In June 2026, the PCI Security Standards Council opened a formal request for comments (RFC) on PCI DSS v4.0.1. For organizations that have just absorbed the v4 changes, the natural question is whether another major update is coming. This article explains what the Council actually announced, what it did not, and how to read the signal.
What was announced
The Council announced the RFC on 2026-06-03. The comment period ran from 2026-06-03 to 2026-07-20, about six weeks. According to the announcement, the purpose was to gather stakeholder feedback on the current standard, PCI DSS v4.0.1, to help guide its future evolution.
The Council said it wanted to hear about the strengths of the current standard and the challenges of implementing it. It also highlighted interest in “evolution opportunities that can support future technology and AI innovation”.
Who could take part
RFCs are not open public consultations. Participation was limited to eligible PCI SSC stakeholders, and participants had to agree to a non-disclosure agreement to access the materials. Comments could only be submitted through the PCI SSC Portal during the defined period, as set out in the RFC instructions. The Council describes how RFCs fit into the development of its standards on its RFC process page.
What was not announced
It is just as important to be clear about what this RFC is not:
- It is not a new version of PCI DSS. The Council did not publish a new standard, and it did not announce a version number or a release date.
- It does not change current obligations. PCI DSS v4.0.1 remains the version against which assessments are performed, including all requirements that became mandatory on 2025-03-31.
- It does not set a transition timeline. No retirement date for v4.0.1 has been announced.
You may see commentary online speculating about the content or timing of a next version. Until the Council publishes something, treat that as speculation.
How to read the signal
An RFC on the current standard tells us a few things with reasonable confidence:
- The standard is in a listening phase. The Council is collecting evidence on how v4.0.1 works in practice, now that organizations have had time to implement the future-dated requirements.
- Implementation challenges are on the table. Asking about them suggests the Council is open to clarifying requirements that have proved difficult to apply.
- Technology change is on the agenda. The explicit mention of AI and future technology suggests the Council is considering how the standard applies to new architectures and tools.
History also helps. After PCI DSS v4.0 was released, the Council published a limited revision, v4.0.1, to address feedback it had received. Standards evolve gradually, and organizations usually have time to plan.
What this means for your business
- Keep going with v4.0.1. Do not pause remediation or delay an assessment waiting for a new version.
- Invest in fundamentals. Accurate scope, segmentation, asset inventories, MFA and good risk analysis will remain relevant whatever form the next version takes.
- Document your pain points. If a requirement is hard to apply in your environment, keep notes on why. That information helps your assessor today and prepares you for future changes.
- Follow official sources. The PCI SSC blog and document library are the authoritative places for announcements.
- Plan budgets with flexibility. Keep some room in multi-year security plans for adjustments once the Council publishes its next steps.
Our view
An RFC is a normal part of how the PCI SSC maintains its standards. It is a good sign that practical experience from merchants, service providers and assessors will feed into what comes next. For now, nothing changes in what you need to do this year.
For a refresher on the current standard, read our PCI DSS overview. Ubitrak continues to perform PCI DSS v4.0.1 assessments, and the Accel PCI portal keeps self-assessing merchants aligned with the current SAQs. Contact us if you have questions about planning ahead.
Sources
Does this apply to you? A free 30-minute consult maps the requirement to your systems and tells you what to do next.
Book a free consult