NovaQTech Insights
ISO/IEC 27090:2026 Published — Guidance on Security Threats Specific to AI Systems
ISO and IEC have published ISO/IEC 27090:2026, “Cybersecurity — Artificial intelligence (AI) — Addressing security threats and compromises to AI systems”, a 56-page first edition published on 14 October 2026. The standard provides guidance — not certifiable requirements — on understanding, detecting and mitigating security threats specific to AI systems throughout their life cycle. It addresses threats such as data poisoning and model theft, and explains how vulnerabilities can be exploited, what the consequences can be and which measures can help address them, while recognising that established cybersecurity practices remain essential. ISO states that the standard complements the established practices in ISO/IEC 27001 and ISO/IEC 27002, helping organisations identify what needs protecting, from training data to AI models. For organisations running an AI management system under ISO/IEC 42001, the guidance offers a concrete threat reference to feed into AI risk assessment and treatment.
Source: ISO — https://www.iso.org/standard/27090