PCI SSC publishes AI security guidance for payment environments, recommending that agent operations involving cardholder data require explicit human approval

The PCI Security Standards Council (PCI SSC) has published the "AI Systems Security Considerations" guidance, covering the protection of data provided to AI systems in payment environments and defenses against AI-assisted attacks, with content addressing governance, deployment, access control, testing, and the applicability of PCI standards. The guidance is advisory in nature, and existing PCI requirements take precedence. The guidance recommends clarifying the purpose, permissions, and data access scope of AI systems before selection or deployment, adopting a least-privilege approach, having appropriate individuals formally accountable for AI outputs, and specifying which operations require human approval. Access restrictions should be implemented through independent controls such as identity management policies and network segmentation, avoiding having sensitive data access, external communications, and unrestricted input from untrusted sources in the same system, and splitting permissions across multiple agents when necessary. For agents with access to plaintext cardholder data, the guidance recommends that any operation involving such data require explicit human approval.