What happens when a PAN reaches a chatbot.

That path is usually well controlled. It happens around the edges, and in every case the intent is to do the job faster, with the card data incidental to the question being asked.

The Luhn checksum eliminates most random 16-digit strings. BIN ranges confirm the number belongs to a real issuer range. The format is stable across contexts and formatting variants.

That reliability has a practical consequence: card numbers are the right place to start blocking rather than warning. When you begin enforcement with detectors that are effectively never wrong, you build trust in the control instead of training people to dismiss it.

Sensitive authentication data is a higher severity. CVV, CVC, PIN blocks and full track data must never be stored after authorisation, so their appearance in a prompt is more serious than a PAN alone, and policy should block them unconditionally, including to sanctioned destinations, because there is no configuration in which storing them is acceptable.

A tool that transmits prompt content to a vendor cloud for inspection would be sending cardholder data to another party: potentially expanding your assessed environment to include your security vendor.

Itzal’s detection runs on the endpoint. What leaves is a finding type, a count, a confidence, a masked snippet, a destination and a risk score. The PAN never reaches Itzal’s infrastructure, so Itzal’s infrastructure never enters the conversation with your QSA.

Exception-list your known test card numbers so developers are not blocked by fixtures. Review the block rate weekly for the first month, and treat a rising trend in one team as a process problem in that team rather than a detection problem.

Scope is the part of PCI DSS that costs money, and it is decided by where account data goes rather than by where you intended it to go.

Any system component that stores, processes or transmits cardholder data is in scope, along with anything connected to it. A support agent pasting a primary account number into an AI assistant has, at that moment, made their workstation a system that transmits account data to a third party that is almost certainly not a validated service provider. That is a scope question and a disclosure question at once, and neither is answered by the fact that nobody intended it.

The practical consequence is that keeping account data out of prompts is a scope-reduction control, which is a better conversation to have with a finance team than a compliance one. The honest limit: we can tell you that a PAN was detected and prevented from leaving a device, and that is evidence of a control operating. Your QSA decides what is in scope, and a detection tool does not make that determination for them.

Payment flows are the part of this that is already controlled, which is why the leak is almost never there.

The pattern that recurs is support. An agent handling a dispute has a transaction in front of them and an assistant that drafts a better reply than they would write at four in the afternoon, so the transaction goes into the prompt. The same happens in chargeback handling, in reconciliation when somebody asks an assistant to make sense of a statement, and in engineering when a production log containing a full number is pasted in to ask what the error means.

Each of those is somebody doing their job well with the tool in front of them, which is why a punitive framing fails here specifically. The control that works is one that fires at the moment of sending and names what it found, and the policy that works is one that gives those teams an assistant they are allowed to use.

The requirement an AI assistant touches most directly is the one about not sending unprotected primary account numbers over end-user messaging technologies. A prompt is exactly that kind of channel.

What satisfies an assessor is evidence that the control operated across the period: a record showing account data was detected and stopped, the policy that defines it, and the ability to say which destinations were involved. A record of categories and counts does this without becoming a second store of account data, which matters because an archive of detections containing the numbers themselves is new in-scope storage you would then have to protect.

The limit is the usual one and worth putting plainly: your QSA decides scope and sufficiency. A product supplies evidence; it does not make the determination, and any vendor saying otherwise is selling something they cannot deliver.