AI governance
ISO/IEC 27090
ISO/IEC 27090:2026 · Security threats and compromises to AI systems · Global guidance
Published on 14 October 2026, ISO/IEC 27090 is international guidance on how AI systems are attacked and how to detect and reduce those attacks across the AI life cycle. It is guidance, not a certifiable standard, and it applies whether you build AI or simply use it. Lavawall® maps it to the controls you already run and gathers much of the evidence on its own.
What ISO/IEC 27090 is, and what it is not
- It is guidance. It describes threats to AI systems and the ways to detect and mitigate them. It does not set requirements to certify against, and nobody issues an ISO/IEC 27090 certificate.
- It builds on what you may already have. It applies the security management and controls of ISO/IEC 27001 and 27002 to AI, and it sits alongside ISO/IEC 42001, the AI management system standard.
- It applies to builders and users. Organizations of every type and size that develop AI systems or use them are in scope, at every stage of the AI life cycle.
- It is new. The first edition was published by ISO and IEC on 14 October 2026, so most organizations are starting from the same place.
Two levels in Lavawall
The guidance does not define levels. Lavawall offers two, so the work you take on matches how your organization uses AI. The second level includes everything in the first.
| Level | Who it is for | What it covers |
|---|---|---|
| Using AI services | Organizations that use AI services such as Microsoft 365 Copilot, ChatGPT, Gemini, and AI agents | Approved tools, limits on the data people share with AI, permissions held by connected AI apps, awareness of prompt injection, and logging and monitoring of AI activity. |
| Building or hosting AI | Organizations that develop, fine-tune, host, or integrate AI models | Everything in Using AI services, plus protection against poisoning, evasion, inference attacks and model theft, protection of development environments, red teaming, and provenance of models and data. |
The threats it describes, in plain language
For each type of compromise, the guidance looks at what goes wrong, how to spot it, and how to reduce it. In everyday terms:
| Threat | What it means |
|---|---|
| Data poisoning | An attacker slips bad data into what a model learns from, so it gives wrong answers or carries a hidden back door. |
| Direct model poisoning | The model itself is tampered with, for example a model file swapped or altered before you deploy it. |
| Evasion | Input crafted to fool a model, such as a message designed to slip past an AI filter that should have caught it. |
| Membership inference | Working out from a model's answers whether a particular person's or organization's data was used to train it. |
| Model inversion | Rebuilding sensitive training data, such as personal details, from what the model returns. |
| Model exfiltration | Copying a model's behaviour by querying it over and over, or stealing the model outright. |
| Prompt injection | Instructions hidden in a prompt, an email, a web page, or a document that make an AI assistant ignore its rules or act for the attacker. |
| Sensitive model output | An AI system revealing confidential information it should never have shared. |
| Output that carries an attack | AI-generated content, such as code, links, or queries, that attacks the system or the person that uses it. |
It also covers the security work around the model: an AI governance program, zero trust, sound software engineering, AI supply chain risk, threat modelling, red teaming, logging and monitoring, protecting development environments, filtering malicious input, limiting how fast a model can be queried, and keeping track of where models and data came from.
What Lavawall® gathers for you automatically
Much of the evidence for ISO/IEC 27090 already sits in the systems Lavawall connects to. Instead of a questionnaire answered from memory, these are tested against live data:
- Connected AI apps and agents. AI apps and AI agents connected to Microsoft 365 and Google Workspace, and whether they can read mail and files.
- Shadow AI. AI apps found through SaaS discovery, and whether each one is on your approved list.
- Copilot and Gemini activity. Whether Microsoft 365 Copilot and Gemini activity is being recorded, and whether anyone reviewed the jailbreak and hidden-instruction (cross-prompt injection) attempts Copilot itself detects. Lavawall works from the activity records and detections; it does not keep the text of prompts or responses.
- AI on computers. AI tools and local model servers installed on your computers.
- AI browser extensions. Extensions that can read every website a person visits, including email and line-of-business apps in the browser.
- AI services on your network. AI services listening on computers or open on the internal network.
- AI services on the Internet. Model servers, AI chat interfaces, and data science notebooks the domain scan finds exposed to the Internet.
Each check keeps a dated history, so you can show an auditor or a client that a control held over time, not only on the day someone looked. Policies, threat models, red team results, and supplier reviews are recorded once and kept with the controls they support. See the full list of automatic checks.
How it fits with ISO/IEC 42001, OWASP, and the rest
- ISO/IEC 42001 sets up the AI management system: policy, roles, impact assessment, and life cycle. ISO/IEC 27090 supplies the security detail behind it.
- The OWASP Top 10 for LLM Applications overlaps on prompt injection, poisoning, sensitive disclosure, and supply chain risk, from a developer's point of view.
- The NIST AI RMF, EU AI Act readiness, and Canadian AI governance share the same controls in Lavawall, along with ISO 27001 and your other security frameworks.
Because every framework draws on one shared control set, a control you put in place for ISO/IEC 27090 counts once and shows up everywhere it applies.
Training courses for ISO/IEC 27090
The Lavawall® training catalogue has a course that covers it. Assign it to the people it applies to and keep the completion records with the rest of your compliance evidence.
- ISO/IEC 27090: AI security threats in practice (20 min)
See this course in the training catalogue →
Related
Primary source: ISO/IEC 27090:2026 at ISO. This page summarizes the guidance in our own words and does not reproduce it. Last verified October 19, 2026.
Frequently asked questions
Is ISO/IEC 27090 certifiable?
No. ISO/IEC 27090 is guidance, not a requirements standard, so no one certifies an organization against it. It builds on ISO/IEC 27001 and 27002 and sits alongside ISO/IEC 42001, which are certifiable. Organizations use ISO/IEC 27090 to decide how to handle AI-specific threats within the security and AI management systems they already run.
Do we need ISO/IEC 27090 if we only use Microsoft 365 Copilot?
Nothing requires it, because it is guidance. It is written for organizations that use AI as well as those that build it, and several of the threats it describes reach Copilot users directly: hidden instructions in an email or a shared file, an assistant revealing information it should not, and AI apps connected to your mail and files without review. Lavawall's Using AI services level is sized for exactly this situation.
How is ISO/IEC 27090 different from ISO/IEC 42001?
ISO/IEC 42001 is the certifiable standard for an AI management system: policy, roles, impact assessment, and how AI is governed across its life cycle. ISO/IEC 27090 is narrower and more technical. It explains how AI systems are attacked and how to detect and reduce each threat. Many organizations use ISO/IEC 42001 for the management system and ISO/IEC 27090 for the security detail. In Lavawall they share controls, so the work counts toward both.
What does Lavawall check automatically for ISO/IEC 27090?
AI apps and AI agents connected to Microsoft 365 and Google Workspace and whether they can read mail and files; AI apps found through SaaS discovery and whether they are approved; Microsoft 365 Copilot and Gemini activity, including the jailbreak and hidden-instruction attempts Copilot itself detects; AI tools and local model servers on computers; AI browser extensions that can read every website; AI services listening on computers or the internal network; and AI services the domain scan finds exposed to the Internet. Each check keeps a dated history.
Does Lavawall make us ISO/IEC 27090 compliant?
No tool can do that, and because ISO/IEC 27090 is guidance there is no certificate to earn. Lavawall helps you assess where you stand against it, gathers much of the evidence automatically, and tracks what is still open, so you can show clients, insurers, and auditors how you handle AI security threats.