ISO/IEC 27090 Is Out: What It Adds If You Already Hold ISO 27001 or ISO 42001

ISO and IEC published ISO/IEC 27090:2026 on 14 October 2026. It is the ISO 27000 family’s standard on security threats to AI systems, from the same committee that looks after ISO 27001. If your business already holds ISO 27001 or ISO 42001, or is working towards either, it is worth knowing what it adds and what it does not.

Short answer

ISO/IEC 27090 is guidance, not a certification standard. ISO describes it as guidance on understanding, detecting and mitigating security threats specific to AI systems across their life cycle, including data poisoning and model theft. It is designed to sit alongside ISO 27001 and ISO 27002, helping you see where your existing controls already cover AI and where AI data, models and workflows need extra protection. You cannot be certified to it. What changes is what a well-informed auditor will expect your risk assessment to consider once AI systems are in scope.

What was published

What it covers

According to ISO’s description, the standard looks at how AI-specific vulnerabilities can be exploited, what the consequences can be and which measures help. The threats it names include:

• Data poisoning. Corrupting the data a model learns from, including operational data that is later reused to retrain the model.
• Model theft. Using queries that look legitimate to extract or reproduce a model.
• Threats to training data, models and intellectual property more generally.
• Risks across the life cycle, from development through operation to model updates.

The common thread is that an AI system has assets a conventional system does not: training data, the model itself, and the pipeline that retrains it. Those assets can be attacked in ways a standard application cannot.

What it is not

• Not certifiable. Certification stays with ISO 27001 for information security and ISO 42001 for AI management. ISO/IEC 27090 supports both; it replaces neither.
• Not a management system. It has no requirements for leadership, internal audit or management review. Those come from the standard you are certified to.
• Not mandatory. No Australian law or certification body requires it. Treat it as current good practice that informs your risk assessment.
• Not only for AI developers. Most businesses use AI tools rather than build models, but data poisoning and model risk still reach you through the vendors you rely on.

If you hold ISO 27001

ISO 27001 already gives you the framework. ISO/IEC 27090 gives you a better list of what can go wrong once AI is in scope. In practice it shows up in a few places:

• Risk assessment (clause 6.1.2). If AI systems are in your ISMS scope, the assessment should consider AI-specific threats, not just the usual confidentiality, integrity and availability risks to the servers they run on.
• Asset inventory (A.5.9). Training datasets, models and prompts or system instructions are information assets. If they are not on the register, nobody owns them.
• Suppliers and cloud services (A.5.19 to A.5.23). Ask AI vendors how they protect their models and training data, whether your data is used to train or retrain them, and how you will be told about a compromise.
• Secure development (A.8.25 to A.8.28). If you build or fine-tune models, the development life cycle needs to cover the data pipeline as well as the code.
• Change management (A.8.32). A model update or retraining run is a change. It can alter behaviour without a single line of code changing.
• Monitoring (A.8.16). Unusual query volumes or patterns against a model you expose can be the first sign of an extraction attempt.

Your Statement of Applicability does not need new controls for ISO/IEC 27090. It needs your existing controls applied to AI assets, with the justification to show you considered them.

If you hold ISO 42001

ISO 42001 asks you to assess AI risks and the impacts of your AI systems, and its Annex A includes controls on the AI system life cycle and on data for AI systems. ISO/IEC 27090 deepens the security side of that work: it is a practical reference when your AI risk assessment asks “how could this system be attacked?” For organisations running both standards as one integrated system, it is a natural bridge between the two. See how ISO 42001 and ISO 27001 fit together and our guide to ISO 42001 requirements.

Five questions an auditor may now ask

1. Which AI systems are inside your ISMS or AIMS scope, and are their data and models on the asset register?
2. Has your risk assessment considered data poisoning, model theft and model-update risk, or only infrastructure risk?
3. For AI tools you buy, what do you know about how the vendor protects its models and whether your data trains them?
4. When a model is retrained or updated, who approves it, and how would you notice if its behaviour changed?
5. Would you detect someone systematically querying a model you expose?

None of these require you to buy ISO/IEC 27090. They are the questions it makes reasonable to ask.

Should you buy it?

If you develop, fine-tune or host AI models, yes: it is written for you, and it will sharpen your risk assessment. If you mainly use AI tools from vendors, the principles above matter more than the document itself, and your supplier questions are where the work is. Either way, check whether Standards Australia adopts it as an AS ISO/IEC standard before buying, as adoption can change the price and edition you purchase.

ISO/IEC 27090: FAQs

Is ISO/IEC 27090 a certifiable standard?

No. It is guidance. Organisations are certified to ISO 27001 or ISO 42001, and ISO/IEC 27090 informs how they treat AI-specific threats within those systems.

Do I need ISO/IEC 27090 to keep my ISO 27001 certification?

No. Your certification is to ISO 27001. If AI systems are in your scope, though, an auditor may reasonably expect your risk assessment to reflect current knowledge of AI threats, and ISO/IEC 27090 is now the international reference for that.

How is ISO/IEC 27090 different from ISO 42001?

ISO 42001 is a certifiable management system standard for governing AI responsibly. ISO/IEC 27090 is narrower guidance focused on the security threats AI systems face.

What is data poisoning?

Corrupting the data an AI model learns from so that it behaves wrongly or in an attacker’s favour. It includes tampering with operational data that is later fed back in to retrain the model.

When was ISO/IEC 27090 published?

14 October 2026, as the first edition.

How Streamline can help

Streamline builds and audits ISO 27001 information security management systems and ISO 42001 AI management systems for Australian organisations. If AI is coming into scope, a gap analysis will show where your risk assessment and controls need to stretch. You deal directly with an experienced ISO Lead Auditor, and ISO mentoring helps your own people do the work. If you would like a hand, get in touch.

Sources

• ISO: ISO/IEC 27090:2026, Cybersecurity, Artificial intelligence (AI), Addressing security threats and compromises to AI systems

Published 21 October 2026 | Facts checked 21 October 2026 | Next review April 2027, or when Standards Australia adopts ISO/IEC 27090 | Jurisdiction: Australia | Edition: ISO/IEC 27090:2026, ISO/IEC 27001:2022 and ISO/IEC 42001:2023