Compliance
PCI DSS and AI: keeping card numbers out of prompts and out of scope
Short answer
Under PCI DSS, any system that stores, processes or transmits cardholder data is in scope. A full card number pasted into ChatGPT or sent to an LLM API pulls that provider into your assessment. Keep PANs out: mask them to the last four digits, never send CVVs, and you avoid making an AI vendor part of your cardholder data environment.
A customer writes in at 9 p.m.: my card 4532 7781 0021 9047 was charged twice, CVV on the back is 123, please fix it. A support agent forwards the whole thread to an AI assistant to draft an apology. In one paste, a full PAN and sensitive authentication data have gone to a system your QSA has never heard of.
PCI DSS doesn't mention ChatGPT, and it doesn't need to. Its scoping rules already cover it. This page explains what the current standard says, why card data in prompts is a scope problem before it's a security one, and what Maskflare's PCI DSS profile does about it. Dates are as of October 2026.
Which version of PCI DSS applies in 2026?
PCI DSS v4.0 was published in March 2022 and v3.2.1 was retired on 31 March 2024. PCI DSS v4.0.1, a limited revision that clarified wording without adding requirements, was published in June 2024, and v4.0 was retired at the end of 2024. The requirements v4.0 marked as best practice until a future date became mandatory on 31 March 2025. As of October 2026, v4.0.1 is the version assessors test against, and every requirement in it is in force.
Why do card numbers in prompts bring AI tools into scope?
PCI DSS applies to the cardholder data environment: the people, processes and systems that store, process or transmit cardholder data or sensitive authentication data, plus anything connected to them. Send a full PAN to an LLM API and the provider now transmits and, depending on its retention, stores cardholder data for you. It becomes a third-party service provider under Requirement 12.8, which means due diligence, a written acknowledgment of responsibility and evidence of its own PCI DSS compliance.
Few general-purpose AI services are built or offered as part of a cardholder data environment. Rather than asking an AI provider for an attestation it may not have, keep the PAN from ever arriving. Requirement 12.5.2 asks you to confirm your scope at least once every 12 months, and an AI tool that receives PANs will show up there sooner or later.
What does PCI DSS say about masking and sensitive authentication data?
| Requirement | What it says | Why it matters for AI |
|---|---|---|
| 3.3.1 | Sensitive authentication data (full track data, card verification codes, PINs) isn't stored after authorization, even encrypted | A CVV in a prompt that a provider retains is stored SAD. It must never be sent |
| 3.4.1 | PAN is masked when displayed, showing no more than the BIN and last four digits unless there's a documented business need | The model drafting a reply needs at most the last four digits |
| 3.4.2 | With remote-access technologies, technical controls prevent copying or relocating PAN except for explicitly authorized people (future-dated, mandatory since 31 March 2025) | Copying PANs into tools outside the CDE is exactly what it targets |
| 3.5.1 | PAN is rendered unreadable anywhere it's stored | Prompts or logs held by an AI provider are storage |
| 12.5.2 | Scope is documented and confirmed at least every 12 months | AI tools that touch PAN must appear in that review |
| 12.8 | Third-party service providers with access to cardholder data are managed | An AI provider receiving PANs becomes one |
What does the Maskflare PCI DSS profile do?
The PCI DSS profile sets two rules plus the credentials pack. Card numbers are kept to their last four digits with the partial action, so the model sees ************9047 and can still say which card it's talking about. Card security codes are masked with a token, so the CVV never reaches the provider. The credentials pack catches API keys and other secrets that tend to show up in the same support threads and logs. Like every profile, it's a floor: if a rule already blocks card numbers, it keeps blocking them.
Before: My card 4532 7781 0021 9047 was charged twice, CVV 123.
Sent: My card ************9047 was charged twice, CVV mf_mask_91fe....You can go stricter. Block requests that contain a card number outright, which suits teams that should never handle PANs in AI workflows. Use format-preserving encryption (FF1) when a downstream system needs a value that still looks like a card number. Or use keyed hashing per organization when you need to match the same card across records without revealing it. One thing to know about partial masking: the hidden digits are dropped, not tokenized, so they can't be restored in the answer. That's usually what you want for card data.
Is the masking layer itself in scope?
Yes, if PANs pass through it, and we'd rather say so plainly. Maskflare sees the card number before masking it, so it transmits cardholder data and belongs in your scoping. Prompts and responses aren't logged or stored, which helps, but it's your QSA's call how that's assessed. For teams that want the masking step inside their own boundary, on-premises deployment is available for enterprise. Maskflare isn't a PCI DSS validated service provider; its SOC 2 Type II and ISO 27001 audits are in progress.
PCI DSS requirements, what Maskflare does, and what stays your job
| Requirement | What Maskflare does | What stays your job |
|---|---|---|
| Keep SAD out (3.3.1) | Masks CVVs before the provider; can block instead | Train agents never to ask for or forward CVVs |
| PAN display (3.4.1) | Shows the model only the last four digits | Document any business need for more |
| Prevent PAN relocation (3.4.2) | Masks PANs typed or pasted into ChatGPT, Claude, Gemini, DeepSeek and Perplexity in the browser | Cover remote-access tools and other channels |
| Scope (12.5.2) | Keeps AI providers from receiving PANs; console shows which tools send traffic | Include the masking layer and AI tools in your scope review |
| Third parties (12.8) | Avoids adding AI providers as card-data service providers | Manage Maskflare itself as a provider if PANs pass through it |
| Logging and monitoring (Req. 10) | Audit export of metadata up to 366 days, signed webhooks | Your own logging and review |
A practical checklist
- Find where card numbers enter AI workflows: support tickets, chat transcripts, call notes, logs, spreadsheets.
- Start the PCI DSS profile in shadow mode for a week to measure, then switch it to enforce.
- Decide per channel between last-four, block, FPE or hash. Block is the simplest answer for staff chat.
- Never send CVVs. Make that a block rule if support agents shouldn't see them either.
- Cover voice separately: in realtime voice sessions, text events are masked but audio isn't, so spoken card numbers need another control.
- Add the masking layer and any AI tools to your annual scope confirmation and your third-party list.
- Tell your QSA how it works before the assessment, not during it.
Limits worth knowing
Card detection uses checksums and patterns, so a PAN split across lines or written as words may slip past. Images of cards aren't read unless you turn on OCR for API image uploads, which is optional and English only. And masking doesn't change your obligations for the systems that legitimately hold card data. It keeps them from spreading into tools that never should.
Frequently asked questions
Is it a PCI DSS violation to paste a card number into ChatGPT?
It brings ChatGPT's provider into your scope as a system that transmits or stores cardholder data, which you're then obliged to manage under Requirement 12.8. Pasting a CVV is worse: sensitive authentication data must never be stored after authorization.
When did the PCI DSS v4.0 future-dated requirements take effect?
On 31 March 2025. Since then every requirement in PCI DSS v4.0.1 is mandatory, including 3.4.2 on preventing copying or relocation of PAN over remote access.
How many digits of a card number can be shown?
Requirement 3.4.1 allows at most the BIN and the last four digits on screens and reports unless there's a documented business need. Maskflare's profile goes further for AI and keeps only the last four.
Can masked card numbers be restored in the answer?
With partial masking, no: the hidden digits are dropped. If you need reversibility, use token masking or format-preserving encryption, keeping in mind the masking layer is then in scope.
Does masking take the AI provider out of PCI scope?
If the provider only ever receives the last four digits and no SAD, it isn't receiving cardholder data in the PCI sense. Confirm the scoping decision with your QSA, and remember the masking layer itself handles the full PAN.
About the author
Articles on GDPR, the EU AI Act and sector rules, written by the people at Maskflare who answer customers' data protection questions. They're general information, not legal advice; we cite the regulator or the provider's own terms wherever we can.