ISO/IEC 27090:2026 has arrived. Title: guidance for addressing security threats and compromises to AI systems. The moment a standard like this is out, the question lands in the inbox: do we now have to do this too. The short answer for most SMEs: no, at least not as a project.
What the standard says
27090 describes attacks that target what is specific about AI: training data, models, and the way a system produces answers. These include data poisoning (corrupted training data), model theft (stealing the model), model inversion and membership inference (inferring the training data from the model), evasion (deliberately fooling the model), prompt injection, and malicious output. Across the whole lifecycle, from the data to operations.
One point is central: it is guidance, not a certifiable requirements standard. Unlike ISO 27001 or ISO 42001, there is no certificate, no audit, no obligation. 27090 complements those two, it does not replace them.
Why this changes little for most SMEs
The list sounds alarming, but it mostly hits the organisations that build AI. Data poisoning, model theft, model inversion: these are risks for organisations that train or operate their own models. An SME that buys AI, so Copilot, ChatGPT or a feature in an existing line-of-business application, inherits that part from the vendor. You do not train a model, so you cannot poison one either.
What remains for users is exactly what you decide yourself anyway: which data goes in, what the assistant is allowed to do without asking, whether you trust the answer. We already sorted those three piles in LLM security risks. 27090 gives that a shared vocabulary. It is not a new to-do list.
The unglamorous truth
A new ISO number reliably triggers the reflex to set up a project: a policy, a tool, maybe a certificate. With 27090 there is nothing to certify, and most of what it contains you cover with the basics that apply even without the standard. Do you know where you use AI. Do you know which data goes in. Is there a named person who stands behind the result. That is an AI inventory and one page of rules, not a new management system.
What 27090 is still good for
As a checklist and as a shared language. Two concrete uses:
- When rolling out an AI tool, deliberately walk through the AI-specific questions once, instead of overlooking them.
- Ask the vendor: how do you protect against corrupted data and against the model being read out, how do you handle prompt injection. Whoever buys a model outsources these controls and is entitled to ask whether they exist.
And if you do train or fine-tune your own models, or if you are a vendor whose customers ask you about this: then 27090 turns from reading material into a real design reference.
What we recommend
No 27090 project, no licence, no certificate as a first step, there is none anyway. If you run an ISO 27001 ISMS, hang the AI risks there, as described in integrate AI governance into your ISMS. If not, the unspectacular three steps are enough: inventory, access rights, accountability.
The standard is a good map. It does not do the walking for you.
If you want to sort out which of the 27090 threats actually affect you as a user and which sit with the vendor, we will look at your use of AI together.
Frequently asked questions
Do SMEs have to implement ISO 27090?
Not as a project. 27090 is guidance with no certificate and no obligation. An SME that buys AI rather than training its own models covers most of it with the basics: knowing where AI is used, which data goes in, and who stands behind the result.
Can you get certified against ISO 27090?
No. Unlike ISO 27001 or ISO 42001, 27090 is a guidance standard, not a requirements standard. There is no certificate, no audit and no obligation. It complements the two certifiable standards, it does not replace them.
Which AI attacks does ISO 27090 describe?
Attacks targeting what is specific about AI across the whole lifecycle: data poisoning, model theft, model inversion, membership inference, evasion, prompt injection and malicious output. Most of these affect organisations that train or operate their own models, not pure users.
