One-sentence summary
ISO/IEC FDIS 27091, Cybersecurity and Privacy — AI — Privacy protection, is at the Final Draft International Standard (FDIS) stage, focusing on privacy when AI systems process personal data and complementing the published ISO/IEC 27090:2026.
Standard Overview
| Item | Detail |
|---|---|
| Standard number | ISO/IEC FDIS 27091 |
| Title | Cybersecurity and Privacy — Artificial intelligence — Privacy protection |
| Body | ISO/IEC |
| Status/Date | Final Draft International Standard (FDIS), progressing as of October 2026 |
| Topic | Personal data processing and privacy risk in AI |
| Companion | ISO/IEC 27090:2026 (AI security threats) |
Scope
- For builders and operators of AI systems that process personal data.
- Applies to data-protection teams embedding privacy into AI compliance.
- Sits alongside 27090 to cover the security and privacy compliance lines.
Key Clauses
| Clause area | Content | Affected party |
|---|---|---|
| Personal data processing | Govern personal-data use in AI training and inference | Model providers |
| Privacy risk | Identify privacy risk scenarios introduced by AI | Data-protection teams |
| Protection requirements | Propose privacy-protection control directions | Enterprise compliance teams |
| Standard linkage | Complement 27090, separating security and privacy | Enterprise security and legal |
Compliance Advice
- Still at FDIS, so pre-assess privacy impact against the draft while tracking the final text.
- Cross-check against ISO/IEC 27090:2026 to meet security and privacy requirements separately.
- Cite the FDIS stage and timeline (October 2026).
Official Sources
- ISO: ISO/IEC FDIS 27091