PCI Council publishes guidance on AI in payment environments: a named person owns the output and agents get least access

The PCI Security Standards Council published Security Considerations for AI Systems, advisory guidance for payment environments. It says an AI system's purpose, permissions and data access should be defined before it is deployed, with each system limited to the access its tasks need. A named person should formally accept responsibility for its output, and the organisation should list which actions need human approval. The guidance advises against combining sensitive data access, outside communication and untrusted input in one system, and says AI should not handle unprotected passwords or keys. Existing PCI requirements take precedence.

• If you take card payments and use an AI assistant for customer messages, orders or refunds, keep card numbers out of its prompts and chat history.
• Name one person who signs off on what the assistant does with payments, and list the actions it may never take alone, such as issuing a refund.

Source: Help Net Security. This is our short summary of their reporting. The paragraphs marked "Our read" and the things to do are SeedFoundry's opinion. The summary is drafted with AI tools. Image: PCI Security Standards Council, from its own announcement. How we source and credit