AI governance asks whether, when and how an organization should use AI. AI security asks how the tool, model, data, connection or automated action could be compromised or misused.
A responsible AI policy is necessary, but it is not enough when an AI tool can reach business information or take action in another system.
Canadian organizations are moving from “Can staff use AI?” to more specific questions: Can an AI tool access our files? Which account does it use? Can it send, publish, approve or change something? What happens if a prompt, data source, integration or provider behaves unexpectedly?
Those are security questions. They are becoming easier to answer with a clearer standards and guidance landscape.
General information only. Reviewed October 2, 2026. Standards and guidance change. This resource does not provide legal advice, certify an AI system, determine compliance or replace the official source.
The current AI-security standard to know: ISO/IEC 27090:2026
ISO/IEC 27090:2026, Cybersecurity — Artificial Intelligence — Addressing security threats and compromises to artificial intelligence systems, is an AI-security guidance standard. ISO describes it as guidance for understanding, detecting and mitigating threats specific to AI systems across their lifecycle.
As of October 2, 2026, ISO lists Edition 1 as under publication, in final production steps. The public ISO page is accessible; the full standard is generally obtained through ISO or a national standards body once available. Do not present it as a completed certification, or claim an organization “meets ISO/IEC 27090” without a defined and supportable basis.
ISO explains why normal cybersecurity alone may miss important AI-specific risks: manipulated training data can influence system behaviour, and apparently legitimate queries can be used to obtain model information. In ordinary business terms, the concern expands beyond malware and passwords to the information feeding an AI tool, the prompts and instructions it receives, the permissions behind it, the systems it can call and the results it can create.
What AI security adds to a normal security program
| AI-security concern | Plain-language question | Practical safeguard |
|---|---|---|
| Instruction manipulation | Can untrusted content or a user prompt cause the tool to ignore its intended boundaries? | Limit tools and actions, separate untrusted inputs, test realistic misuse and require human approval for sensitive actions. |
| Information exposure | Can prompts, connected files, logs or outputs reveal confidential business, client or personal information? | Classify information, restrict access, define approved uses and review vendor settings and retention. |
| Data or knowledge tampering | Could a bad source, altered record or manipulated dataset influence the result? | Use trusted sources, preserve provenance where possible and verify important outputs before acting. |
| Insecure integration | Which account, token or connector lets the tool reach another system? | Use least privilege, separate service identities, review app grants and maintain a fast revocation path. |
| Availability and dependency | Can the organization still operate if the AI service or its connected platform is unavailable? | Document fallback procedures, retain access to underlying records and avoid making one automation the only operating path. |
Use the right source for the question
| Source | Best used for | Status and boundary |
|---|---|---|
| ISO/IEC 27090:2026 | AI-specific cybersecurity threats, compromises and mitigations across the AI lifecycle. | Guidance standard. ISO lists Edition 1 as under publication in October 2026; it is not a certification claim. |
| ISO/IEC 42001:2023 | Establishing an AI management system with policy, accountability, objectives, risk management and improvement. | Requirements standard; the official overview is public and the full standard is generally paid. |
| Canadian Cyber Centre: Top 10 AI security actions | A practical Canadian starting point for reducing AI security risk. | Official guidance, not a law or certification program. |
| Canadian Cyber Centre: Careful adoption of agentic AI | AI systems that can call tools, access data or take multi-step actions. | Official guidance focused on agentic-AI risks and controls. |
| Digital Governance Council guide | Finding Canadian digital-governance standards and understanding the difference between standards, verification and certification. | CyberTECT overview; always use DGC, SCC and government sources for authoritative program details. |
A proportionate starting point for a small organization
You do not need to become an AI developer or buy every standard to use AI responsibly. The work should match the use case and the information involved.
- Inventory AI use. Record the tool, purpose, business owner, users, account type, connected services and information handled.
- Set information boundaries. Define what may be entered, uploaded, searched or connected—and what must stay out.
- Review the identity and permissions. Know whether the tool uses an employee account, administrator account, service account or OAuth grant. Remove access it does not need.
- Keep people accountable. Set human review and approval points for client-facing, financial, legal, operational or other consequential work.
- Test the exit path. Confirm you can remove access, retrieve needed records and continue the business process if the tool or provider is unavailable.
When a deeper review is justified
A deeper assessment is appropriate when AI can handle sensitive personal, client, health, financial, legal, confidential business or regulated information; when it is connected to business systems; when it can act without a person approving each step; or when a customer, contract, regulator or insurer asks for specific evidence. That work may involve privacy, legal, vendor, security and operational owners.
Where the Canadian AI-agent report fits
The recent report of suspected AI-agent activity against public Canadian government websites is not proof that every AI tool is unsafe. It is a timely reminder that an automated system can issue unexpected requests and that organizations need boundaries around public systems, connected accounts and automated actions.
Read the related brief: Suspected AI-Agent Activity Targeting Canadian Government Websites: What It Means for Organizations.
Find the official material without hunting for it
CyberTECT has added ISO/IEC 27090 and current Canadian agentic-AI guidance to the Frameworks & Official Guidance library. That page labels each item as guidance, a standard or a program so a small organization can start with the right kind of resource.
Where CyberTECT fits
CyberTECT is Ontario’s Rural & Small Business Digital Risk Partner. We can help an organization map AI tools, accounts, permissions, information handling, vendor dependencies, human review and recovery paths. We do not certify AI systems, provide legal advice, perform a privacy impact assessment or replace an organization’s security or compliance authority.
Useful starting points are AI Readiness & Governance, the AI & Digital Operations Review and, where ownership or emergency access is unclear, Break-Glass Readiness.
Official sources
- ISO/IEC 27090: Cybersecurity — Artificial Intelligence
- Standards Council of Canada: ISO/IEC FDIS 27090
- ISO/IEC 42001: Artificial intelligence management system
- Canadian Centre for Cyber Security: Top 10 artificial intelligence security actions
- Canadian Centre for Cyber Security: Careful adoption of agentic AI
- Canadian Centre for Cyber Security: Frontier artificial intelligence
CyberTECT resources provide general operational guidance. They do not replace advice specific to your legal, regulatory, contractual or technical circumstances.