data in prompts, outputs, logs and training datasets, and use tokenised or encrypted data where possible, with data-loss prevention that runs independently of the AI.
6. Define human approval points. Specify which AI-driven actions need human sign-off. For agents with access to cleartext cardholder data, require explicit approval for any action involving that data.
7. Treat AI providers as service providers. Assess hosted models and AI platform providers as third-party service providers, and prohibit use of your data for model training in contracts.
8. Test adversarially. Test controls for prompt injection, unsafe actions and data leakage, and cover prompt injection, model poisoning and unapproved AI tools in incident response plans. For a real-world example of how quickly AI-assisted attacks now move, see When Your Attacker Has an AI Coding Agent Too: Lessons from the CyberXero Campaign.
9. Record scope decisions. Retain evidence showing how AI-related scope decisions were reached, and revisit them each time you confirm PCI DSS scope under Requirement 12.5.2: at least every 12 months, and after any significant change.
10. Update awareness training. Cover AI-assisted phishing, data leakage and inappropriate use of public AI services.
PCI SSC has not created new rules for AI. It has made clear that existing rules already apply, and that AI scoping decisions need a rationale that will stand up to assessor scrutiny.
Organisations that document their AI inventory and scope decisions now will go into their next QSA review with a scoping position they can defend.
Cycubix helps merchants and service providers scope AI-enabled environments, test AI integrations for prompt injection and data leakage, and update developer and awareness training, including our Secure Coding for PCI DSS course. Talk to us about what this guidance means for your PCI programme.
