ISO/IEC 27090:2026
What is ISO/IEC 27090:2026?
ISO/IEC's guidance standard on securing AI systems, built as the practices an organisation applies: an AI security governance programme inside the ISMS, zero trust and secure engineering for AI, supply chain and threat modelling, red teaming, and the detection and mitigation of data poisoning, evasion, membership inference, model exfiltration and inversion, direct model poisoning, sensitive outputs and prompt injection, with the cross-cutting mitigation guidance on interactions, life cycle continuity, deterioration, logging, development environments, input filtering and throttling. It comprises 46 controls organised across 3 domains, and applies in International.
Map this against the frameworks you already hold
The compliance knowledge graph holds cross-framework control mappings for hundreds of standards, including the ones you are likely to be certified against already.
Browse the framework graph →Where ISO/IEC 27090:2026 overlaps with the standards you already hold
What ISO/IEC 27090:2026 means in your sector
What ISO/IEC 27090:2026 means for your job
Questions people ask about ISO/IEC 27090:2026
What is ISO/IEC 27090:2026?
How many controls does ISO/IEC 27090:2026 have?
Where does ISO/IEC 27090:2026 apply?
Which version of ISO/IEC 27090:2026 is covered here?
Query ISO/IEC 27090:2026 programmatically
ISO/IEC 27090:2026, its 46 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.
ISO/IEC 27090:2026 API reference and MCP config →How ready are you for ISO/IEC 27090:2026?
Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.