DE — heise online
ISO/IEC 27090 Aims to Make AI Systems Secure
Security2 min read
ISO and IEC have published ISO/IEC 27090, a new guide on how to protect AI systems from security attacks. It is a guide, not a certificate.
What happened
The standards bodies ISO and IEC published ISO/IEC 27090, titled "Cybersecurity — Artificial intelligence (AI) — Addressing security threats and compromises to AI systems." It describes security threats that only affect AI systems. It explains what they cause and lists ways to find and stop them. There is no certificate. The document is a guide and does not contain requirements that must be met.
Key facts
- The first edition has 56 pages.
- It comes from the subcommittee JTC 1/SC 27, which also runs the ISO/IEC 27000 series.
- The project was accepted in September 2022. The committee draft came in January 2024. The DIS vote ended in July 2025.
- The standard is only available in English. It costs 204 Swiss francs as a PDF or in print.
Types of attacks covered
The guide covers many attack types. Data poisoning means feeding bad data into training. Model weight manipulation changes the inner settings of a model. Evasion attacks use tricked inputs to fool a model. Model extraction copies a model through its interface. Membership inference and model inversion try to learn about the training data. Prompt injection and attacks through model outputs are also included. An annex links attacks to the stages of the AI life cycle and to the assets they affect. A second annex describes AI versions of classic attacks. Agentic AI systems that use tools are only briefly covered.
Why it matters
The guide fills a gap. ISO/IEC 27001 and 27002 cover normal IT security, and ISO/IEC 42001 asks for AI security controls but does not name attacks. ISO/IEC 27090 shows where normal controls still work and where models, training data and ML pipelines need extra protection. For European companies, the publication does not change the law. It does not give a presumption of conformity under the AI Act or the Cyber Resilience Act. CEN/CENELEC JTC 21 is still working on the harmonised standard prEN 18282, which is still a draft.
What to watch
- ISO/IEC 27091, on privacy in AI systems, is at the Final Draft stage.
- The harmonised standard prEN 18282 from CEN/CENELEC JTC 21 is still in draft.
- ETSI has published TS 104 223. No mapping between ISO/IEC 27090, prEN 18282 and TS 104 223 exists yet.
Glossary
- ISO/IEC 27090
- A new international guide on protecting AI systems from security attacks. It is not a certificate.
- ISO/IEC 27001
- An international standard for running an information security management system, which can be certified.
- ISO/IEC 42001
- An international standard for managing AI systems in an organization. It can be certified.
- prEN 18282
- A draft European standard on cybersecurity for AI systems, still being written.