Basil C. Puglisi

Artificial Intelligence (AI) & Digital Marketing Since 2009

ISO/IEC 27090 Maps the Attacks on AI; Your Team Still Owns the Response #AIg

by Leave a Comment

NIST diagram showing three circles for availability, integrity, and privacy attacks on predictive AI, with callouts for data poisoning, model poisoning, evasion, backdoor poisoning, model extraction, and membership inference
Image: NIST AI 100-2e2025, Figure 1, “Taxonomy of attacks on PredAI systems” (Vassilev et al., March 2025).

Your firewall can be working perfectly while your AI model is the thing under attack. That is the problem a new international standard was written to name. ISO/IEC 27090, Cybersecurity — Artificial intelligence (AI) — Addressing security threats and compromises to AI systems, cleared its final ballot on August 19, 2026, and ISO now lists it as under publication with an October 2026 publication date. ISO has also posted a guide to the standard drawn from the final draft, so organizations can see what it asks before the published edition lands.

Our position is simple. ISO/IEC 27090 is a strong threat map and an honest one, and its most important line is not about an attack at all. In its list of practical first steps, ISO asks organizations to consider “how suspicious behaviour would be detected and who would respond.” Detection is a technical control. The response is a human decision. A security program that buys the first and leaves the second unnamed has a list of threats, not a defense.

What ISO/IEC 27090 covers

The standard comes out of ISO/IEC JTC 1/SC 27, the committee behind the ISO/IEC 27000 information security family, after a project that was approved in September 2022. ISO describes it as guidance on “understanding, detecting and mitigating security threats specific to artificial intelligence (AI) systems throughout their life cycle.” Its guide is careful about scope. The focus is protecting AI systems, not using AI to defend other systems, and it “provides security guidance, not requirements for an AI management system.”

The threat list is the practical core. ISO’s guide names data poisoning, where malicious or unwanted data is introduced into training data to influence outcomes, and model exfiltration, where a model is extracted “including through queries that can appear legitimate.” It also covers evasion attacks, membership inference, model inversion, direct model poisoning, prompt injection, sensitive model output, and outputs that contain injection attacks. Beyond the attacks, the draft addresses where AI systems and their data come from, how mitigations interact and sometimes conflict, and how models and mitigations can deteriorate over time.

Two warnings in the guide deserve more attention than the threat list. The first is about access. Because repeated queries can be used to extract a model, ISO says “controlling access alone may therefore be insufficient without ways to detect suspicious use.” The second is about retraining: data collected during operation can create new exposure when it is later used to retrain the model. A system that was clean at launch can be poisoned by its own feedback loop.

Where 27090 sits next to ISO/IEC 42001 and the AI Act

ISO draws the line itself. ISO/IEC 27001 and 27002 remain the information security foundation, and 27090 adds AI-specific detail on top of them rather than replacing them. ISO/IEC 42001 sets requirements for an AI management system across the organization. In ISO’s words, “Security is part of responsible AI management, but it is not the whole picture.” That is the same layering argued in The Standard of Care: voluntary NIST and ISO documents become the measure courts and insurers reach for, so the record of how you applied them matters as much as the certificate.

The European Union has already written these threats into law. Article 15(5) of the AI Act says high-risk AI systems “shall be resilient against attempts by unauthorised third parties to alter their use, outputs or performance by exploiting system vulnerabilities,” with measures to “prevent, detect, respond to, resolve and control for” data poisoning, model poisoning, adversarial examples or model evasion, confidentiality attacks, and model flaws. Under the amended Article 113, those high-risk requirements apply from December 2, 2027 for Annex III systems and August 2, 2028 for systems covered by Annex I product legislation.

Note the verb in the middle of that list: respond. The law already assumes someone answers the alarm. What 27090 does not do, by its own terms, is give anyone a presumption of compliance. The European Commission’s AI Act standardisation page explains that only harmonised standards referenced in the Official Journal provide that legal certainty, and cybersecurity is one of the ten areas the Commission asked CEN and CENELEC to cover. The Commission also says international standards “when available and aligned with EU requirements” can become European harmonised standards. Until that happens, 27090 is evidence of good practice, not a legal shield.

Why detection alone is not governance

ISO is candid about limits. Its approach is defence in depth, “while recognizing that detecting some AI threats remains difficult,” and the guide closes by saying the standard “does not guarantee immunity from attack.” NIST reached the same place from the research side. Its adversarial machine learning taxonomy, NIST AI 100-2e2025, warns that theoretical results suggest “fully robust systems may be mathematically impossible without additional assumptions” and that designing models that resist evasion while keeping accuracy “remains an open problem.”

That is where the difference between Responsible AI and AI Governance stops being academic. Logging, input filtering, rate limits, and anomaly detection are machine checking machine. That is Responsible AI work, and 27090 makes it better organized. But when a detector flags a possible poisoning event in a model that scores loan applicants, a machine cannot decide whether to roll back the model, pause the decisions, or notify the people affected. A named person with the authority to accept, modify, or reject the system’s next move has to make that call, and that is AI Governance.

Standards bodies have not always been willing to say that out loud. When the U.S. Technical Advisory Group reviewed a public comment asking ISO/DIS 21520 to anchor its definition of AI governance in human authority, it rejected the change. ISO/IEC 27090 does not settle that argument, but its own first-steps list points the same direction: someone has to respond.

What security and governance teams should do now

First, build the AI asset register ISO asks for, including systems supplied by third parties. For each one, record where its training data and model came from and whether operational data feeds retraining. The measure is coverage: the share of AI systems in production with a documented data and model origin.

Second, test whether your monitoring can see the attacks that look like normal use. Run an extraction-style query pattern and a poisoned-sample test against a staging copy and check whether anything fires. The measure is time to detect, in hours, for each test.

Third, name the responder before the alert. Write down who can pull a model offline, who can halt the decisions it feeds, and who tells affected people, then rehearse it. The measure is time from detection to a human decision, recorded every time it happens, including drills.

ISO/IEC 27090 gives security teams a shared vocabulary for attacks that conventional controls miss, and that is real progress. The standard can tell you what to watch for. It cannot tell you who has the authority to act, and in a high-risk system that answer has to exist on paper before the alert ever fires.

Sources

FAQ

What is ISO/IEC 27090?

ISO/IEC 27090 is an international standard from ISO/IEC JTC 1/SC 27 that gives guidance on understanding, detecting, and mitigating security threats specific to AI systems across their life cycle. ISO lists it as under publication with an October 2026 publication date. It is security guidance, not a set of requirements for an AI management system.

Which AI attacks does ISO/IEC 27090 address?

ISO’s guide names data poisoning and model exfiltration, along with evasion attacks, membership inference, model inversion, direct model poisoning, prompt injection, sensitive model output, and outputs that contain injection attacks. It also covers data and model origins, how mitigations interact, and how protection can deteriorate over time.

How is ISO/IEC 27090 different from ISO/IEC 42001?

ISO/IEC 42001 sets requirements for managing AI across an organization. ISO/IEC 27090 focuses on security threats to AI systems and how to detect and mitigate them. It builds on ISO/IEC 27001 and 27002 rather than replacing them.

Does following ISO/IEC 27090 mean compliance with the EU AI Act?

No. Article 15 of the AI Act requires high-risk AI systems to resist attacks such as data poisoning and adversarial examples, but the European Commission says only harmonised standards referenced in the Official Journal give a presumption of conformity. ISO/IEC 27090 can support a compliance record without providing that legal presumption.

Is AI security monitoring Responsible AI or AI Governance?

Automated monitoring, filtering, and logging are Responsible AI, because they are machines checking machines with no human review. AI Governance begins when a named person with authority accepts, modifies, or rejects what happens next, such as rolling back a poisoned model or pausing its decisions.

What should organizations do before the standard is published?

Inventory every AI system you develop or use, including third-party systems, and record where its data and models come from. Test whether monitoring catches extraction-style queries and poisoned samples, and name the people who can take a model offline and notify affected users, then rehearse that response.

AI disclosure: This column was researched and drafted with AI assistance by HAIA Agents (RAI by GrokBot), using primary sources verified at time of publication. #AIg

Subscribe to Blog via Email

Enter your email address to subscribe

Join 9,585 other subscribers

Reader Interactions

Leave a Reply