The PCI Security Standards Council has just released a new information supplement titled Security Considerations for AI Systems, and for organizations deploying artificial intelligence anywhere around payments, it is worth paying attention to.
The timing is important.
Organizations are moving quickly to introduce AI into customer service, voice interactions, fraud detection, operational workflows, payment support, and increasingly into more autonomous and agentic experiences. As that happens, one question becomes increasingly important that is really the practical issue:
Where does AI sit within the payment environment, and what does it have access to?
The new PCI SSC guidance looks at several areas, including how organizations should think about deploying AI systems, how AI can affect security risk, how organizations can defend against malicious uses of AI, and how existing PCI standards should be considered when AI is introduced into a payment environment.
One of the most important points in the guidance is also one of the simplest:
AI should generally be treated like any other technology when determining which PCI requirements may apply.
That may sound obvious, but it has significant implications.
If an AI system is introduced into a payment workflow, organizations need to understand what that system can see, what systems it can access, what information it can process, and what role it plays in the broader payment flow.
For example, if an AI assistant is helping a customer make a payment, does the AI actually need access to cardholder data?
If a voice AI system is managing a payment-related conversation, where does the payment data enter the process?
If an AI agent can interact with payment systems, what level of access has it been given, and how is that access being controlled?
These are no longer theoretical questions; they are becoming part of the design decisions organizations need to make as AI moves closer to payment processes.
This Is Guidance, Not a New PCI Requirement
It is also important to be clear about what PCI SSC has released.
This is an information supplement, not a new PCI standard and not a new set of mandatory requirements and the existing PCI standards continue to take precedence.
What this document does provide is a useful framework for organizations to begin evaluating how AI changes their technology environment, their risk profile, and potentially their PCI scope.
That distinction matters.
The message is not that using AI automatically creates a new compliance burden.
The message is that AI should not be treated as an exception.
AI and Payment Flow Need to Be Considered Together
From my perspective, this is where organizations need to look beyond the technology itself.
The question is not simply:
"Are we using AI?"
Rather, it should be:
"Where does AI sit in the payment flow, and what does it touch?"
That includes looking at:
- what data the AI can access;
- whether it interacts directly or indirectly with cardholder data;
- which systems it connects to;
- what decisions or actions it can perform;
- how access is authenticated and controlled;
- how activity is monitored;
- and whether introducing AI changes the security boundaries around the payment environment.
As organizations move toward conversational AI, voice AI, and agentic commerce, these questions are only going to become more important.
The organizations that address them early will be in a much better position to adopt AI without unnecessarily increasing risk, complexity, or PCI exposure.
Download the New PCI SSC Guidance
If your organization is deploying AI in or around payments, I recommend reviewing the new PCI SSC information supplement.
You can download and read the guidance Security Considerations for AI Systems
I'll be spending more time on this topic as organizations begin interpreting the guidance and applying it to real-world payment environments.
If you have questions about where AI fits within your payment flow, or how introducing AI may affect your payment security or PCI environment, reach out to us; we are here to help.