PCI SSC publishes AI security guidance, calls for human approval of agent actions on cardholder data

The PCI Security Standards Council (PCI SSC) has published a new information supplement addressing the security of artificial intelligence systems. The document covers both the security aspects of using AI in payment environments and the considerations for securing traditional systems against attacks that leverage AI.

Reporting on the guidance, Help Net Security highlighted that it calls for human approval of AI agent actions involving cardholder data. That framing puts a governance question squarely on the table: how much autonomy AI agents should have over payment data.

PCI SSC said it developed the document in collaboration with industry stakeholders including the Global Executive Assessor Roundtable (GEAR) and the Board of Advisors. The guidance provides a high-level summary of AI guidelines alongside a description of key areas, according to the council.

Importantly, PCI SSC stresses that the information supplement serves as guidance and is not to be considered mandatory requirements. Where the guidance and official PCI standards differ, the PCI standard always takes precedence. In practice, that makes the document a reference for understanding risk rather than a new set of compliance obligations.

The release reflects PCI SSC's recent focus on AI. The council has already been discussing AI's role in payment security through its "The AI Exchange" interview series and topic articles, and packaging the material into a dedicated information supplement marks a step from exchanging views toward structured guidance.

For the payments industry, AI agents are moving into customer service, reconciliation and risk workflows, while cardholder data remains at the center of compliance. Requiring human approval for agent actions that touch cardholder data draws a line between automation and accountability: which decisions a system may take on its own, and which need a person to sign off.

What to watch next is how payment organizations interpret and implement the guidance as they bring agents into live systems, and whether it shapes the direction of future revisions to the PCI standards.