PCI SSC guidance: require human approval for AI agent actions on cardholder data

The PCI Security Standards Council announced on October 7 new guidance on securing AI in payment environments, developed with industry stakeholders including its Global Executive Assessor Roundtable and Board of Advisors. It covers how AI is deployed, how to reduce its misuse, how it fits with existing PCI standards and real-world use cases, and responds both to businesses adopting AI and to fraudsters using it to sharpen phishing and find weaknesses at scale. The recommendations are advisory, and existing PCI requirements take precedence.

The guidance recommends defining an AI system's purpose, permissions and data access before deploying it and following a "least agency" principle, with a named person accountable for its output and access limits enforced by independent controls such as identity policies and network isolation. Organizations should avoid giving one AI system sensitive data access, external communications and untrusted input at the same time, keep an AI inventory and bill of materials, and restrict shadow AI. For agents with access to cleartext cardholder data, it recommends explicit human approval for any action involving that data.

AI systems should not handle unprotected passwords or cryptographic keys, which belong in secrets-management tools and out of prompts, context and logs. Access to encrypted or tokenized data together with tools that can decrypt it counts as access to readable data for PCI scoping. Against AI-assisted attacks, the Council recommends continuous vulnerability monitoring, phishing-resistant authentication and isolating legacy systems, and says AI-generated code and patches need security and functional testing.