PCI Security Standards Council calls for human approval before AI agents handle card data

Payment security meets autonomous AI

The Payment Card Industry Security Standards Council has issued advisory guidance requiring human oversight before AI agents can act on cardholder data. The guidance, released in October 2026, covers both how organisations should protect data they feed to AI systems and how they should defend payment environments against AI-assisted attacks ^[1].

The central requirement is simple: no AI agent may take an action involving cardholder data without human approval first. The council defines an AI agent as a system that can plan, reason and act with some degree of autonomy ^[1].

For any organisation running AI in a payment environment, that means deciding early what an agent can see, what it can propose and who approves it.

What the guidance covers

The advisory addresses two sides of the problem. First, when an organisation supplies cardholder data to an AI system, whether for analysis, fraud detection or customer service, it must ensure that data is protected and used only for its intended purpose. Second, organisations must defend against attackers who use AI to find and exploit weaknesses in payment systems ^[1].

The guidance recommends that AI agents should have access only to the data they need, following the principle of least privilege. If an agent is checking a transaction for fraud, it should see the transaction details but not the entire customer database. If it spots something unusual, it should flag the case for a human decision rather than blocking the payment itself ^[1].

Testing is another focus. The council advises organisations to simulate attack scenarios, including those where an attacker uses AI to probe for vulnerabilities or craft convincing phishing messages. That testing should happen before an AI system goes into production and regularly afterwards ^[1].

What happens when an agent wants to act

Say a support agent encounters a customer complaint about a charge and the AI suggests issuing a refund. Under the new guidance, that suggestion goes to a human approver who checks the account, the transaction history and the refund policy before deciding. The AI proposes, the person decides.

That approval step matters because cardholder data is sensitive, disputes happen and mistakes are costly. When an agent acts without oversight, the organisation may not know what it did until someone complains. With a human checkpoint, there is a record of who approved what and when.

The guidance is advisory, not mandatory, but it sits alongside existing PCI DSS requirements that are mandatory. Where those requirements already cover a risk, they take precedence. The new recommendations fill gaps that the existing standards do not fully address ^[1].

Logging what the agent does

Another recommendation is logging. The guidance advises organisations to keep detailed logs of what AI agents propose, what actions are approved and what data they access. Those logs serve two purposes: internal audit and incident response ^[1].

When a payment dispute arises, or when a supervisor asks questions, the log is what tells the story. It shows which agent made which suggestion, who approved it and when. A log someone with administrator rights can edit is harder to rely on when the stakes are high.

Here, the thing to seal is each agent action as it is written to the log: the instruction received, the tool call made, the result returned and the approver's decision. Sealing takes a fingerprint, not the data, so the log itself never leaves the organisation's systems. If the action is questioned months later, anyone the organisation shares the record with can check that it is the one written at the time ^[2].

A digital witness doesn't authorise the action or make the decision correct. It shows that the record of what the agent did, and when it did it, hasn't changed since it was sealed. WitniumChain handles that sealing through the REST API, the SDK or the MCP server, with the first 2,000 witnesses a month free ^[2][3].

How it would work

1. The AI agent logs each instruction, tool call and approval decision as it happens.
2. Each log entry is sealed the moment it is written, creating a fingerprint.
3. If the action is challenged, anyone can recalculate the fingerprint and check it matches.

Governance and accountability

The guidance also addresses governance. Organisations are advised to assign clear accountability for AI systems that touch cardholder data, and to ensure that people in those roles understand both the AI's capabilities and the payment security rules it must comply with ^[1].

That means someone in the organisation knows which AI agents are running, what data they can access, who approves their actions and where the logs are kept. When a regulator or an auditor asks, that person can answer.

For legal AI used in law firms, the guidance has limited relevance, because legal advice systems are not typically high-risk under the AI Act and do not handle cardholder data. The PCI rules apply to payment environments, not to professional services more broadly.

What this means for you

If your organisation processes card payments and is considering AI agents for fraud detection, customer service or transaction monitoring, ask these questions now:

• Which actions can the agent propose, and which require human approval?
• What cardholder data does the agent need, and is access limited to that data only?
• Who approves the agent's proposed actions, and is that approval logged?
• How do we test the agent against simulated attacks before it goes live?
• If an action is questioned months later, can we show what the agent did and who approved it?

The PCI guidance is advisory, but the questions it raises are practical. Deciding early what an agent can see and do, and who checks its work, is simpler than answering those questions after something has gone wrong.

Sources

1. Help Net Security, 'PCI SSC releases guidance for securing payment environments that use AI', 9 October 2026, https://www.helpnetsecurity.com/2026/10/09/pci-ssc-payment-environments-ai-security-guidance/
2. WitniumChain Documentation, 'Agent actions pattern', accessed October 2026, https://witniumchain.com/docs
3. WitniumChain, 'Pricing', accessed October 2026, https://witniumchain.com/signup