On 2026-09-15, the PCI Security Standards Council published an information supplement, Security Considerations for AI Systems (PCI SSC). It arrives as organizations put chatbots in front of customers, use AI agents to handle disputes and refunds, and let staff paste data into AI tools. If any of that touches card data, PCI DSS already applies.
The key message: AI is not special for scoping
The Council is explicit that “when AI is used, it should be considered no different from any other form of technology when scoping the PCI requirements” (PCI SSC). An AI system that stores, processes or transmits cardholder data, or that can affect the security of the cardholder data environment, is in scope like any other system component.
The supplement is guidance, not a new requirement: it “is not to be considered as mandatory requirements”, and the PCI standards take precedence where they differ (PCI SSC). It covers deploying and assessing AI in payment environments, defending against malicious use of AI, and how PCI standards apply when AI is used. It was developed with the Council’s Global Executive Assessor Roundtable and Board of Advisors. Download it from the PCI SSC Document Library.
Where AI quietly pulls systems into scope
- Customer service chatbots and voice agents. Customers type or read card numbers into them. Transcripts, logs and training data may then contain PAN, and sensitive authentication data such as the security code must never be retained after authorization (requirement 3.3.1).
- AI agents with system access. An agent that can issue refunds, look up transactions or change configurations needs the same least-privilege access controls, authentication and logging as a human administrator (requirements 7, 8 and 10).
- Third-party AI services. A hosted model that receives card data is a third-party service provider. It must be on your list, under a written agreement, and monitored (requirement 12.8).
- Shadow AI. Verizon found that 45% of employees now use AI tools regularly at work, and 67% of users accessing AI services on corporate devices did so with non-corporate accounts (Help Net Security summary). Data pasted into those tools leaves your control.
AI on the attacker’s side
AI also changes the threat. Verizon reports that attackers use AI to accelerate exploitation of known vulnerabilities, “shrinking the window for defense from months to mere hours” (Verizon). Patch deadlines and authenticated scanning matter more, not less. See scanning and patching under PCI DSS 4.0.1 and phishing and ransomware controls.
What to do before your next assessment
- Inventory AI touchpoints. List every AI system, agent or service that could see card data or reach the cardholder data environment.
- Keep card data out. Redirect payment collection to a validated payment page or IVR solution instead of letting a chatbot take card numbers. Mask or filter PAN before it reaches models and logs.
- Treat agents as privileged users. Unique credentials, least privilege, MFA where applicable, and full logging.
- Update third-party records. Add AI vendors to your service provider list and agreements.
- Write an acceptable-use rule that tells staff which AI tools are approved and what data may never be entered.
- Tell your assessor early. AI in or near scope is better discussed at scoping than discovered during fieldwork.
The Council is also running an “AI Exchange” series on its PCI Perspectives blog with assessor and vendor perspectives. Ubitrak can help you scope AI use before your PCI DSS assessment. For broader AI governance, see ISO/IEC 42001. Contact us.
Sources
Does this apply to you? A free 30-minute consult maps the requirement to your systems and tells you what to do next.
Book a free consult