ISO/IEC 27090:2026 Published: New International Standard Addresses Cybersecurity Threats to AI Systems
The International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) have published ISO/IEC 27090:2026, a new international standard addressing cybersecurity threats and compromises affecting artificial intelligence systems.
Published on 14 October 2026, the standard provides guidance to organisations developing or using AI technologies on understanding security threats, detecting potential compromises and implementing appropriate mitigation measures.
As AI becomes increasingly integrated into business operations, public services and critical infrastructure, protecting AI systems against emerging cybersecurity threats has become an important organisational priority.
What is ISO/IEC 27090:2026?
ISO/IEC 27090:2026 provides guidance on cybersecurity risks specific to artificial intelligence systems. Developed by ISO/IEC JTC 1/SC 27, the international committee responsible for information security, cybersecurity and privacy protection, the standard addresses vulnerabilities that may arise throughout the AI system life cycle.
Its scope includes organisations of all sizes, including government institutions, private companies and not-for-profit organisations. Unlike conventional cybersecurity guidance, ISO/IEC 27090 focuses on the distinctive security challenges associated with AI technologies.
What cybersecurity threats does ISO/IEC 27090 address?
Artificial intelligence introduces security risks that may not be adequately addressed through conventional cybersecurity controls alone.
Data poisoning: Manipulation of training data that can compromise an AI model's behaviour or reliability.
Model theft: Attempts to extract or replicate AI models, potentially compromising intellectual property and commercially valuable technology.
AI system vulnerabilities: Weaknesses associated with AI development, deployment and operation that attackers may exploit.
Compromised model updates: Security risks arising when corrupted information is introduced during model updates or retraining.
ISO/IEC 27090 provides guidance on understanding these threats, evaluating their consequences and considering appropriate detection and mitigation measures.
How does ISO/IEC 27090 relate to ISO/IEC 27001 and ISO/IEC 42001?
The publication of ISO/IEC 27090 adds to the growing international framework of standards supporting responsible and secure AI adoption.
ISO/IEC 27001 establishes requirements for managing information security risks through an organisational management system.
ISO/IEC 42001 establishes requirements for implementing, maintaining and continually improving an AI management system.
ISO/IEC 27090 provides complementary guidance focused specifically on cybersecurity threats and compromises affecting AI technologies.
Together, these standards can support a more comprehensive approach to information security, AI governance and the management of emerging technological risks. Importantly, ISO/IEC 27090 is a guidance standard. Its publication does not itself create mandatory legal requirements or establish a new organisational certification scheme.
Why is ISO/IEC 27090 important for organisations?
As organisations deploy AI across increasingly complex business processes, cybersecurity teams must understand how these systems differ from conventional software applications.
AI introduces additional considerations involving training datasets, model integrity, intellectual property protection and the potential manipulation of system outputs.
The publication of ISO/IEC 27090 provides organisations with internationally developed guidance for understanding these challenges. For organisations across the GCC and internationally, it also highlights the importance of integrating AI-specific cybersecurity considerations into existing information security and risk management arrangements.
What should organisations do following its publication?
Organisations developing or deploying AI should consider reviewing their current cybersecurity arrangements against the threats identified by ISO/IEC 27090.
Potential priorities include assessing vulnerabilities within AI systems, reviewing safeguards protecting training data and models, strengthening monitoring capabilities and ensuring relevant personnel understand AI-specific security risks.
Organisations already implementing ISO/IEC 27001 or ISO/IEC 42001 may also consider how the new guidance complements their existing management systems.
How can MENA Executive Training support AI cybersecurity and governance?
MENA Executive Training provides professional development programmes covering artificial intelligence governance, cybersecurity, information security and internationally recognised management system standards.
Our portfolio includes ISO/IEC 42001 AI Management Systems training and ISO/IEC 27001 Information Security Management Systems training through PECB, IAPP Artificial Intelligence Governance Professional (AIGP) training and relevant ISACA professional qualifications.
These programmes help organisations develop the professional capabilities required to manage technological risks and strengthen governance arrangements.
Contact MENA Executive Training to discuss AI governance, cybersecurity and ISO standards training for your organisation.
Official sources
Cover image attribution, when added: © ISO/IEC 2026. Reproduced with permission.
