TABLE OF CONTENT
Introduction
The grace period for PCI DSS 4.0 is over. Since 31 March 2025, every requirement in the standard has been in scope for assessment, and every assessment in 2026 is performed against PCI DSS v4.0.1, the only active version.
Yet many organizations still carry gaps. Some validated under v4.0 in 2024 and treated the future-dated requirements as optional. Others moved to v4.0.1 on paper without changing how their controls actually run. Meanwhile, the PCI Security Standards Council (PCI SSC) has already begun work on the next iteration of the standard.
This guide covers what PCI DSS 4.0.1 changed, which requirements assessors now test without exception, what has shifted in 2026, and how to prepare for your next Report on Compliance (ROC) or Self-Assessment Questionnaire (SAQ).
PCI DSS 4.0 vs 4.0.1: what actually changed
PCI DSS 4.0.1 is a limited revision, not a new standard. The PCI SSC published it on 11 June 2024 to correct formatting and typographical errors and to clarify the intent of certain requirements. It added no new requirements and removed none. PCI DSS v4.0 was retired on 31 December 2024.
The clarifications still matter in practice:
- Requirement 6.4.3 now makes clear that the script inventory applies to scripts loaded and executed in the consumer's browser on payment pages.
- Requirement 11.6.1 clarifies that change-and-tamper detection covers security-impacting HTTP headers and the script contents of payment pages.
- Requirement 8.4.2 allows phishing-resistant authentication factors to stand in for multi-factor authentication (MFA) for certain non-administrative access into the cardholder data environment (CDE).
- Requirement 3.3 adds clarity for issuers and companies supporting issuing services.
- Requirement 11.3 adds guidance on the vulnerability management process.
If you need a refresher on the full requirement set, our PCI DSS 4.0 checklist of the 12 most important requirements walks through each one.
The future-dated requirements are now mandatory
PCI DSS 4.0 introduced 64 new requirements. Thirteen applied immediately; the other 51 were best practices until 31 March 2025. Since that date, all 51 are assessed like any other control, with no grace period.
These are the ones that most often surface as findings:
What has changed since the 2025 deadline
The standard itself has not changed since v4.0.1, but the guidance around it has. Five developments shape how PCI DSS 4.0 compliance looks in 2026:
The RFC is the one to watch. It signals that the next version will address AI in payment environments, but it does not pause or soften v4.0.1. Until a new version is published and a transition window announced, v4.0.1 is the standard you will be assessed against.
Not sure which SAQ applies to you after the SAQ A change? Start with our guide to PCI DSS compliance levels.
Targeted risk analysis and the customized approach
PCI DSS 4.0 gives you flexibility, but only if you can document why. That documentation is where many 2026 assessments stall.
Targeted risk analysis (TRA). Requirement 12.3.1 asks for a TRA wherever a requirement lets you set your own frequency, such as how often you review payment pages under 11.6.1 or certain logs under 10.4.2.1. A sound TRA names the assets, the threats, the likelihood and impact, and why the chosen frequency fits. "Low risk, review annually" is not a TRA.
Customized approach. Mature organizations can meet a requirement's objective with their own control instead of the defined one. Each customized control needs its own TRA under 12.3.2, a controls matrix, and evidence your assessor can test. It suits complex cloud and AI-driven environments, but it raises the documentation bar rather than lowering it.
An independent information security risk assessment is a practical way to build the evidence base both approaches depend on.
Your PCI DSS 4.0.1 readiness checklist for 2026
Use these steps to close gaps before your next assessment:
- Confirm the version. Make sure your QSA, ROC template and SAQ all reference v4.0.1.
- Re-scope. Map every place card data is stored, processed or transmitted, including shadow data in logs and backups.
- Close the future-dated gaps. Treat the 51 requirements in the table above as audit-critical, not aspirational.
- Lock down payment pages. Inventory and authorize every script, and deploy tamper detection on checkout pages.
- Test like an attacker. Run authenticated internal scans, quarterly PCI ASV scans and annual network penetration testing.
- Write your TRAs. Document a targeted risk analysis for every requirement where you set the frequency.
- Govern third parties. Confirm which PCI DSS requirements each service provider owns, and review them through a third-party risk program.
- Rehearse incident response. Test your plan, and include how you would preserve evidence for a forensic investigation.
- Make it continuous. Track control health all year, not in the eight weeks before the audit.
How SISA helps you stay PCI DSS 4.0 compliant
SISA has worked in payment security since 2006 and is among the first organizations globally certified as a PCI QSA. That gives us two vantage points: we assess against PCI DSS, and as a PCI Forensic Investigator, we investigate payment breaches when controls fail. That forensic insight, captured in our Digital Threat Report 2025-26, shapes how we test your controls against real attacker behavior.
Whether you need a v4.0.1 gap assessment, a QSA-led ROC, PCI S3 assessments for your payment software, or continuous compliance through SISA Pulse, our team keeps you audit-ready all year.
Frequently asked questions
What is the current version of PCI DSS in 2026?
PCI DSS v4.0.1 is the only active version. PCI DSS v4.0 was retired on 31 December 2024, and v3.2.1 on 31 March 2024.
Is PCI DSS 4.0 different from PCI DSS 4.0.1?
Only slightly. Version 4.0.1 corrects errors and clarifies guidance. It adds no new requirements and removes none, so your PCI DSS 4.0 program carries over.
Are any PCI DSS 4.0 requirements still optional?
No. All 51 future-dated requirements became mandatory on 31 March 2025 and are tested in every 2026 assessment.
Is a PCI DSS 5.0 coming?
The PCI SSC ran a request for comments on v4.0.1 from 3 June to 20 July 2026 to shape the next iteration. No new version or date has been announced, so plan against v4.0.1.
Does PCI DSS apply to AI systems?
Yes. Any system that stores, processes or transmits cardholder data, or can affect its security, is in scope, including AI agents and chatbots in payment flows.
For more answers, see our PCI DSS 4.0 FAQ guide for 2026.