The PCI Security Standards Council published Security Considerations for AI Systems on 15 September 2026. It says AI should be scoped like any other technology. Help Net Security reported that the supplement treats an agent holding tokens plus a detokenise tool as having readable card data. The supplement is guidance, not a new requirement.
Key takeaways
- PCI SSC says AI is scoped like any other technology.
- Tokens plus a detokenise tool count as access to readable data.
- Human approval is recommended for agent actions on cleartext card data.
- The supplement is advisory and PCI DSS takes precedence.
What did PCI SSC publish?
According to the PCI SSC blog post, the information supplement covers four areas:
- AI deployment and use
- Defending against malicious use of AI
- PCI standards and AI use
- AI use-case examples
It was developed with the Global Executive Assessor Roundtable and the Board of Advisors.
PCI SSC states the supplement "is not to be considered as mandatory requirements". Where it differs from a PCI standard, the standard takes precedence.
Help Net Security summarised the detail on 9 October 2026. Its report says the guidance recommends a "least agency" approach and formal human responsibility for AI output. It also advises against putting sensitive data access, external communication and untrusted input in one AI system.
When is an AI agent in PCI DSS scope?
Help Net Security reported that scoping should consider an AI system’s deployment and isolation. It also covers access to account data, including training data, and the system’s ability to affect the security of cardholder data systems.
The same report says access to encrypted or tokenised data, together with tools that decrypt or detokenise it, should be treated as access to readable data. An agent that only ever sees tokens is not out of scope if one of its tools can turn a token back into a card number.
What does this mean in plain language?
A tool is part of the agent. If a support chatbot can call a refund API that looks up the full card, the chatbot is reading card data by proxy. Scope follows what the agent can reach, not what its prompt says it should do.
Help Net Security also reported that external AI providers with access to sensitive data should be assessed under third-party service provider requirements.
Why does it matter for merchants and payment SaaS?
Teams adding agents to checkout, support or fraud workflows now have a reference their assessor can cite. The supplement does not add a requirement, but it shows how PCI SSC expects existing scoping rules to be applied to agents.
Sorami’s view
This section is opinion. It is our reading of the PCI SSC guidance and its coverage, not a statement from PCI SSC.
Map tools before you map prompts. The scoping question is which tools an agent can call and what each one returns. Agent permissions drift as teams add tools, so the map needs an owner.
Test the restriction, not the instruction. Per Help Net Security’s summary, the guidance asks for adversarial testing of safeguards before functional testing. That is the part a prompt-injection test should prove or disprove.
What to do now
- List every tool each agent can call and the data it returns.
- Flag any tool that decrypts or detokenises card data.
- Require human approval for agent actions on cleartext card data.
- Keep secrets out of prompts, context, outputs and logs.
- Run adversarial tests to see if agent restrictions can be bypassed.
- Assess external AI providers as third-party service providers.
If an agent touches payment systems and you want its permissions tested, see our AI application penetration testing, or contact us to discuss scope.
Related guides
- Self-replicating prompt injection in AI agents
- AI agent DNS exfiltration from a sandbox
- MCP Python SDK token audience advisory
- Every Sorami article is in the guides index.
Sources
- PCI Security Standards Council, Just Published: Security Considerations for AI Systems (15 September 2026)
- Help Net Security, PCI SSC calls for human approval of AI agent actions involving cardholder data (9 October 2026)
- PCI SSC Document Library (information supplement and Integrating Artificial Intelligence in PCI Assessments)
Facts on this page were checked against these sources on 16 October 2026. We update the page when the source changes.