ISO/IEC 27505
ISO/IEC 27505 — Information security, cybersecurity and privacy protection — Privacy in brain computer interface (BCI) applications
[DRAFT]
Abstract
[ISO/IEC 27505] "provides requirements and guidelines on privacy for Brain Computer Interface Applications. It provides privacy controls specific to the data collected or inferred by Brain Computer Interface Applications to address the privacy risks based on the principles described in ISO/IEC 29100."
[Source: Committee Draft]
Introduction
'Brain-Computer Interface' refers to cutting-edge telepathic technologies such as brain implants to control smart prosthetic devices and receive information from sensors and systems directly into the brain.
This standards development project falls under ISO/IEC JTC 1/SC 27 Working Group 5.
Scope
The standard will address:
the privacy aspects of the intimate Brain-Computer Interface (e.g. the possibility of someone illicitly monitoring/intercepting and exploiting sensitive personal datacommunications), rather than broader information and cyber security aspects (e.g. actively manipulating, faking or interrupting the comms or introducing malware).
BCI applications i.e. the software elements of computer systems, devices or equipment using BCI, as opposed to, say, the hardware and procedural aspects, or indeed the medical element and biotech in general.
That's not to say those other areas won't even be mentioned, and changes are entirely possible as the standard is drafted.
Structure
Main clauses [from the Committee Document]:
5: Classification of BCI
6: Use cases
7: Privacy in the context of BCI
8: Privacy threat modelling
9: Privacy attacks in BCI applications
10: Privacy requirements and controls
Annex A: Typical applications (use cases) of BCI
Annex B: Case studies
Annex C: Transparency and explainability
Status
ISO/IEC JTC 1/SC 27/WG 5 agreed to develop this standard in December 2025. The early drafts were initially numbered ISO/IEC 27574.
The Committee Draft was released for comment in October 2026.
Allowing a year for formal committee comments, revision and approval, followed by ISO processing, publication may happen in 2027, more likely in 2028.
Commentary
Addressing privacy at the early stages of such technological developments demonstrates the principle of 'security by design', particularly if the committee is able to offer constructive guidance to this nascent field on how to treat the associated information risks (ideally, not just privacy risks!).