PCI DSS applies to any system component that stores, processes or transmits cardholder data, and to anything that could affect the security of the cardholder data environment. The standard says nothing about AI agents, because it doesn't need to. If a card number passes through your agent's context window, then that agent, its traces and whichever model provider they run through are all in scope, and your next assessment gets considerably more expensive.
So start with scope. The compliance questions only make sense once you know which of your systems the standard is pointing at.
What puts an agent in scope?
Almost nothing you do on purpose. It's the persistence you get for free.
Your agent framework logs prompts and completions so you can debug them. Your tracing layer records tool calls with their arguments. Something writes conversation memory to a vector store so the next turn has context, and most teams pipe all of it through a third-party observability platform. Put a PAN anywhere along that path and you have written cardholder data into systems you don't operate and probably haven't scoped.
[PCI DSS v4.0.1](https://www.pcisecuritystandards.org/document_library/) closes the obvious escape route. The v4.0.1 clarification to Requirement 3.5.1 covers PAN held in non-primary storage and names audit logs specifically, so a card number sitting in a trace is stored account data. Requirement 3.3.1 is stricter again: sensitive authentication data, the CVV among it, can't be retained after authorization at all, encrypted or not. An agent that reads a CVV and carries it three turns further in context has already broken that one.
The uncomfortable part is what comes next. Your model provider is a system component.
Does the PCI Council have anything to say about AI?
One document, and its subject is your auditor.
The Council published [Integrating Artificial Intelligence in PCI Assessments](https://blog.pcisecuritystandards.org/new-guidance-integrating-artificial-intelligence-into-pci-assessments) on 17 March 2025. It lets assessors use AI for document review, work papers and report drafting, and it's blunt about the limit: AI is a tool, not an assessor. Assessors have to disclose that they used it and get the client's consent first.
That is the entire official position on AI. It governs how your Report on Compliance gets written. It says nothing about an autonomous agent holding a card, and nobody has announced an agent-specific annex. You're applying a scope rule written in 2004 to software that didn't exist when it was drafted, and so is your QSA.
Two ways to keep the agent out of scope
Both work. They solve opposite directions of money flow.
| | Agent collects a payment | Agent spends money |
|---|---|---|
| The situation | a customer gives card details to a conversational agent | an agent buys something on a user's behalf |
| The approach | a certified layer captures the card; the agent sees status and last four | the user's instrument never enters the flow; the agent gets a scoped credential |
| Who does it | [Sierra](https://sierra.ai/blog/payments), which announced Level 1 certification for its conversational platform in April 2026 | [Stripe Issuing](https://docs.stripe.com/issuing/elements), Shatale |
| Where the obligation lands | the certified capture layer | whoever owns the card programme |
That last row is the one people skip.
Stripe Issuing Elements renders card details inside Stripe-hosted iframes, so a PAN never touches your servers. That does cut your scope. But it stays your card programme: you're the cardholder, you hold the merchant relationship, and the residual obligations are yours to validate every year.
Shatale buys in its own name for your account, the commissionnaire à l'achat arrangement set out in article L132-1 of the French Commercial Code. The card is ours. The buyer of record at the merchant is us. Your users' instruments were never in the flow to be scoped, and neither was ours.
What does Level 1 get you?
You get an audit instead of a form.
Most PCI validation runs on a self-assessment questionnaire. Level 1 is an assessment by a Qualified Security Assessor that produces a Report on Compliance, repeated every twelve months. [Visa requires](https://corporate.visa.com/en/resources/security-compliance.html) issuers and acquirers to confirm their service providers' compliance on that same annual cycle. One is a vendor's claim about itself. The other has a third party's signature on it.
Shatale certified PCI DSS Level 1 in July 2026 — assessed by Compliance Control Ltd. against v4.0.1, full assessment, nothing excluded from scope. Your user's own card never enters the agent's flow. The agent transacts on a card Shatale issues and holds as cardholder, capped at the amount authorised for that purchase and bounded by the window it is leased for. The credential is released only to the integration that owns that purchase, and every release is written to an access log before it is handed over. The [prompt-injection threat model](/blog/prompt-injection-payment-threat-model) covers what a compromised runtime can and cannot reach.
Security reviewers ask for the ROC and its scope rather than the badge. [The checklist your CISO will ask for](/blog/ai-agent-security-compliance-checklist) covers the rest of that conversation.
What to ask
- Which of my systems does your integration put inside the CDE?
- Does any card number reach my application, my logs, or my model provider?
- Who is the cardholder on the card programme, and who validates it each year?
- Can I see the Report on Compliance and the scope it covers, not the AOC summary?
FAQ
Does PCI DSS apply to AI agents?
Not by name. PCI DSS scopes system components that store, process or transmit cardholder data, or that could affect the security of the CDE, and an agent runtime qualifies on exactly the same terms as any other software. Whether card data reaches it is the question that decides.
Has the PCI Security Standards Council issued guidance on AI?
One document: Integrating Artificial Intelligence in PCI Assessments, published 17 March 2025. It addresses assessors using AI during an assessment, not merchants or service providers deploying agents. Its central rule is that AI is a tool, not an assessor.
Can prompt logs really put me out of compliance?
They put you in scope, which is the step before. A PAN written into a trace counts as stored account data under Requirement 3.5.1, whose v4.0.1 clarification names audit logs. Sensitive authentication data such as a CVV can't be retained after authorization at all.
What certifications does Shatale hold?
PCI DSS Level 1, certified July 2026 by Compliance Control Ltd. against v4.0.1 — certificate 3Y89-4IZ7-ONQO, valid to 30 July 2027. Cards are issued through a regulated issuing partner. Shatale holds no payment-institution licence of its own and has not applied for one: the commission-agent model is built so that the regulated activity sits with the issuing and acquiring partners, each under its own licence.
---
The companion piece on [why an AI agent should never hold your card](/blog/why-ai-agents-should-never-hold-your-card) covers the same isolation from the trust side rather than the audit side. Early access is free for publishers.
Shatale is the control layer for AI-agent payments. Its authorization architecture is the subject of European patent application EP26194994.5 (filed; priority 28 July 2026).