Iso 27090

ISO/IEC 27090:2026 — "Cybersecurity — Artificial intelligence — Addressing security threats and compromises to AI systems" — has been published. It is guidance, not a certifiable standard: it maps AI-specific threats (data poisoning, evasion, membership inference, model inversion, model theft, prompt and output injection) to confidentiality, integrity and availability, and sits alongside ISO/IEC 42001 (certifiable AI management), ISO/IEC 27001 (certifiable ISMS), ISO/IEC 42005 (AI impact assessment) and the NIST AI RMF. A practical CISO read, with the certification reality made clear.