Stronger control over AI agents in payment environments is now spelled out in new guidance from the PCI Security Standards Council. The Council’s document, Security Considerations for AI Systems, sets a practical baseline: a human must formally approve any AI action that touches cardholder data, and every AI system should run with the narrowest access it needs to do its job.
What the PCI SSC guidance covers
Published by the PCI Security Standards Council, Security Considerations for AI Systems was developed with industry stakeholders. It covers governance, deployment, access controls, testing, and how existing PCI standards apply to AI. The document is advisory, and existing PCI requirements take precedence where they overlap. Its purpose is to give payment organizations a starting point for using AI responsibly in environments that handle card data.
How should access and accountability be defined?
The Council recommends defining an AI system’s purpose, permissions, and data access before selecting or deploying it. Its least agency approach limits each system to the access and capabilities needed for its assigned tasks. A suitable human individual should formally accept responsibility for AI output, and organizations should specify which actions require human approval.
Access restrictions should be enforced through independent controls, such as identity-management policies and network isolation. Organizations should avoid combining sensitive data access, external communications, and unrestricted input from untrusted sources in a single AI system. Where a workflow needs all three, the guidance recommends separating responsibilities among agents with different permissions.
An AI inventory and bill of materials should identify models, versions, hosting, integrations, data-use and retention policies, and intended users. An acceptable-use policy and technical controls should help identify and restrict shadow AI, the tools employees deploy or use without approval.
How should controls be tested and failures prepared for?
Safeguards should be tested before extensive functional or user-acceptance testing, including adversarial testing to determine whether restrictions can be bypassed. Monitoring and revalidation should continue throughout deployment to detect changes in behavior. Review processes should also account for excessive trust in AI output, which can cause reviewers to overlook mistakes.
The guidance describes human approval for each task and an alternative in which AI systems perform authorized actions under monitoring without approval for every individual action. For monitored autonomy, organizations should define permitted actions, approval requirements, shutdown triggers, and procedures for reversing changes. A suitable human individual should remain ultimately responsible. For agents with access to cleartext cardholder data, explicit human approval for any actions involving that data is recommended.
How should sensitive data and credentials be protected?
AI systems should not handle, generate, or manage unprotected high-impact secrets, including passwords and cryptographic keys. Credentials should be managed through secrets-management tools and kept out of source code, prompts, AI context, outputs, and logs. When random values are required, the Council recommends using a trusted random-number generator. Values used for passwords or cryptographic keys may need to remain outside the AI system.
Organizations should use encrypted or tokenized payment data where possible. Data-loss prevention controls should operate independently of the AI, and logs should support investigations without retaining sensitive payment information. PCI scoping should consider an AI system’s deployment, isolation, access to account data (including data used for training), and ability to affect the security of cardholder-data systems. Access to encrypted or tokenized data together with tools that decrypt or detokenize it should be treated as access to readable data.
How does the guidance address AI-assisted attacks?
The Council warns that AI can accelerate vulnerability discovery, exploit development, and social engineering. It recommends ongoing vulnerability monitoring and a process for prioritizing findings and patches. Defenses include limiting services and permissions, isolating legacy systems, using phishing-resistant authentication, encrypting sensitive data, and containing the impact of breaches.
AI-generated code and patches should undergo security and functional testing. Reviews should check for embedded credentials, unsuitable dependencies, newly introduced weaknesses, and whether fixes address the underlying problem. One deployment example divides vulnerability management among agents that identify issues, prepare patching plans, test changes, and deploy approved updates. Permissions are assigned by role, and rollback procedures are tested before deployment.
What should organizations ask of external AI providers?
External AI providers with access to sensitive data should be assessed under applicable third-party service provider requirements. Agreements should address responsibility for sensitive information, explicitly prohibit using the organization’s data for AI training, provide visibility into subcontractors, and set breach notification terms. Incident response plans and periodic testing should cover prompt injection, model poisoning, actions outside approved scope, and unauthorized AI tools accessing sensitive data.
FAQ
Who published the AI security guidance for payment environments?
The PCI Security Standards Council (PCI SSC) published Security Considerations for AI Systems, developed with industry stakeholders.
Does the guidance require human approval for AI actions on cardholder data?
Yes. For agents with access to cleartext cardholder data, explicit human approval for any actions involving that data is recommended. A suitable human individual should also formally accept responsibility for AI output.
Are the PCI SSC’s AI recommendations binding on existing PCI requirements?
No. The recommendations are advisory, and existing PCI requirements take precedence.