ISO 27090 Control Cards
Sixteen controls that close the gaps ISO/IEC 27001 Annex A leaves for AI. Each one names the evidence that proves it works.
ISO/IEC 27001 Annex A was not written with AI systems in mind, and it leaves gaps: dataset provenance, model signing, prompt injection, model extraction through the API. These sixteen controls, drawn from clauses 5 to 7 of ISO/IEC 27090:2026, close them.
Each card states the control, why it matters, who owns it, what it applies to and which threats it addresses. It then lists the implementation steps and the evidence an auditor will sample, so you can show that a control works and not only that it exists.
The sixteen controls
- AIC-01 Dataset provenance and integrity
- AIC-02 Model promotion gate
- AIC-03 Signed model artefacts
- AIC-04 AI bill of materials
- AIC-05 Adversarial robustness testing
- AIC-06 Malicious input detection
- AIC-07 Output granularity limits
- AIC-08 Model use throttling
- AIC-09 Privacy-preserving training
- AIC-10 Least model privilege
- AIC-11 Untrusted output handling
- AIC-12 Retrieval authorisation
- AIC-13 AI red teaming
- AIC-14 Mitigation conflict review
- AIC-15 Deterioration re-validation
- AIC-16 AI kill switch
Controls are colour-coded as preventive (stops the attack), detective (finds it or tests for it), corrective (limits the damage) or governance (decides and records).
Where to start
Start with AIC-10, AIC-12, AIC-03, AIC-01 and AIC-11. Together they cut the blast radius of injection, cross-customer leakage and tampered models.
Add each control you adopt to your Statement of Applicability as organisation-defined, citing ISO/IEC 27090 as the source, under ISO/IEC 27001 clause 6.1.3. The threats each control addresses are on the ISO 27090 Threat Cards.