PCI DSS 4.0 introduced 64 new requirements compared to version 3.2.1. Two are particularly relevant for teams running AI-assisted payment APIs: Requirement 6.4.3 (script integrity on payment pages) and Requirement 11.6.1 (monitoring for unauthorised modifications to payment interfaces). Both target web-skimming attacks — and both require controls that most teams do not currently have.
Requirement 6.4.3: Script Integrity
All scripts on payment pages must be authorised, have integrity checked, and have their impact on security assessed. Practically: every JavaScript file, including third-party analytics, chat widgets, and AI assistant scripts, must be inventoried. CDN-hosted scripts must use Subresource Integrity (SRI) hashes. Dynamically generated scripts must be nonce-validated via CSP.
The implication for AI-assisted checkout flows: if you have integrated an AI chatbot or suggestion widget on your payment page, that widget must be inventoried, its scripts must have SRI hashes, and any inline scripts must carry a valid CSP nonce. This is often overlooked when AI features are added to existing payment flows.
Requirement 11.6.1: Change Detection
Organizations must detect unauthorised modifications to HTTP headers and scripts on payment pages. This requires a change detection mechanism that runs at minimum weekly and alerts when unexpected modifications occur. A static site where the HTML is version-controlled satisfies this with a file hash check. A dynamic AI-enhanced payment flow requires more sophisticated monitoring.
The Customised Approach
PCI DSS 4.0 introduces a "customised approach" that allows organizations to implement controls in ways not explicitly defined by the standard, provided they can demonstrate equivalent risk reduction. This is relevant for AI systems that do not neatly map to traditional compensating controls — you can document a bespoke AI-specific control and have it assessed by a QSA.
If you added an AI assistant to your checkout page after your last PCI assessment, that script may not be in your script inventory and may not have SRI hashes. Requirement 6.4.3 is now mandatory — QSAs are actively looking for unlisted scripts on payment pages.