ISO 27090 Leadership Cards
Seven one-page briefs that put the ISO/IEC 27090 AI threats in business terms, each with named owners, measures to report and a decision for leadership.
The threat and control cards are written for the people who build and audit AI systems. These briefs are for the people who answer for them. They group the twelve threats in ISO/IEC 27090:2026 into five business risks and one assurance programme.
Briefs 2 to 7 each say what is at stake, how the risk could play out in financial services, healthcare, government or critical infrastructure, and the signs that you are exposed. It then names the controls, who owns each one and the measure reported to leadership. It ends with questions to put to your team, what a strong answer sounds like, the decision leadership needs to take and what to do if it happens.
The seven briefs
- Brief 1 AI security risk at a glance
- Brief 2 Manipulation of AI training and models
- Brief 3 Deception of AI at the point of decision
- Brief 4 Extraction of models and data
- Brief 5 Direct theft and leakage of AI assets
- Brief 6 Hijacked and leaking AI assistants
- Brief 7 Ongoing assurance of AI controls
How to use them
Start with Brief 1. It maps every risk to its threats, controls and owners on one page, and asks for the first decision: one accountable executive for AI security. Take the other briefs to the board or risk committee one at a time, and use the questions on each to test what your teams tell you.
Each brief cites the relevant clauses of ISO/IEC 27090, ISO/IEC 42001 Annex A and the EU AI Act. The detail behind each brief is on the ISO 27090 Threat Cards and the ISO 27090 Control Cards.