Securing AI use: the Cyber Centre’s 10 AI security measures

Most organizations now use AI somewhere: a chatbot on the website, a copilot in the office suite, an agent wired to the CRM. The Canadian Centre for Cyber Security has published a short primer on how to secure that use, The 10 AI security measures: introduction (ITSAP.10.049, May 2026) (Cyber Centre). It is written for organizations of every size and sector, and it complements the Centre’s existing top 10 IT security actions (ITSM.10.089) rather than replacing them.

Three risks, three pillars

The Centre groups its measures by where the risk comes from: attackers using AI against you, attacks on your own AI systems, and the way your staff and processes use AI. The consequences it lists are familiar ones: data theft, reputational harm, and operational and financial loss.

Pillar 1: protect against adversarial use of AI

1. Mitigate prompt injection and jailbreaking. Sanitize inputs, restrict high-risk agents and tools, and validate what an AI system is about to do before it executes.
2. Counter deepfakes and impersonation. Verify identities and media, use phishing-resistant multi-factor authentication, and confirm unusual requests through a separate channel.
3. Strengthen defences against AI-generated fraud and attacks. Patch faster, add bot detection and rate limiting, and train staff on AI-enabled threats.

Pillar 2: protect your AI systems

4. Test and red-team AI systems. Evaluate models, pipelines and interfaces regularly, and plan incident response and continuity for them.
5. Protect against data poisoning. Track data provenance, version datasets, screen ingested data and control access along the data chain.
6. Control data use and prevent model theft. Default to not training on your data, log access to models and data, and watch APIs for extraction patterns.
7. Secure the AI supply chain. Keep an AI bill of materials, sign models and artifacts, follow secure development practices and review dependencies.

Pillar 3: protect users and operations

8. Apply vendor, contract and privacy controls. Minimize personal information in prompts, encrypt data, publish a list of approved and unapproved tools, deal with “shadow AI” and put the right clauses in procurement.
9. Keep humans in control. Keep human checks in automated workflows, keep decisions explainable and auditable, and provide stop and escalation procedures.
10. Stay resilient against drift, hallucinations, bias and over-reliance. Monitor performance, retrain or retire models, require human review of critical outputs and keep fallback procedures.

What it means for compliance programs

None of these measures is a new kind of control. They extend controls most programs already have to a new class of system:

• Québec Law 25: measure 8 is a privacy measure first. Personal information pasted into an external AI tool is a disclosure to a service provider, and may be a transfer outside Québec. Decisions based exclusively on automated processing also carry a duty to inform the person concerned (section 12.1 of the private sector act).
• PCI DSS: cardholder data has no place in prompts or training sets. If an AI tool can see account data, it is in your cardholder data environment’s scope, along with its vendor.
• SOC 2 and ISO 27001: AI vendors belong in your vendor risk process, and AI systems in your asset inventory, change management and logging.
• ISO/IEC 42001: the Centre points to the NIST AI Risk Management Framework and ISO/IEC 42001:2023 for organizations that want a full AI management system.

Where to start

1. Inventory the AI tools in use, including the ones nobody approved.
2. Publish an acceptable-use rule: which tools, which data, who decides.
3. Review AI vendor contracts for data use, training, retention and audit rights.
4. Add AI systems and agents to your next penetration test and risk assessment.

Need help mapping these measures to your PCI DSS, SOC 2 or Law 25 program? Talk to our team.