PCI DSS v4.0 and voice AI: keeping cardholder data out of the model

The PCI DSS v4.0 changes that matter for voice AI

PCI DSS v4.0 replaced v3.2.1 as the only effective standard from 31 March 2024, with future-dated requirements becoming mandatory from 31 March 2025. Three changes materially affect voice AI deployments: customised approach (Requirement 12 lets entities meet objectives via non-prescriptive controls if rigorously documented), expanded scope for third-party service providers (Requirement 12.8 and 12.9), and explicit treatment of cardholder data in non-traditional channels.

The headline implication for voice AI: the standard does not contemplate cardholder data flowing through an LLM. There is no exception, no carve-out, and no 'AI annex'. If a PAN reaches the model, the model provider is a Level 1 service provider and the whole call path is in audit scope.

Pause-and-resume DTMF: the only defensible pattern

The standard pattern that keeps voice AI out of PCI scope is pause-and-resume DTMF capture. The AI conducts the conversation up to the point of payment, hands the call to a PCI-scoped capture service that accepts DTMF tones (the customer types card digits on the keypad), then resumes once the transaction is authorised.

Done properly, the AI never hears the digits — neither the audio nor the transcription. The DTMF tones are intercepted upstream of the speech-to-text path, the call is masked to the AI, and the only signal the AI receives back is a transaction outcome (authorised / declined / referred). The pattern has been the standard for human-agent contact centres for over a decade; voice AI inherits it without modification.

• DTMF capture service is a separately attested PCI Level 1 provider
• Audio path to the AI is muted during capture — no STT, no recording
• Tone-suppression is verified by a third-party penetration test, not vendor assertion
• The AI receives only the transaction outcome, never the PAN, expiry, or CVV
• Recording, where retained, is split so the masked period is unrecoverable from the retained audio

What pulls voice AI back into scope

Three deployment patterns silently put the AI back in PCI scope and most procurement teams miss at least one.

First: 'we'll redact the PAN from the transcript after the call'. Redaction after the fact does not reduce scope. The PAN was present in the LLM context at processing time. The model provider, the STT provider, and any logging pipeline are in scope from the moment the digits hit the prompt.

Second: 'the AI reads the digits back to confirm'. Read-back means the TTS provider now handles cardholder data, which expands scope to the TTS and synthesis pipeline. The defensible pattern is for the DTMF capture service to confirm out-of-band (visual confirmation in a web channel, or human-agent confirmation), never the AI.

Third: 'we capture by voice when DTMF fails'. Voice fallback for cardholder data eliminates the scope reduction entirely. If voice fallback is necessary for accessibility, route the call to a PCI-scoped human-agent flow, not to the AI.

Sub-processor and SAQ obligations

Even with pause-and-resume DTMF correctly implemented, the merchant is still responsible for documenting which parties touch cardholder data and obtaining their PCI attestation. Requirement 12.8.5 requires a maintained list of service providers, their PCI scope, and the controls they cover.

For a typical voice AI deployment, the in-scope service-provider list is the telephony carrier (always in scope — they carry the audio), the DTMF capture provider (in scope, with full Level 1 attestation), and the payment gateway. The AI platform, STT, LLM, and TTS providers are out of scope — and their out-of-scope status is documented in the network and data-flow diagrams that accompany the merchant's SAQ.

The SAQ that applies depends on the merchant's payment volume and channel mix; SAQ A or A-EP is typical for properly scoped pause-and-resume deployments. A QSA-led Report on Compliance replaces the SAQ at Level 1 merchant volumes.

Controls QSAs actually test

A QSA reviewing a voice AI deployment for PCI v4.0 will test a recurring set of controls. Knowing the list before the audit is the difference between a clean report and a remediation cycle.