Summary

PCI DSS has no AI-specific exemption. If an AI tool receives, stores, processes, or transmits account data, or connects to systems that do or that protect the cardholder data environment (CDE), it is in scope. This white paper explains how AI can change your PCI compliance scope and controls, and what to have ready before your next assessment.

Inside, you’ll learn:

  • Why PCI DSS has no separate rulebook or exemption for AI
  • How AI can come into PCI DSS scope through its connections to the cardholder data environment (CDE), not only through payment data
  • How shadow AI can create an uncontrolled data path for account data
  • Why chat histories and provider logs matter when sensitive authentication data is involved
  • Why approved AI is not automatically covered by the vendor’s PCI DSS status, including whether the vendor’s Attestation of Compliance (AOC) covers the service you use and how to evaluate changes between annual assessments
  • Which PCI DSS requirements an AI use case can touch, depending on what it does
  • What evidence to have ready for your next QSA assessment, and when to raise material AI changes with your QSA

It’s written for teams that handle payment card data, so you can raise AI-related scope questions early in assessment planning instead of discovering them during fieldwork. Insight Assurance conducts independent PCI DSS assessments.

Also in this series: AI and SOC 2: When To Revisit Scope, Controls, and Evidence.