What Are the Latest Updates from the PCI Security Standards Council?

Updated

The PCI Security Standards Council (PCI SSC) has recently published four updates that matter most for compliance planning: a limited revision of PCI DSS (v4.0.1), a new PCI Key Management and Operations (KMO) Standard v1.0, a new information supplement on AI system security, and extended expiration dates for PCI PTS HSM requirements and device approvals. Which one affects you depends on your role — merchants and assessors should start with PCI DSS v4.0.1, entities handling cryptographic keys with the KMO standard, organizations deploying AI in payment environments with the AI supplement, and terminal/HSM vendors with the PTS date extensions.

PCI DSS v4.0.1: A Limited Revision, Not a New Version

According to the PCI SSC site, the Council published a limited revision to PCI DSS v4.0.1 to address stakeholder feedback and questions received since v4.0 was released. The word "limited" is the key detail: this is a targeted revision rather than a restructured standard.

What this means for you:

  • If you are mid-assessment against PCI DSS v4.0, check the revision notes before assuming your current documentation is unaffected.
  • If you are planning a future assessment, confirm with your assessor which version applies to your validation timeline.
  • The site points readers to the Standards Updates & RFCs section for the full revision details — that is the authoritative place to verify scope before changing any control documentation.

PCI Key Management and Operations (KMO) Standard v1.0

PCI SSC has published a new standard "designed for entities involved in the use of cryptographic keys." This is a standalone standard, not a PCI DSS supplement, so it applies to a specific audience: organizations that generate, store, distribute, or retire cryptographic keys in payment-related systems.

Decision guide:

Your situation Relevance of KMO v1.0
You operate HSMs or key management infrastructure for payment processing High — read the standard directly
You are a merchant using third-party payment terminals Low — your provider's key management is their responsibility
You are building or auditing key lifecycle processes High — use it as a reference framework

Because the standard is new (v1.0), expect supporting guidance and adoption timelines to develop. Check the Document Library for the published text before committing resources.

Security Considerations for AI Systems

PCI SSC has published a new information supplement addressing the security of artificial intelligence systems. Note the document type: an information supplement provides guidance and considerations — it is not a mandatory standard with its own assessment requirements.

When this is worth your time: if your organization uses AI in or near payment data flows — for example, fraud scoring models that ingest transaction data, or chatbots that handle cardholder inquiries — the supplement gives you a structured way to think about those risks. If AI is entirely outside your payment environment, it can wait.

PCI PTS HSM Requirement and Device Approval Date Extensions

The site carries a reminder about the extension of PCI PTS HSM v4 security requirements and device approval expiration dates, as well as PCI PTS HSM v3 device approval expiration dates. This affects hardware security module vendors and anyone whose approval status depends on those dates.

Action: if you track HSM approval expirations for procurement or deployment planning, re-check your internal dates against the reminder — the extensions may move deadlines you previously recorded.

Also Worth Knowing

  • PCI PTS POI Modular Security Requirements v7.0 is listed as just published in the Document Library — relevant to point-of-interaction terminal vendors.
  • A PCI DSS and NIST CSF mapping resource is available for organizations that maintain controls against both frameworks and want to align them rather than duplicate effort.
  • Community Meetings and training (including ISA/QSA training in Kuala Lumpur alongside the Asia-Pacific Community Meeting, and the Europe Community Meeting) are open for registration — useful if you need formal training or want direct access to PCI SSC updates.

How to Verify Any of These Updates

  1. Go to pcisecuritystandards.org and open the Document Library — this is where the published texts of the KMO standard, the AI supplement, and PTS documents live.
  2. For PCI DSS v4.0.1 details, use the Standards Updates & RFCs section, which the site identifies as the place for the revision announcement.
  3. To confirm training or event details, use the registration links on the homepage rather than third-party summaries.
  4. To find assessors or solutions, use the site's Find a Provider or Solution tool.

The main pitfall to avoid: treating the AI supplement as a compliance requirement or the PCI DSS v4.0.1 revision as a full new version. Both misreadings lead to wasted effort — check the document type and revision scope in the Document Library before adjusting your compliance program.