Published on 14 October 2026, ISO/IEC 27090 is the first international standard dedicated to security threats specific to artificial intelligence systems. Voluntary and not certifiable, it will nonetheless have concrete legal effects: through the state of the art, Article 15 of the AI Act and the EDPB’s position, it becomes the benchmark against which regulators and courts will measure the security of your AI systems.
Key points
- ISO/IEC 27090:2026 (first edition) was published on 14 October 2026 by subcommittee ISO/IEC JTC 1/SC 27.
- It describes AI-specific threats (data poisoning, evasion, model theft and inversion, membership inference, prompt injection) and how to detect and mitigate them.
- It is guidance: no certification, no legal obligation, no presumption of conformity with the AI Act.
- Yet three mechanisms make it unavoidable: the state of the art (GDPR, NIS2), Article 15 of the AI Act and the EDPB’s position on the anonymity of AI models.
- Immediate priority: review your contracts with AI providers.
What is ISO/IEC 27090?
ISO/IEC 27090:2026 covers the cybersecurity of artificial intelligence and, more precisely, how to address security threats and compromises to AI systems. Developed since 2022 within subcommittee ISO/IEC JTC 1/SC 27, it runs to 56 pages and was published on 14 October 2026.
It is aimed at any organisation that develops or uses AI systems. Its purpose is threefold: identifying what needs protecting, from training data to models; understanding the consequences of attacks; and detecting and mitigating these threats across the system’s entire life cycle.
The standard stresses an often-overlooked point: updates and retraining. In a system that learns continuously, operational data becomes training data, and therefore an entry point for poisoning.
Which threats does it cover?
| Threat | What the attacker does | Main impact |
|---|---|---|
| Data poisoning | Alters training or retraining data | Integrity |
| Evasion | Submits inputs designed to fool the model in production | Integrity |
| Model theft | Replicates the model through seemingly legitimate queries | Confidentiality, intellectual property |
| Model inversion | Reconstructs training data from the model’s outputs | Confidentiality |
| Membership inference | Determines whether a person is in the training set | Confidentiality |
| Prompt injection | Hides instructions that hijack the system | Integrity, availability |
These attacks share one feature: they slip past conventional controls. A firewall cannot see poisoned data, and model-theft queries look like normal use.
How does it fit with ISO/IEC 27001, 27002 and 42001?
ISO/IEC 27001 sets the requirements for an information security management system; ISO/IEC 27002 details the controls; ISO/IEC 42001 frames the AI management system. ISO/IEC 27090 replaces none of them. It complements them by describing, threat by threat, what those frameworks do not detail for AI.
Since 27001 and 42001 share the same structure, an integrated security and AI management system is feasible, with 27090 serving as the technical reference for AI-specific risks.
A voluntary standard: what legal status?
Formally, ISO/IEC 27090 is a guidance document. Three consequences follow.
- It is not certifiable. Unlike 27001 and 42001, no body issues ISO/IEC 27090 certificates.
- It is not mandatory. No legislation makes it directly applicable.
- It is not a harmonised standard. Only harmonised standards whose references are published in the Official Journal of the European Union confer a presumption of conformity with the AI Act (Art. 40).
It would nonetheless be a mistake to treat it as soft law without consequences.
Why the standard will be held against you in practice
1. The state of the art: GDPR and NIS2
The GDPR (Art. 32) requires appropriate security measures, taking into account the state of the art. The NIS2 Directive (Art. 21) requires essential and important entities to adopt measures based on the state of the art and, where applicable, relevant European and international standards. On this point, see our article on NIS 2 transposition in France.
In AI security, the state of the art now has a published international benchmark. After an incident, the CNIL, ANSSI or the courts will have a reference against which to assess whether the measures taken were adequate. In contractual matters, a provider’s security obligation is likewise assessed against professional standards.
2. The AI Act: Article 15 already targets these attacks
Article 15 of Regulation (EU) 2024/1689 requires high-risk AI systems to be resilient against attempts by unauthorised third parties to exploit their vulnerabilities. The text expressly names data poisoning, the poisoning of pre-trained components, adversarial examples and model evasion, confidentiality attacks and model flaws.
ISO/IEC 27090 describes these very threats. Pending harmonised standards, it will be a natural reference for demonstrating compliance with this requirement.
The timeline was adjusted by Regulation (EU) 2026/1744, known as the “AI Omnibus”, which entered into force on 27 July 2026. Obligations for high-risk systems listed in Annex III will apply from 2 December 2027, and those for systems embedded in regulated products from 2 August 2028. This deferral is not a reprieve: it is a compliance window. Obligations for general-purpose AI models, including cybersecurity for models with systemic risk (Art. 55), have not been deferred. For groups established outside the Union, see AI Act: obligations for non-EU companies.
3. Personal data: inversion, inference and EDPB Opinion 28/2024
Model inversion and membership inference make it possible to extract from a model information about the individuals whose data was used to train it. These are personal data breach scenarios: notification to the supervisory authority within 72 hours where there is a risk (GDPR Art. 33) and communication to the individuals concerned where the risk is high (Art. 34).
In its Opinion 28/2024, published on 18 December 2024, the EDPB considers that a model trained on personal data can only be regarded as anonymous if the likelihood of extracting personal data from it, in particular through membership inference or inversion attacks, is insignificant. A model vulnerable to such attacks remains subject to the GDPR.
For the DPO, ISO/IEC 27090 becomes a reading grid for data protection impact assessments (GDPR Art. 35) of AI projects. See our personal data protection and GDPR compliance services, including outsourced DPO.
What businesses should do now
Review your contracts with AI providers
The priority is contractual. A contract with an AI provider should address at least six points:
- Provenance and integrity of training data: warranties on the origin of the data and anti-poisoning controls.
- Prohibition on training models on your data without express written consent.
- Notification of AI-specific incidents: detected poisoning, model extraction, prompt injection, with deadlines compatible with your own obligations.
- Governance of updates and retraining: prior notice, testing, the ability to roll back to the previous version.
- Logging, audit and reversibility: access to logs, audit rights, return of data at the end of the contract.
- Allocation of responsibilities mirroring the AI Act’s provider and deployer roles.
We draft and negotiate these IT and AI contracts.
Add AI systems to your risk register
- Map all AI uses, including those that were never authorised.
- Record each AI system in the risk register and, where applicable, in the impact assessment.
- Never give an AI agent more rights than the user it assists.
- Train teams on what they may entrust to an AI tool, and what they must never entrust to it.
Financial sector: align with DORA
For financial entities, DORA, Regulation (EU) 2022/2554, has applied since 17 January 2025. An AI service provider is a third-party ICT service provider: the clauses above must be aligned with the mandatory contractual provisions of Article 30 of DORA.
What about Tunisia?
Decree-Law No. 2023-17 of 11 March 2023 on cybersecurity was supplemented by implementing texts published in September 2023. They determine the entities subject to mandatory periodic security audits and the technical standards for those audits. An AI system integrated into the information system of an entity in scope is likely to fall within their perimeter.
For businesses operating on both sides of the Mediterranean, see also our articles GDPR, Tunisian law and artificial intelligence and the legal framework for cybersecurity in Tunisia.
Frequently asked questions about ISO/IEC 27090
Is ISO/IEC 27090 mandatory?
No. No legislation requires it. However, the GDPR and NIS2 assess security measures against the state of the art, which this standard now helps to define for AI.
Can you obtain ISO/IEC 27090 certification?
No. It is a guidance document. The certifications available remain ISO/IEC 27001 (information security) and ISO/IEC 42001 (AI management), which 27090 helps implement for AI-specific risks.
Does ISO/IEC 27090 give a presumption of conformity with the AI Act?
No. Only harmonised standards published in the Official Journal of the European Union have that effect (Art. 40). It remains a useful reference for demonstrating compliance with Article 15.
What is the difference between ISO/IEC 27090 and ISO/IEC 42001?
ISO/IEC 42001 organises AI governance within a certifiable management system. ISO/IEC 27090 is technical guidance focused on security threats specific to AI systems.
Which clauses should a contract with an AI provider include?
At a minimum: provenance of training data, a prohibition on training models on your data, notification of AI-specific incidents, governance of updates, audit and reversibility, and a clear allocation of responsibilities.
Conclusion
AI security has become a matter of evidence. On the day of an incident, no one will ask whether you were certified, but whether your measures reflected the state of the art. ISO/IEC 27090 has just written part of it.
About the author. Maître Mohamed Zied El Air is a lawyer admitted to the Paris and Tunis Bars and a certified DPO (PECB). He advises businesses in France and Tunisia on data protection, cybersecurity, digital law and AI contracts. View profile.
This article provides general legal information, current at its date of publication. It does not constitute legal advice.