Why AI Use Matters Under PCI DSS
A card number pasted into an AI chat sends cardholder data to a system outside the assessed environment. That widens PCI scope to a vendor nobody assessed, and leaves no record of where the number went.
Controls ProctoredAI Evidences
| Control | Evidence in the Monthly Report |
|---|---|
| Req. 3 / 12.5.2 Cardholder data scope | Card data blocked from leaving the CDE via AI services. |
| Req. 10 Log and monitor access | AI activity logs retained per tenant retention policy. |
| Req. 9.4 Media with cardholder data | Card data stopped from leaving on removable media; media use logged. |
Each client's report lists these controls with a status. Evidenced means the mechanism produced records in the period; Active means it is enforced with nothing to record; Not configured means the feature is off for that client.
Policy Packs Applied
Selecting PCI DSS for a client applies these packs in one step:
- PCI DSS — Cardholder Data. Block card numbers; redact bank details.
- Personal Data (GDPR/GLBA). Redact government IDs; warn on bulk contact data.
The Setup Checklist
Some steps live outside the policy rules. The console hands the provider this list:
- Block card numbers in prompts and uploads to AI apps (the PCI DSS pack does this)
- Turn on removable-media control under Data Protection
What the Auditor Receives
- A monthly AI Governance Report for the client, stored with a SHA-256 digest so the copy an auditor holds can be matched to the console.
- An evidence bundle with every non-usage event in the period, the client's audit-log entries and the head hash of the audit chain.
- The AI Use Policy generated from the client's real configuration, with each employee's acknowledgment and version.
AI Apps to Decide On First
Questions
Is pasting a card number into an AI tool a PCI DSS issue?
Yes. Cardholder data then leaves the cardholder data environment for an unassessed service. ProctoredAI detects card numbers with checksum validation and blocks them in prompts and uploads on the device.
Can bank details be removed instead of blocked?
Yes. The PCI DSS pack blocks card numbers and redacts bank account and routing numbers, so the rest of the message still goes through.
What evidence does a QSA get?
The monthly report's control-evidence section lists each PCI DSS control on this page with its status, and the stored report carries a SHA-256 digest that ties it to the console record.
ProctoredAI supports a client's compliance program; it does not by itself make a client compliant, and it is not legal advice. All frameworks · The MSP AI governance guide