--- title: PCI SSC publishes guidance on securing AI in payment environments description: Nuevas orientaciones del PCI SSC para integrar la IA en pagos de manera segura, destacando la gestión de vulnerabilidades y el cumplimiento de estándares PCI. image: https://blog.isecauditors.com/hubfs/ISEC%20Media/Blog%20Media/banner%20-%20Two%20Frameworks%2c%20One%20Objective-PCI%20DSS%E2%80%93NIST%20CSF%20Mapping.png --- English - [Spanish](https://blog.isecauditors.com/pci-ssc-publica-orientaciones-para-proteger-la-ia-en-los-entornos-de-pago) - [English](https://blog.isecauditors.com/en/pci-ssc-publica-orientaciones-para-proteger-la-ia-en-los-entornos-de-pago) [![290x123px\_isecauditors](https://blog.isecauditors.com/hs-fs/hubfs/ISEC%20Media/Blog%20Media/290x123px_isecauditors.png?width=290&height=91&name=290x123px_isecauditors.png) ![290x123px\_isecauditors](https://blog.isecauditors.com/hs-fs/hubfs/ISEC%20Media/Blog%20Media/290x123px_isecauditors.png?width=290&height=91&name=290x123px_isecauditors.png)](https://blog.isecauditors.com/?hsLang=en) - [← www.isecauditors.com](https://www.isecauditors.com/) - [academy.isecauditors.com](https://academy.isecauditors.com/) - [← www.isecauditors.com](https://www.isecauditors.com/) - [academy.isecauditors.com](https://academy.isecauditors.com/) [PCI SSF](https://blog.isecauditors.com/en/tag/pci-ssf) Inteligencia Artificial [PCI Compliance](https://blog.isecauditors.com/en/tag/pci-compliance) # PCI SSC publishes guidance on securing AI in payment environments [Alberto Villar Arévalo](https://blog.isecauditors.com/en/author/alberto-villar) Nov 3, 2026, 1:43:06 PM **Madrid, 3 November 2026.** The PCI Security Standards Council has publicised additional guidance on **securely integrating artificial intelligence into payment environments.** Its 7 October announcement addresses a technology that helps protect operations while also enabling fraud and vulnerability discovery. Increasing autonomy calls for clear access controls, responsibilities and oversight. \[1\] The **Security Considerations for AI Systems** information supplement, announced on 15 September, covers AI deployment, defence against malicious AI use, the relationship with PCI standards and use-case examples. It emphasises frequent vulnerability management and assessing scope as with any other technology. **It is guidance, not new mandatory requirements; applicable PCI standards take precedence.** \[2\] PCI SSC principles recommend limiting data and privileges, assigning dedicated revocable credentials and retaining human accountability. Systems should support action logging, validation throughout deployment and shutdown when necessary. The principles also recommend protecting inputs and outputs against manipulation and avoiding exposure of cryptographic keys or other high-impact secrets. **Introducing AI does not waive any applicable PCI requirements.** \[3\] At Internet Security Auditors, we recommend **reviewing each use case before it enters production:** which data it receives, where processing takes place, which systems it can modify and which providers are involved. An assistant that retrieves documentation and an agent acting on payment infrastructure create different exposures. The assessment should lead to verifiable controls, defined responsibilities and reviews of changes that could affect PCI scope. Internet Security Auditors supports this work through **PCI DSS scoping and compliance assessments, remediation plans, QSA audits and ongoing PCI DSS compliance support.** For payment software, our **PCI SSF services** assess security within the applicable framework. We complement this work with code reviews, penetration testing and training, helping organisations introduce AI with sustainable controls and verify their operational effectiveness. \[4–5\] ![securing-ai-in-payment-environments](https://blog.isecauditors.com/hs-fs/hubfs/ISEC%20Media/Blog%20Media/securing-ai-in-payment-environments.png?width=900&height=308&name=securing-ai-in-payment-environments.png) References \[1\] PCI SSC — Press release dated 7 October 2026 [https://www.pcisecuritystandards.org/about\_us/press\_releases/pci-ssc-publishes-additional-guidance-on-securing-ai-in-payment-environments/](https://www.pcisecuritystandards.org/about_us/press_releases/pci-ssc-publishes-additional-guidance-on-securing-ai-in-payment-environments/) \[2\] PCI SSC — Security Considerations for AI Systems supplement announcement [https://blog.pcisecuritystandards.org/just-published-security-considerations-for-ai-systems](https://blog.pcisecuritystandards.org/just-published-security-considerations-for-ai-systems) \[3\] PCI SSC — Principles for securing AI in payment environments [https://blog.pcisecuritystandards.org/ai-principles-securing-the-use-of-ai-in-payment-environments](https://blog.pcisecuritystandards.org/ai-principles-securing-the-use-of-ai-in-payment-environments) \[4\] Internet Security Auditors — PCI DSS services [https://www.isecauditors.com/en/pages/pci-dss-implementation-and-certification](https://www.isecauditors.com/en/pages/pci-dss-implementation-and-certification) \[5\] Internet Security Auditors — Payment security and PCI SSF [https://www.isecauditors.com/en/pages/payment-methods-security](https://www.isecauditors.com/en/pages/payment-methods-security) - [Tweet](https://twitter.com/share) --- ![author-image](https://blog.isecauditors.com/hubfs/Logo_isecauditors_contraccion_HP.png) [Alberto Villar Arévalo](https://blog.isecauditors.com/en/author/alberto-villar) PCI SSA, PCI QSA, CISSP, CSSLP, ISO 27001 L.A., CSFPC, SFPC Security Consultant Consulting Department --- [Legal Notice](https://www.isecauditors.com/aviso-legal) [Policy Privacy](https://www.isecauditors.com/politica-privacidad) [Cookie Policy](https://www.isecauditors.com/politica-cookies) --- Copyright © 2026 - All rights reserved ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Alberto Villar Arévalo", "url" : "https://blog.isecauditors.com/en/author/alberto-villar" }, "dateModified" : "2026-11-03T12:43:06.915Z", "datePublished" : "2026-11-03T12:43:06.000Z", "headline" : "PCI SSC publishes guidance on securing AI in payment environments", "image" : [ "https://blog.isecauditors.com/hubfs/ISEC%20Media/Blog%20Media/banner%20-%20Two%20Frameworks%2c%20One%20Objective-PCI%20DSS%E2%80%93NIST%20CSF%20Mapping.png" ], "mainEntityOfPage" : { "@id" : "https://blog.isecauditors.com/en/pci-ssc-publica-orientaciones-para-proteger-la-ia-en-los-entornos-de-pago", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.isecauditors.com/hubfs/isec_logo.png" }, "name" : "Internet Security Auditors, S.L." } } ```