Institute briefing
AI Cybersecurity: New ISO/IEC 27090 Standard Launched
A new international standard, ISO/IEC 27090, has been introduced to specifically address and mitigate cybersecurity risks unique to artificial intelligence systems, providing a framework for enhanced AI resilience and trustworthiness.
What happened
A new international standard, ISO/IEC 27090, has been introduced to address cybersecurity challenges within artificial intelligence systems. This development aims to provide a unified framework for managing security risks specifically related to AI, moving beyond general cybersecurity measures to tackle the unique vulnerabilities inherent in AI technologies. The standard seeks to enhance the resilience and trustworthiness of AI deployments across various sectors.
Why it matters
The introduction of ISO/IEC 27090 is a significant step for AI governance and business strategy. It establishes a baseline for organisations to assess and mitigate security threats that are particular to AI, such as data poisoning, model evasion, and adversarial attacks. For business leaders, this standard offers a pathway to build more robust and defensible AI systems, fostering greater confidence in their adoption and reducing potential liabilities. From an ethical standpoint, securing AI systems is crucial to prevent misuse and ensure fair, reliable, and transparent operation, aligning with principles of responsible AI development and deployment.
The Institute take
While the establishment of an international standard for AI cybersecurity is a welcome and necessary development, its true impact will hinge on proactive implementation rather than mere compliance. Many organisations will view ISO/IEC 27090 primarily as a checklist, but responsible AI leaders must recognise it as a foundational element of their overall AI governance strategy.
The real challenge lies not just in meeting the technical requirements, but in embedding AI cybersecurity into an organisation's risk culture and continuous improvement processes. A tick-box approach will fall short against evolving threats. Truly responsible AI leadership demands integrating this standard into a holistic framework that considers data ethics, algorithmic transparency, and human oversight, ensuring security is a proactive design principle, not an afterthought.
Briefing notes
Questions this story answers
01What is ISO/IEC 27090?+
ISO/IEC 27090 is a new international standard designed to address cybersecurity challenges specific to artificial intelligence systems, providing a unified framework for managing AI-related security risks.
02Why is ISO/IEC 27090 important for businesses?+
This standard is crucial for businesses as it helps them assess and mitigate unique AI security threats like data poisoning and adversarial attacks, fostering more robust AI systems and reducing potential liabilities.
03How should organisations implement ISO/IEC 27090?+
Organisations should integrate ISO/IEC 27090 proactively as a foundational element of their AI governance strategy, embedding AI cybersecurity into their risk culture and continuous improvement processes, rather than treating it as a mere compliance checklist.