There is a part of assessment work that almost everyone would like to move through faster: organizing evidence, reviewing documents, writing work papers, and turning technical findings into a report someone can actually follow.

AI can help with that. I see real value in using it to reduce repetitive work and give assessors more time to investigate the things that deserve their attention.

But I keep coming back to one question: If someone challenges the conclusion, can you walk them through the evidence and explain how you got there?

That question matters whether you wrote every sentence yourself or used AI to help draft it.

The PCI Security Standards Council’s March 2025 guidance, Integrating Artificial Intelligence in PCI Assessments, establishes boundaries for that use. It describes how AI can support assessment activities while keeping responsibility with the human assessor and the assessor company. It also makes clear that the guidance does not change the security requirements being assessed.

My takeaway is straightforward: a faster workflow still needs a defensible result.

A policy can say the right thing and still leave you with work to do

Consider a hypothetical example. An assessor uploads an access control policy into an approved AI tool. The tool identifies language covering account reviews, access approval, and account removal. It produces a clean summary that sounds aligned with the relevant requirements.

That is a useful starting point. Now the assessor needs to establish what actually happens.

Which systems does the process cover? Who performs the reviews? What evidence shows they happened? How are exceptions handled? Does the practice match the policy?

Finding language in a document answers a different question from determining whether a control is implemented and operating as required.

PCI’s guidance allows AI to help review artifacts and identify potential concerns. It reserves final compliance decisions, complex interpretations, and context-specific judgments for the assessor. AI also cannot perform inspections or on-site evaluations or authorize the release of final reports.

That distinction needs to remain visible throughout the engagement. Otherwise, a preliminary observation can quietly become a conclusion nobody actually tested.

The client’s AI dashboard needs independent examination too

The same issue applies when the organization being assessed uses its own AI tools.

A dashboard may indicate that evidence is complete or that a control is satisfied. That output can help organize the conversation. The assessor still has to perform independent sampling, examinations, and interviews in accordance with the applicable PCI testing requirements.

I would want to understand the evidence behind the status, the systems covered, the period represented, and any exceptions the tool may have missed.

For organizations investing in automated compliance platforms, this is an important expectation to set early. A tool can make evidence easier to collect and review. The assessment still requires someone to establish what that evidence supports.

Client consent belongs before the upload

Before using AI with customer data, the guidance says assessors should declare how they intend to use it and obtain client consent.

That conversation needs enough detail for the client to make an informed decision. Which tasks will AI support? What data will it process? What models and data transfers are involved? How will outputs be checked? What happens to the information afterward?

Think about what can sit inside an assessment folder: network diagrams, configurations, logs, interview notes, and findings that describe weaknesses in the environment. Even when an artifact contains no cardholder data, it can still expose sensitive information about the organization.

My practical recommendation is to make AI use part of engagement planning and evidence handling. Assessors should know which tools and uses are approved before they start moving client information through them.

The guidance also draws a clear boundary around training. Assessment evidence is shared to support compliance or conformance validation. It should not quietly become training material for an AI system or large language model. The document calls for contractual restrictions on sensitive assessment data in training datasets and clear assurances to clients about training use and explicit authorization.

Treat that as a data governance decision with real consequences.

Human review needs to go deeper than proofreading

One of the most useful distinctions in the guidance is between quality assurance for AI outputs and quality assurance for the final assessment report.

Those are separate activities.

AI output validation asks whether the tool produced an accurate, complete, and reliable result. Report review asks whether the final document accurately represents the assessment and meets the applicable reporting and program requirements.

A report can read beautifully while overstating the evidence.

For example, imagine an interviewee says, “We are working toward quarterly reviews.” An inaccurate summary might turn that into, “Access reviews are performed quarterly.” The sentence is clear. The meaning has changed. A future intention has become an established practice.

That is why reviewing an AI summary means returning to the source. Check the interview record. Check the supporting artifacts. Confirm that the statement preserves the limits of what was actually established.

PCI also says AI output accuracy should be validated independently by a qualified person who did not code or develop the tool. And the reviewer needs expertise appropriate to the output: a generated network diagram, for example, needs someone qualified to evaluate its technical accuracy and completeness.

My view is that a useful review should leave the assessor able to explain what was checked, what was corrected, and why the remaining content is trustworthy.

Approve the use case, then validate the tool

An AI tool that summarizes policies well may still struggle with configurations, logs, or network diagrams.

The guidance recognizes this by calling for assessor companies to define the evidence types AI can process and limit its use to types they have tested and approved. It also addresses benchmarking, tool selection, security, retention, deletion, ongoing validation, and updates as standards and assessment criteria change.

I would start with a limited use case, test it against known results, and document the review process before expanding it. If the model or workflow changes, reassess whether the earlier validation still supports the intended use.

The Council also states that it does not endorse, recommend, or qualify specific AI products or services for PCI assessments. Selecting a tool remains a due diligence responsibility for the assessor and assessor company.

The opportunity is better assessment work

I see room for AI to improve assessment work: less time sorting information, better organization of evidence, clearer drafts, and more attention available for investigation.

Realizing that value takes discipline. The lead assessor and assessor company remain accountable for the outcome, including quality issues introduced by AI.

For those of us working in GRC, the practical lesson is to keep the connection between evidence, testing, judgment, and reporting intact. Every improvement to the workflow should strengthen that connection.

Before accepting an AI-assisted conclusion, ask: Can I identify the evidence, explain the testing, and defend this statement in the context of this organization?

If you can, AI has helped you do the work. If you cannot, there is still assessment work to do.

---

Based on PCI SSC’s March 2025 guidance, Version 1.0. Examples are hypothetical; practical recommendations reflect my interpretation of the guidance.