PCI DSS vs ISO 42001
By Sam Rivera, Founder, SentinelPanda · August 6, 2026 · 2 min read · PCI DSS
These are orthogonal standards, and for most organisations only one applies. The exception is worth understanding: AI models trained on payment data.
Mostly unrelated, and that is fine
Not every framework pairing is meaningful. PCI DSS is a prescriptive control standard for cardholder data imposed by card brand contract. ISO 42001 is a certifiable management system for artificial intelligence. A merchant taking card payments with no AI anywhere has no reason to consider ISO 42001, and an AI company that never touches a card number has no reason to consider PCI DSS.
The comparison earns its place because of a specific and increasingly common case, not because the standards are alternatives.
Where they meet: payments AI
Fraud detection, transaction risk scoring, chargeback prediction, and authorisation optimisation are all machine learning problems trained on transaction data — and transaction data is where account data lives. That single fact creates the intersection.
If a model is trained on datasets containing PAN, that training data is in PCI DSS scope: Requirement 3 governs its storage, Requirement 7 who may access it, Requirement 10 the logging of that access. The data science environment becomes part of the cardholder data environment, with everything that implies for segmentation and assessment cost.
The obvious mitigation
- Tokenise or truncate before data reaches the training environment. Models rarely need the actual PAN — they need the entity relationships and behavioural features a token preserves.
- Derive features upstream in the CDE and export only the features, keeping the data science platform out of scope entirely.
- Where full PAN genuinely is needed, segment the training environment as CDE and accept the assessment consequences deliberately rather than by accident.
- Never let a notebook environment with broad access become the place raw payment data ends up. It is the most common way a data science team quietly expands PCI scope.
What ISO 42001 adds on top
PCI DSS will secure the data. It has no opinion on whether the fraud model declines legitimate transactions disproportionately for some customers, whether anyone can explain a decline to a customer who asks, or who is accountable when the model degrades.
Those are consequential questions for a payments business — a fraud model that systematically misfires is both a customer harm and a commercial problem, and in some jurisdictions a regulatory one. ISO 42001 provides the impact assessment, monitoring, and oversight structure for exactly that.
The practical read: PCI DSS is non-negotiable if you touch card data, ISO 42001 is worth considering once AI is materially involved in decisions affecting your customers. They govern different failure modes of the same system.