PCI DSS v4.0.1 Compliance: Enabling Secure Payment Handling with Enterprise AI Agents

Organizations increasingly look to automate payment-related customer interactions, but strict regulatory requirements have often limited how far automation can extend into these high-value journeys. With independently assessed PCI DSS v4.0.1 compliance for supported deployments on CXone instances, NiCE Cognigy brings secure payment experiences into AI-first customer service across channels. 

For customer service leaders, payment interactions are often among the most valuable moments in the customer journey. They directly impact revenue, customer satisfaction, and operational efficiency. At the same time, they are among the most heavily regulated interactions in contact centers.

The Payment Card Industry Data Security Standard (PCI DSS) is designed to protect cardholder data wherever it is processed, transmitted, or stored. In a contact center context, that means any interaction where a customer speaks, types, or otherwise communicates a payment card information, whether through voice, chat, SMS, or any other channel, is subject to PCI DSS requirements for the systems that handle it.

Extending Automation into High-Value Payment Journeys

With an independently assessed PCI DSS v4.0.1-compliant environment for supported deployments, NiCE Cognigy enables organizations to incorporate secure payment handling directly into AI-powered and agent-assisted customer interactions, helping reduce friction for customers while simplifying the technology architecture required to support secure payment.

This flexibility allows enterprises to design payment experiences around customer preferences rather than channel limitations, supporting seamless journeys across voice, messaging, web, and future engagement channels as customer expectations continue to evolve.

Secure payment collection can be embedded across a variety of customer journeys, including:

• A customer starts an interaction via WhatsApp and receives a link to a secure web app for entering payment data - all within a continuous, connected experience.

• A customer interacts with an AI Agent on webchat and enters payment information directly into an Adaptive Card embedded within the conversation.

• A customer reaches out by phone and receives an SMS link to a secure web app for completing payment entry on their mobile device.

• A customer engages through a web-based voice interaction via WebRTC and can enter payment details in the accompanying chat interface.

• A customer is handed off from the AI to a human agent, with Cognigy AI Agent providing Copilot assistance in the background. Card data is captured through a PCI-compliant method that keeps it out of the AI Agent's transcription and logging; the Cognigy platform and the contact center each maintain their own PCI DSS compliance.
  

Independently assessed PCI DSS controls at the AI interaction layer

The independent PCI DSS assessment evaluated the NiCE Cognigy platform components included within the assessed environment against the 12 PCI DSS requirement categories. Several platform and process elements are especially important for enterprises evaluating PCI-compliant automation:

• No intentional storage of raw cardholder data: Card numbers and CVV values may be processed transiently during supported payment interactions, but the platform is designed to prevent that data from being written to any persistent store – logs, transcripts, analytics, monitoring systems. Where cardholder data is detected in a flow that would otherwise be persisted, it is redacted before storage.
• Encrypted data in transit: Transmission of cardholder data through the platform uses TLS 1.2 or better levels of encryption.
• Access is MFA-enforced across the board. All platform access requires multi-factor authentication. User access and authentication controls are provided through Microsoft Azure Entra ID, which NiCE Cognigy manages as a third-party service provider under PCI DSS Requirement 12.8. No shared accounts exist in the assessed environment.
• Security testing is performed regularly: The assessed environment is subject to internal and external vulnerability scanning and penetration testing in line with PCI DSS Requirement 11.

Scope and Prerequisites

The PCI DSS v4.0.1 assessment applies to NiCE Cognigy deployments operating on CXone instances. The assessed scope includes cloud infrastructure across eight AWS regions in North America, Europe, Asia Pacific, and the Middle East, as well as the application layer, authentication systems, development and deployment practices, employee training, security operations, and incident response processes.

The assessment does not apply to the Cognigy Live Agent application. Organizations should also be aware that components outside the assessed NiCE Cognigy environment may have their own PCI DSS obligations. Depending on the deployment architecture, this includes payment processors, external APIs, LLM providers, STT/TTS providers, call recording storage, and cloud storage under customer control. Customers remain responsible for any storage they configure outside the Cognigy platform.

What this means for enterprises

Many organizations have already identified payment-related interactions as high-value use cases for automation but have been constrained by data security requirements. PCI DSS compliance helps reduce a significant barrier, allowing enterprises to expand AI-powered workflows into areas that were previously difficult to automate.

Simplifying compliance support

While organizations remain responsible for their own PCI DSS obligations, the AI interaction layer is supported by independently assessed controls, helping reduce the scope of controls enterprises need to validate themselves.

Smoother customer experiences

Customers increasingly expect service interactions to be resolved in a single, connected experience, regardless of channel. Reducing unnecessary transfers, enabling secure payment completion in the flow of conversation, and supporting seamless AI-to-human handoffs help create faster, more convenient experiences.

Reduced integration complexity

Enterprises frequently maintain separate IVR infrastructure specifically to handle PCI-scoped payment capture, running it alongside their modern contact center platform rather than within it. Platform-level compliance creates a path to consolidate those environments, reduce vendor footprint, and simplify the architecture required to support secure payment experiences.

A foundation for secure AI-first customer service

The future of customer service is not about automating isolated tasks. It is about enabling customers to accomplish meaningful outcomes from start to finish through intelligent, secure, and connected experiences. PCI DSS compliance is a fundamental building block for enterprise-grade security, governance, and compliance to deliver on that vision.

Download NiCE Cognigy’s PCI DSS v4.0.1 Attestation of Compliance from the Trust Center.