“Aligned with ISO/IEC 27090” Statement Generator
Get trust-page and RFP wording that says what you do about AI security without overclaiming. Enter your scope, the AI threat themes you address, the certifications you hold and your last assessment date. The statement says your practices are aligned with or informed by ISO/IEC 27090 guidance, never “certified” or “compliant”, and a live check flags risky wording as you edit.
Free, in your browser, nothing uploaded.
Your details
Completes the sentence “our security practices for …”. Narrow is more credible than “everything”.
No risky wording found
Checked for certification or compliance claims about 27090, absolute security promises, and certificates you have not ticked as held.
- No assessment date: a dated review is more credible to a buyer than "regularly".
Wording guidance, not legal advice. Have your legal or compliance team approve any public claim. Saved in this browser only.
TL;DRWhat this generator does
4 points
- Generates a public statement for a trust page or an RFP answer that says your AI security practices are "aligned with" or "informed by" ISO/IEC 27090 guidance.
- You enter your scope, the AI threat themes you address, the certifications or reports you hold (ISO/IEC 27001, ISO/IEC 42001, SOC 2) and your last assessment date.
- Edit the text freely. A live check flags risky wording such as "27090 certified", "compliant with 27090", "fully compliant" or "guarantees", and any certificate you have not said you hold.
- Three formats: trust page, RFP answer and one-liner. Copy, or download as Markdown or plain text. Free, nothing uploaded.
Why ISO/IEC 27090 cannot be certified
Certification needs a standard written as requirements (“the organisation shall…”) and an accredited body that audits against them. ISO/IEC 27001 and ISO/IEC 42001 are written that way. ISO/IEC 27090 is not: it is guidance on the security threats specific to AI systems and how to address them. There is nothing for an auditor to issue a certificate against, so “27090 certified” and “27090 compliant” describe something that does not exist.
What you can show is that you used the guidance: named the AI threats, mapped controls to them, tested those controls, and reviewed the result inside a certified 27001 or 42001 management system. That is what an “aligned with” statement claims, and the traceability matrix is the evidence behind it. For the full answer, see ISO/IEC 27090 certification: what is and isn’t possible.
Frequently asked questions
Can a company be ISO/IEC 27090 certified?
No. ISO/IEC 27090 gives guidance on addressing security threats to AI systems. It is not a management-system requirements standard, so certification bodies have nothing to certify against. A claim of "27090 certification" is false. The certifiable standards nearby are ISO/IEC 27001 for information security management and ISO/IEC 42001 for AI management systems.
What wording is safe for a trust page?
Say your practices are "aligned with" or "informed by" the guidance in ISO/IEC 27090, name the AI threats you address, and state the scope and when you last reviewed it. Keep certification language for certificates you actually hold, such as ISO/IEC 27001 or 42001, and describe SOC 2 as a report, not a certification.
Why is "compliant with ISO/IEC 27090" risky?
"Compliant" implies a conformity check against requirements. Guidance has recommendations rather than requirements, and no one assesses conformity to it, so a buyer or regulator can read the claim as misleading. "Aligned with" says what you did without implying a formal assessment.
What does the wording check look for?
Certification, compliance, conformance, accreditation or ISO-endorsement words in a sentence that mentions 27090; absolute promises such as "guarantees", "fully compliant", "100% secure" or "eliminates"; certification claims for ISO/IEC 27001 or 42001 that you have not ticked as held; and SOC 2 described as a certification. It also warns when your last assessment is over 12 months old or in the future.
Is this legal advice?
No. It is wording guidance to keep a public claim accurate. Have your legal or compliance team approve the final text, especially for regulated markets or contractual RFP answers.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.