ISO 27090 IS HERE. NOBODY WILL CERTIFY YOU TO IT.

ISO 27090 is out. Its full name is ISO/IEC 27090:2026, Cybersecurity, Artificial intelligence, Addressing security threats and compromises to AI systems, and it is the first ISO standard written specifically about attacks on AI: poisoned training data, models stolen through their own API, prompts that turn a support bot into an exfiltration tool.

It is also guidance. Nobody will audit you against ISO 27090 and nobody will issue you a certificate for it. That is the first question every client has asked us since the publication date, so it goes at the top.

The more useful question is what changes for a company that already runs an ISO 27001 program, or is building toward ISO 42001. The short version: your AI risk assessment now has an authoritative threat list to be measured against, and “we considered the AI-specific threats” is no longer a claim you can make without showing which ones.

WHAT ISO 27090 ACTUALLY IS

ISO/IEC JTC 1/SC 27, the committee behind ISO 27001, started work on 27090 in 2022 inside Working Group 4. It was published in October 2026 as a first edition of 56 pages. Its stated purpose is guidance on understanding, detecting and mitigating security threats specific to AI systems across their life cycle.

The structure is easy to hold in your head. Three clauses carry the content and three annexes support them.

Clause 6 is the part you will use most. Each threat gets roughly a page covering what it looks like, what it does to the organization, and how to detect and mitigate it. Annex A is the part your engineers will like, because it says where in the life cycle each attack lands and which asset it is after.

Your first action is a small one. Buy the standard (it is paywalled), hand Clause 6 and Annex A to whoever owns your AI features, and ask them which entries apply to what you ship.

THE ISO 27090 THREAT CATALOG

The value of ISO 27090 is vocabulary. Before it, every vendor and every framework named these attacks slightly differently. Now there is one internationally agreed list, and your risk register can point at it. The main types of compromise it covers:

Read the list as two halves. The first seven attack the model and its data, and mostly matter if you train or fine-tune. The last two attack the system the model sits inside, and they apply to every company that wired an LLM into a product or a workflow, which in 2026 is nearly every company we talk to.

“

If you never trained a model, half the catalog is your vendor’s problem. The other half is yours the moment the model can read a document or call a tool.

The practical move is to sort the list into those two halves for your own environment. The first half becomes supplier questions for your model provider. The second half becomes engineering work on your side.

WHY IT LANDED THIS YEAR

Standards bodies are slow by design, and 27090 took four years. The breach data caught up with it in the meantime. IBM’s 2026 Cost of a Data Breach report, based on Ponemon research across 602 breached organizations, is the clearest single picture.

The number we would put in front of a board is the 92%. Nearly every organization that had an AI-related breach was missing basic access control on the AI system. That is a control ISO 27001 has asked for since long before anyone had a chatbot, applied to a new kind of system nobody put in scope.

The OWASP community reached the same conclusion from a different direction. Its 2026 Top 10 for LLM Applications, weighted in part by 7,714 recorded AI security incidents, keeps prompt injection at number one and moves excessive agency from sixth to third. Models are being given more permissions, and attackers noticed.

“

92% of organizations that suffered an AI-related breach lacked proper AI access controls.

If you only take one thing from the data, check who and what can reach each AI system you run, and whether that access would survive the access review you already perform for everything else.

ISO 27001, ISO 42001 AND ISO 27090: WHO DOES WHAT

Three standards now touch AI security, and they do different jobs. ISO 27001 is your information security management system, and it is certifiable. ISO 42001 is the management system for AI itself, covering governance, impact and responsible use, and it is also certifiable. We covered it in Issue #010.

ISO 27090 is neither. ISO positions it as a complement to ISO 27001 and ISO 27002 that addresses the threats specific to AI, building on established practice rather than replacing it. In practice it is the threat input that feeds the other two.

That gives you a concrete way to use it inside a program you already have. Take each threat from Clause 6, find the ISO 27001 Annex A control that already covers the general case, and extend its scope to the AI system. This is the mapping we start clients from:

None of those controls are new. What is new is putting the AI system inside their scope and keeping the evidence. If you are running ISO 27001 today, this is a scoping exercise and a risk register update, not a second program.

WHAT THE STANDARD LEAVES OUT

ISO 27090 is deliberately narrow. It is concerned mainly with active, deliberate attacks by capable adversaries. The analysis at ISO27001security.com points out that accidental failures and insider threats are largely outside its frame, and so is the defensive use of AI.

Practitioner reviews also note that jailbreaks have no heading of their own. All of these gaps are well covered elsewhere. Pair the standard with the OWASP Top 10 for LLM Applications for the application and agent layer, and with MITRE ATLAS for attacker techniques.

“

Assume the model will be fooled eventually, and decide now what it is allowed to do on that day. Filtering prompts helps. Limiting permissions is what saves you.

For agents specifically, we wrote about the identity side in Nobody Offboards the Robot. The short form: give each agent its own narrowly scoped credential, require a human approval for anything irreversible, and log every tool call.

PUTTING ISO 27090 TO WORK IN 90 DAYS

You cannot certify to ISO 27090, so the goal is a stronger ISO 27001 or ISO 42001 program that can show its AI risk work. Three months is enough to get there for a typical growth-stage company.

Expect your ISO 27001 auditor to start asking about this at the next surveillance audit. An AI feature in scope with no AI threats in the risk assessment is an easy observation to write, and we covered the questions assessors already ask in Your Auditor Is Going to Ask About Your AI.

If ISO 42001 is on your roadmap, the same work carries straight across. The inventory, the threat models and the supplier answers are inputs to the AI risk and impact assessments that standard requires. See our ISO 42001 overview for how that certification runs.

The Illumenati // Boutique GRC for the AI-First Era // illumen.io