What is ISO/IEC 27090? AI security, explained

A machine learning model can be manipulated by poisoning the data it learns from. It can be stolen through a sequence of perfectly legitimate-looking queries. It can be fooled by inputs crafted to look normal to humans and hostile to no one — except the model. None of these attacks trips a firewall rule, and none of them is addressed by patching a server. This is the gap that ISO/IEC 27090, published in 2026, was written to close.

What this standard is

ISO/IEC 27090 — Cybersecurity — Artificial intelligence (AI) — Addressing security threats and compromises to AI systems — provides guidance on understanding, detecting and mitigating the security threats that are specific to AI systems, across their whole life cycle: from the data used for training, through development and deployment, to operation and retirement. It comes from the same ISO/IEC committee that maintains the ISO/IEC 27000 family, and it deliberately builds on that foundation: the premise is not that conventional cybersecurity becomes obsolete, but that AI adds an attack surface that conventional controls alone do not cover.

Two things make that attack surface different. First, in an AI system, the model and its training data are the asset — not just the infrastructure that hosts them. Protecting the servers while leaving the model’s behavior unexamined protects the box, not the contents. Second, many attacks on AI systems arrive through the front door, as apparently legitimate use. A model-extraction attack looks like a customer making API calls. An evasion attack looks like an ordinary input. Security monitoring built to spot intrusions has nothing obvious to alarm on.

The threats it addresses

Without turning this article into a catalogue, the families of threats the standard deals with are worth knowing by name, because they are entering the vocabulary of audits, contracts and regulatory conversations:

• Data poisoning — manipulating training data so that the model learns the wrong thing: degraded performance, hidden behaviors, or a bias the attacker wants. The attack happens before the system ever goes live, which is what makes it hard to detect in operation.
• Model theft and extraction — reconstructing or copying a model, sometimes through nothing more than systematic querying. For organizations whose model is their competitive advantage, this is intellectual property theft through the service interface.
• Adversarial (evasion) inputs — inputs deliberately crafted to make a model misclassify or misbehave, while looking unremarkable to human eyes. The classic examples come from image recognition, but the pattern applies wherever a model makes decisions.
• Inference and privacy attacks — probing a model to learn things about its training data, including whether a specific person’s data was used. This is where AI security and data protection meet.

ISO/IEC 27090 connects these threats to their potential consequences and to the measures — technical and organizational — that can help prevent, detect and respond to them.

What the standard is not

Three clarifications that save confusion later. ISO/IEC 27090 is a guidance standard: it contains recommendations, not requirements, so there is no such thing as an organization “certified to ISO/IEC 27090.” It is not a hands-on technical manual either — it will not teach your engineers to run adversarial testing tools; it gives the organization the framework for deciding what needs protecting and which kinds of measures belong where. And it is not a replacement for the security work you already do: the standard itself assumes that established information security practice — the territory of ISO/IEC 27001 and 27002 — remains the foundation underneath.

Where it fits in the standards landscape

The useful way to place ISO/IEC 27090 is as the security bridge between two families you may already know:

• ISO/IEC 27001 defines the information security management system — the overall framework for managing security risks. For an organization with an ISMS, 27090 is the guidance for extending that risk assessment and control selection to AI-specific threats.
• ISO/IEC 42001 defines the AI management system — the governance framework for developing and using AI responsibly. Security of AI systems is one of its concerns; 27090 is where that concern gets depth.
• Around them: ISO/IEC 22989 supplies the vocabulary (including the ecosystem roles we covered in a previous article — producer, provider, user), ISO/IEC 23894 addresses AI risk management broadly, and a sibling standard on privacy in AI systems, ISO/IEC 27091, is on its way — the pair will do for AI what 27001 and 27701 did for security and privacy.

For organizations running both an ISMS and an AIMS — or planning to — 27090 is the document that keeps the two from talking past each other on security.

Who should read it

The honest answer follows the ecosystem roles. If your organization produces AI systems, the standard concerns your development life cycle: where poisoning, supply chain and model-protection measures belong. If you provide AI products or services, it concerns what you owe your customers — and what they will increasingly ask you about in due diligence. If you use AI, it sharpens the questions to put to your suppliers: how is the model protected, what happens to our data, how would you detect manipulation? In all three cases, the practical first step is the same and costs nothing: an inventory of your AI systems and the data behind them, because you cannot protect assets you have not listed.

Security teams, CISOs and ISMS implementers will find the material most immediately actionable; AI governance and compliance professionals will want the threat vocabulary, because it is already appearing in regulatory discussions and customer questionnaires.

Frequently asked questions

Can an organization get certified to ISO/IEC 27090?
No. It is a guidance standard, with recommendations rather than requirements. Certifiable frameworks in this space are ISO/IEC 27001 (information security) and ISO/IEC 42001 (AI management systems) — 27090 supports both.

Do we need ISO/IEC 27001 before using ISO/IEC 27090?
No, the guidance can be read and applied on its own. But it is written to sit on top of established security practice, so organizations with an ISMS will find it slots directly into their existing risk assessment and control selection.

What is the difference between ISO/IEC 27090 and ISO/IEC 42001?
ISO/IEC 42001 is the certifiable management system for AI overall — governance, responsibility, impact on people. ISO/IEC 27090 is focused guidance on one dimension: security threats to AI systems and what to do about them. They complement rather than compete

Want to build the foundations these standards sit on? Our ISO/IEC 27001 and ISO/IEC 42001 courses cover both management systems requirement by requirement. And if you want to prove your knowledge, the ISO/IEC 42001 AIMS Practitioner and AIMS Auditor certifications, as well as the Responsible AI Specialist certification, are smart options.