PCI SSC Recommends Human Approval for AI Actions Involving Cardholder Data
The PCI Security Standards Council released advisory guidance urging organizations to require explicit human approval for AI‑driven actions that access or manipulate clear‑text cardholder data. The guidance outlines governance, access controls, testing, and continuous monitoring to ensure responsible AI use in payment environments, reinforcing existing PCI DSS requirements.
ADTP Breach Watch· October 9, 2026· Help Net Security
The PCI Security Standards Council published 'Security Considerations for AI Systems', an advisory that recommends defining AI purpose, permissions, and data access, enforcing least‑agency principles, and requiring explicit human approval for any AI‑initiated actions involving clear‑text cardholder data. It also calls for an AI inventory, adversarial testing, ongoing monitoring, and clear accountability for AI outputs.
Why it matters for trust and compliance
This guidance highlights the need for a documented AI governance framework that provides continuous evidence of human oversight, access restrictions, and testing—key elements of a control‑assurance program.
Map AI governance requirements to your existing control framework to demonstrate due diligence during PCI assessments.
Collect and retain evidence of human approval processes and AI testing for audit readiness.
Who is affected
Financial services organizations handling payment card data
Recommended actions
Create an AI inventory and define purpose, permissions, and data access for each model.
Implement formal human‑approval workflows for AI actions that touch clear‑text cardholder data.
Integrate adversarial testing and continuous monitoring into your AI lifecycle.
Get the Breach Digest
The incidents that matter for your vendors and your data, analysed for practitioners, in one email.