PCI Security Standards Council issues new guidance on securing AI in payment environments

On October 7, 2026, the PCI Security Standards Council published additional guidance on securing artificial intelligence in payment environments. The document was developed with the council's Global Executive Assessor Roundtable and Board of Advisors and covers how AI should be deployed to reduce the risk of misuse, how AI fits within existing PCI standards, and real-world use cases. The council says the guidance is not mandatory, and where it conflicts with an official PCI standard, the standard wins. It builds on AI principles the council published in September 2025.

This matters because AI tools are showing up in customer service, fraud review, back-office automation and software development, and some of them touch cardholder data. The council's earlier principles are clear that AI systems handling cardholder data still have to meet PCI DSS requirements, including protecting data at rest and in transit. They also say AI should get least-privilege access with its own trackable, revocable credentials, its actions should be logged back to a responsible person, and higher-risk actions should keep a human in the loop.

Ask your vendors a few direct questions. Does your POS, payment gateway, help desk or chatbot use AI that can see full card numbers? If so, is that component included in your PCI scope and your provider's attestation? Can the vendor use tokens or truncated card numbers instead? Who can review logs of what the AI accessed or did?

For most small and mid-sized merchants, the safest approach is to keep AI tools out of the cardholder data environment entirely and confirm that in writing with each provider. The council's Europe Community Meeting, October 20 to 22, includes sessions on AI agents in the cardholder data environment.