ISO 27090 Threat Cards
The 12 system threats that affect AI systems as mentioned in ISO27090 guidance
ISO/IEC 27090:2026 gives guidance on the security threats that are specific to AI systems. Most of them get past firewalls, encryption and access control, because they arrive through data and inputs the system is built to accept.
These cards turn the twelve threats in its Table 1 into something a team can put on the table in a threat-modelling session. Each card covers one threat: how it works, a worked example, the asset it hits, the life-cycle stage where it appears, whether an attacker is needed, and the signals that help you detect it. Threats are colour-coded as integrity (behaviour is altered) or confidentiality (data or the model leaks).
The twelve threats
- T01 Data poisoning
- T02 Evasion
- T03 Membership inference
- T04 Model exfiltration
- T05 Model inversion
- T06 Direct model poisoning
- T07 Direct model theft
- T08 Direct training data leak
- T09 Model input leak
- T10 Sensitive model output
- T11 Prompt injection
- T12 Output contains injection attacks
How to use them
Add the threats to your ISO/IEC 27001 risk assessment (6.1.2) and Statement of Applicability (6.1.3), and to your ISO/IEC 42001 AI management system. The cards are guidance, not certification. EU AI Act Article 15 requires high-risk AI systems to resist these attacks from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
The controls that answer these threats are on the ISO 27090 Control Cards. For developers, the Developer Edition shows each threat as vulnerable code to spot in review.