What PCI's New AI Guidance Means for Payment Institutions

Artificial intelligence is becoming part of the operational infrastructure of payments. It is being used to detect fraud, support risk assessments, assist customers and increasingly interact with systems that handle sensitive financial information.

For payment institutions, this creates a challenge that goes beyond adopting new technology. Existing security controls were designed around systems with relatively predictable behaviour, defined permissions and established operating procedures. AI introduces additional complexity because its responses can vary, its decisions can depend on context, and some systems can initiate actions through connected tools.

On 7 October 2026, the PCI Security Standards Council (PCI SSC) published additional guidance on securing AI in payment environments. The announcement addresses a growing concern for payment institutions: how to manage access, accountability and existing security controls as AI systems take on greater operational responsibility.

The guidance does not introduce a new mandatory certification requirement. Instead, it helps organisations understand how AI deployments interact with existing payment security obligations, emerging threats and secure implementation practices.

The larger implication is important. As financial institutions expand their use of AI, documenting security controls is only part of the challenge. They also need to understand whether those controls remain effective when AI systems encounter unexpected, manipulated or adversarial inputs.

What PCI SSC's Guidance Actually Covers

The latest announcement follows PCI SSC's publication of Security Considerations for AI Systems in September 2026, developed with input from the Global Executive Assessor Roundtable and the Council's Board of Advisors.

The information supplement addresses four areas: AI deployment and use, defending against malicious applications of AI, how existing PCI standards apply to AI systems, and practical use cases involving AI in payment environments.

One particularly important clarification is that AI should not automatically be treated as a separate category of technology when determining which PCI requirements apply. Organisations must still assess how an AI system interacts with payment data, infrastructure and existing security controls.

This distinction matters for banks, payment processors, acquirers and financial technology providers. Introducing AI into an existing workflow does not remove the underlying security obligations associated with that workflow.

Consider a payment service provider introducing an AI assistant to investigate transaction disputes. The assistant might retrieve customer information, consult transaction records and recommend actions to a human investigator.

The institution must still consider data access, confidentiality, monitoring and accountability. But it now faces additional questions about how the assistant interprets instructions, handles untrusted information and behaves when different sources provide conflicting directions.

Traditional controls remain necessary. The challenge is determining whether they operate effectively when an AI system is part of the workflow.

Why Agentic AI Changes the Risk Assessment

The distinction between an AI system that provides information and one that can take action is particularly relevant.

A fraud detection model might assign a risk score to a transaction. A more autonomous fraud investigation agent could retrieve account information, query internal systems, prepare case findings and interact with other applications.

The second system introduces more ways for unexpected behaviour to affect an operational process.

An agent may receive instructions from authorised users, but it may also encounter transaction descriptions, customer messages, external documents or tool responses containing untrusted content. If it fails to distinguish between legitimate instructions and information it is merely supposed to analyse, an attacker could potentially influence its behaviour.

This is the underlying concern behind prompt injection, where malicious instructions are embedded in material that an AI system processes.

PCI SSC's previously published AI security principles discuss protecting AI systems against malicious inputs and malformed outputs. They identify risks including privileged actions, sensitive-information disclosure and unexpected changes in behaviour. The principles also address limited credentials, least-privilege access, monitoring and continued validation.

For payment institutions, these risks are not simply questions about model accuracy.

An AI agent could produce an accurate summary of a transaction while simultaneously exposing information it should not disclose. It could correctly identify a suspicious pattern but attempt an action outside its delegated authority.

The institution therefore needs to evaluate the behaviour of the entire AI-enabled workflow, including the model, connected tools, permissions, data sources and surrounding controls.

The Gap Between Documented Controls and Observed Behaviour

Most payment institutions already maintain security policies, access-control frameworks, incident-response procedures and assessment processes.

These remain essential. However, an AI deployment can satisfy a documented design expectation without necessarily behaving as intended in every operating scenario.

For example, an institution may establish a policy that its customer-service AI must never disclose sensitive account information to an unauthorised party. It may also configure the system to reject certain requests.

The relevant assurance question is whether those restrictions hold when the system encounters manipulated conversations, indirect instructions embedded in retrieved content or attempts to extract information through multiple interactions.

Similarly, an institution may limit an AI agent's permissions to specific tools. But testing should establish whether the agent attempts to misuse those tools, requests inappropriate actions or behaves unexpectedly when a connected service returns misleading information.

This is where behavioural testing becomes valuable.

Rather than relying exclusively on policy documents or configuration reviews, institutions can examine how AI systems respond to controlled scenarios designed to challenge their expected boundaries.

Importantly, behavioural testing complements established security assessments, model validation and PCI compliance processes. It does not replace them, and a successful test cannot establish that every possible failure mode has been eliminated.

What Payment Institutions Should Actually Test

PCI SSC's guidance creates a useful starting point for institutions to examine the assurance requirements of their AI deployments. The following testing priorities are practical implications of the guidance, rather than a new PCI-mandated testing checklist.

1. Resistance to Manipulated Instructions

An AI system should be evaluated against attempts to redirect its behaviour through untrusted content.

In a payment environment, this could involve a fraud investigation assistant processing a customer message containing instructions to disregard internal policies, or an agent receiving a manipulated response from an external service.

Testing should establish whether the system maintains the intended distinction between authorised instructions and lower-trust information.

The goal is not merely to determine whether the model refuses a particular prompt. It is to understand whether the complete workflow maintains its operational boundaries when exposed to realistic manipulation attempts.

2. Sensitive-Information Handling

AI systems may interact with transaction records, account information, customer communications and other sensitive material.

Institutions need to examine whether information remains appropriately protected across different interactions, users and connected services.

Testing scenarios could assess whether an AI assistant reveals information outside the requesting user's authorised context, includes sensitive details in inappropriate outputs or exposes data when prompted indirectly.

These behavioural tests should sit alongside established technical controls for data protection, access management and secure transmission.

3. Adherence to Institutional Policies

Financial institutions operate under internal policies that determine what systems and personnel are permitted to do.

An AI agent might be instructed to gather evidence for a fraud investigation but not modify account restrictions. A customer-service assistant might be authorised to explain a dispute process but not change a customer's financial arrangements.

Institutions should examine whether AI systems respect these boundaries under ordinary and adversarial conditions.

A particularly important distinction is between an AI system attempting an unauthorised action and the underlying infrastructure allowing that action to succeed. Both behaviours warrant examination, but they represent different control failures and require different mitigations.

4. Monitoring, Accountability and Recovery

PCI SSC's AI principles also emphasise logging, monitoring, human accountability and the ability to disable AI systems when necessary.

These considerations become more significant as systems operate with greater autonomy.

An institution should be able to investigate what an AI system attempted, which tools it used, what information it accessed and whether its behaviour departed from the expected workflow.

Testing should also examine what happens when a system encounters a failure. Does it stop, escalate appropriately, retry within permitted boundaries or continue acting when intervention is required?

For institutions managing consequential financial workflows, recovery behaviour can be as important as normal operating performance.

From Testing Results to Institutional Evidence

Identifying a vulnerability is only the beginning of an effective risk evaluation process.

An institution also needs to understand the circumstances in which the issue occurred, its potential operational impact, the controls intended to mitigate it and whether those controls remain effective after remediation.

This requires evidence that can be reviewed by people who were not involved in developing the AI system.

For example, a risk committee evaluating an AI-powered customer-service workflow may need to know whether sensitive-information disclosure was tested, which scenarios were covered, what failures were observed and whether subsequent testing demonstrated improvements.

A product team may be interested primarily in fixing the technical issue. A Chief Risk Officer or Head of Model Risk needs a broader view of what that issue means for the institution's exposure.

These are different decisions, but they should be supported by a consistent body of evidence.

PCI SSC's emphasis on accountability and existing security obligations reinforces the importance of this distinction. Technical assurance becomes more useful when its findings can inform deployment reviews, internal governance, third-party assessments and ongoing monitoring.

For institutions, the value of testing extends beyond identifying individual vulnerabilities. Documented scenarios, observed failures, applied mitigations and retesting results can provide a clearer basis for internal risk reviews, deployment discussions and ongoing governance. This is particularly important when AI systems are developed by third parties but the institution remains responsible for managing the risks associated with their use.

Where AetherLab Fits Into This Discussion

AetherLab helps institutions evaluate, mitigate and underwrite AI risk. Its approach addresses an important challenge emerging from the adoption of AI in financial workflows: institutions need evidence of how these systems behave, particularly when their normal operating conditions are challenged.

Through AdversarialScan, AetherLab helps institutions examine how AI systems behave under adversarial conditions, including manipulated instructions, attempts to bypass defined policies, inappropriate information disclosure and actions outside intended boundaries.

For payment institutions, this type of testing can help reveal weaknesses that may not be apparent from documentation or routine functional testing alone.

The resulting findings can inform a more structured evaluation of AI behaviour, including what was tested, what failed, which controls require attention and what residual risks remain.

This is complementary to PCI security assessments and existing institutional governance. AetherLab does not determine PCI compliance, certify payment systems or replace the responsibility of institutions and their authorised assessors.

Its relevance lies in helping institutions examine an additional dimension of risk: whether AI-enabled workflows behave within their intended boundaries when those boundaries are tested.

The Next Question for Payment Institutions

PCI SSC's latest guidance should not be interpreted as a new compliance deadline or an additional certification requirement. Its significance lies in recognising that AI is becoming part of the payment security environment and must be governed within the responsibilities and controls that already apply.

For payment institutions, the practical response is to examine where AI has entered consequential workflows, what information and tools those systems can access, and how their behaviour is evaluated throughout deployment.

An institution may have well-established security controls and still lack sufficient evidence about how an AI agent responds to manipulated inputs or unexpected operating conditions.

As AI becomes more autonomous, that evidence will become increasingly important for risk teams, security leaders and institutional decision-makers.

The question is no longer limited to whether an AI system has appropriate controls documented. It is also whether the institution can demonstrate how those controls perform when the system is challenged.

Assess How Your AI Systems Behave When Their Controls Are Challenged

AetherLab helps payment institutions evaluate AI behaviour through adversarial testing, including manipulated instructions, policy bypass attempts and sensitive-information exposure.

Explore how AdversarialScan can support the evaluation of AI-enabled payment workflows.

Explore AdversarialScan