---
title: "PCI DSS"
description: "PCI DSS is the global standard protecting payment cardholder data. Why pasting card numbers into AI tools almost certainly violates PCI DSS and how to keep CHD out of the AI prompt path."
url: "https://sonomos.ai/glossary/pci-dss/"
source: "https://sonomos.ai/glossary/pci-dss/"
---

# PCI DSS

The Payment Card Industry Data Security Standard — the global security framework that governs how organisations protect cardholder data wherever it is stored, processed, or transmitted.

## In depth

PCI DSS is a set of technical and operational requirements published by the PCI Security Standards Council (PCI SSC), a consortium founded by American Express, Discover, JCB, Mastercard, and Visa. It applies to any organisation that stores, processes, or transmits payment card data — merchants, payment processors, issuers, acquirers, and their service providers. Version 4.0 became the sole active standard in April 2024. PCI DSS does not explicitly address generative AI tools, but its existing requirements cover any system or process that touches cardholder data (CHD) or sensitive authentication data (SAD). Pasting a primary account number (PAN), a CVV, or a full transaction record into ChatGPT, Claude, or Gemini almost certainly violates multiple PCI DSS requirements: it transmits CHD outside the cardholder data environment (CDE), to a service provider with no PCI-aligned contract, with no evidence of scope assessment or security controls. Requirement 12.8 extends PCI obligations to service providers, and Requirement 12.3.4 requires annual reviews of all technology — including AI tools used by staff who handle CHD.

## Examples

- A developer pasting a test PAN into GitHub Copilot to debug a Luhn-check function — CHD is now on a third-party server with no PCI-compliant agreement.
- A fraud analyst attaching a transaction CSV export to a ChatGPT session to identify anomalies — the full CSV contains real PANs.
- A payments engineer using a coding assistant with codebase indexing enabled on a repository that contains real card-range test data.

## How Locke handles pci dss

Locke detects Luhn-valid card numbers (PANs), CVVs, track-data patterns, and transaction identifiers locally before any prompt leaves the device. For payments engineering teams, this provides a technical control that reduces the risk of CHD escaping the CDE through the AI prompt path — the control gap PCI DSS v4.0's customised approach allows organisations to address with novel mechanisms.

[See the product](https://sonomos.ai/locke/)

## Related terms

- Data Loss Prevention (DLP)

  A category of security tooling that inspects outbound data flows to prevent sensitive content from leaving an organisation's control.
- Personally Identifiable Information (PII)

  Any information that can identify a specific person, either directly (name, SSN) or in combination with other data (zip code + birthdate).
- Shadow AI

  Employees using AI tools at work without organisational sanction — the AI-era version of shadow IT.

## Reading on this topic

- [PCI DSS and AI: Can You Use ChatGPT With Cardholder Data? (2026 Guide)](https://sonomos.ai/blog/pci-dss-ai-chatgpt-cardholder-data-2026/)