ISO/IEC 27090 is an international standard that gives guidance on addressing security threats to AI systems, such as data poisoning and model theft. It is guidance, not a certifiable requirements standard. As of the sources we could fetch, it had reached final draft stage, so check ISO for the current edition.
What does ISO/IEC 27090 cover?
The standard comes from ISO/IEC JTC 1/SC 27, the committee behind the ISO/IEC 27000 family of information security standards. Its working title is about cybersecurity and artificial intelligence, with guidance for addressing security threats and compromises to AI systems. ISO's own page words the title slightly differently from earlier drafts, which is another reason to read the catalogue entry itself.
According to pre-publication descriptions, it helps organisations understand threats to AI systems, see how those threats can be exploited, judge the consequences across the AI lifecycle, and pick measures that detect or reduce them. It is meant for organisations of any size that build or use AI.
Descriptions of the draft say it focuses on deliberate attacks. Threats named include poisoning, evasion, membership inference, model inversion, model stealing, and prompt and output injection. Natural, accidental and insider threats are reported as largely out of scope. Because those descriptions come from a draft, the final text may differ.
Is it published yet?
We could not confirm that. Here is what we could confirm from public pages:
- A summary of ISO's catalogue entry lists the standard as under publication, which means final production steps remain.
- An independent tracker of the 27000 family, last updated in August 2026, described it as at Final Draft International Standard stage and "likely to be published later in 2026".
- The ISO catalogue and national body pages returned access errors when we fetched them directly, so we could not read the entry first hand.
So we cannot tell you a publication date or edition year. If you need to cite the standard, check ISO for the current edition and its exact title.
How does it differ from other AI security material?
It helps to place it next to documents you may already use.
The NIST AI Risk Management Framework 1.0, released in January 2023, is voluntary and broad. It covers risks AI poses to people, organisations and society, including but not limited to security.
The OWASP Top 10 for LLM Applications (2025 edition) is a practical list for people building with language models. It includes prompt injection, data and model poisoning, supply chain, excessive agency and unbounded consumption.
ISO/IEC 27090 sits closer to the management system world. Its descriptions point to links with ISO/IEC 42001 and ISO/IEC 27001 style programmes. If your security team already works in that vocabulary, this is the AI threat companion they will likely be asked about.
What does it mean for your AI security work?
Even before you read the final text, the direction is clear. AI systems are treated as assets with their own attack paths, and ordinary controls such as access management, logging and supplier review are expected to carry over and be adapted.
Three practical consequences follow.
First, you need an inventory. You cannot assess threats to models, datasets and prompts you have not listed.
Second, the supply chain matters. Models, datasets, plugins and tool servers come from outside your walls, and the OWASP list treats that as a top risk.
Third, auditors and customers may start asking which guidance you used. A clear answer beats a vague one.
What to do
- List every AI system you build or buy: models, training and retrieval data, prompts, agents, and the tools they can call.
- Record who owns each one and what data it can reach.
- Walk through the named threat types for each system and write down which ones apply and which controls exist.
- Apply your existing controls first: least privilege, logging, change review and vendor checks.
- Test for prompt injection and output handling problems before release, and again after model or prompt changes.
- Buy the standard from ISO or your national body when you need the clause level detail, and check which edition you hold.
How Safeguard fits in
Safeguard's compliance suite includes ISO/IEC 27090 as a framework. It helps teams prepare and keep evidence ready, with continuous monitoring and automated tests. Autonomous remediation is off by default, and customers choose which categories, if any, run automatically. Using it does not make anyone compliant or certified, and ISO does not endorse it. Teams can also work from any general AI security checklist alongside it.
Quick check
Can my organisation be certified against ISO/IEC 27090?
Based on its description as guidance, it is not a requirements standard you certify against. Check ISO for the current edition and any related scheme.
Does it replace the NIST AI RMF or the OWASP LLM Top 10?
No. They serve different purposes. NIST is a broad risk framework, OWASP is a practical list for builders, and ISO/IEC 27090 is threat guidance in the ISO family.
Sources
- ISO/IEC 27090 catalogue entry on iso.org (summary seen through search; direct fetch returned an access error)
- ISO27001security: ISO/IEC 27090 status and scope notes
- NIST AI Risk Management Framework
- OWASP Top 10 for LLM Applications
Last reviewed: 19 October 2026.
