Compliance tools · Cybersecurity and data protection

PCI DSS compliance tool

PCI DSS v4.0.1 · European Union and United Kingdom · Contractual standard

Name anyone on your staff. The system makes them your compliance person.

A member of your own staff, with no compliance background, reads the training module, answers the interview, and finishes with your PCI DSS documentation cited article by article. The knowledge stays in the business.

Every account level runs inside a dedicated Claude account. Anyone can try a toolkit in their own Claude account; compliance work runs in a dedicated one. The Claude Max plan is £90 a month, paid to Anthropic, and is not included in any level.

See a finished report before you pay

PCI DSS v4.0.1 is a contractual standard in the European Union and United Kingdom. Payment card data security standard, mandatory under card acquirer contracts when accepting cards.

The free assessment screens for PCI DSS when a business accepts card payments.

Screen your business against all 116 agent toolkits, free →

• Your exact position under PCI DSS: what is in place, what is missing, and what to do about each gap.
• Documentation with article citations, ready for auditors, insurers, customers and public buyers.
• A trained person inside the business who understands what the regulation requires, and stays.
• A dated record of every section completed, with the reports themselves staying in your own Claude account. The toolkit is carried by an account level, see the plans.
• All of it completed in-house, at your own pace, without booking a single meeting.

Check that PCI DSS applies to your business, free →

Does PCI DSS apply to my business?

PCI DSS applies to you if your business stores, processes, or transmits cardholder data or sensitive authentication data from any of the five founding card brands: Visa, Mastercard, American Express, Discover, and JCB. It is a contractual standard, so it binds you when you accept payment cards under your acquiring bank agreement.

Who does PCI DSS apply to?

It applies to all entities that store, process, or transmit cardholder data or sensitive authentication data, including merchants, service providers, acquirers, issuers, and processors. Merchants are entities that accept payment cards bearing the logos of any founding payment brand as payment for goods or services.

Does PCI DSS apply to a small business?

PCI DSS has no size threshold. The standard applies to all entities that store, process, or transmit cardholder data or sensitive authentication data, regardless of size, transaction volume, or geography. Only the validation method varies, with most SMEs completing a Self-Assessment Questionnaire rather than a full Report on Compliance.

When does PCI DSS apply from, and what are the deadlines?

PCI DSS has no fixed legislative compliance date. Validation is annual, external vulnerability scans by an Approved Scanning Vendor are quarterly, internal vulnerability scans are quarterly, and penetration testing is at least once every twelve months. All future-dated v4.0 requirements became mandatory on 31 March 2025.

What does PCI DSS require me to do?

You must meet the twelve numbered requirements covering network security, secure configuration, stored data protection, transmission encryption, malware protection, secure development, access control, authentication, physical security, logging and monitoring, security testing, and information security policy. You must also validate compliance annually and submit an Attestation of Compliance to your acquirer or payment brand upon request.

What records or documents does PCI DSS require me to keep or produce?

You must keep documented evidence of your outsourcing arrangements and validate your reduced scope where you have outsourced card data functions. You must document and confirm your PCI DSS scope at least annually with network diagrams, data flow diagrams, and justification for out-of-scope components (Requirement 12.5), and maintain a list of third-party service providers (Requirement 12.8).

What happens if I do not comply with PCI DSS?

Card brands may levy fines on acquiring banks for non-compliant merchants, typically ranging from USD 5,000 to USD 100,000 per month, and acquiring banks pass these fines to merchants under the merchant agreement. Non-compliance can also bring increased transaction fees, mandatory forensic investigation at your expense, and termination from card brand programmes, which means loss of the ability to accept payment cards.

Does PCI DSS apply to a UK business selling into the EU?

PCI DSS is global and applies wherever payment card transactions are processed or card data is handled, so a UK business selling into the EU is covered on the same terms as anywhere else. There is no single governing jurisdiction, and the standard is imposed through merchant and service provider agreements worldwide.

Does PCI DSS apply to an EU business selling into the UK?

An EU business selling into the UK is covered because PCI DSS applies wherever payment card transactions are processed or card data is handled. The standard is global and contractual, imposed by the payment card brands worldwide through merchant and service provider agreements.

How is PCI DSS different from SOC 2?

A SOC 2 report does not substitute for PCI DSS validation, and that PCI DSS compliance does not satisfy SOC 2, though the PCI SSC has identified areas of overlap around availability, security, and confidentiality.

How do I start complying with PCI DSS?

Start by documenting and confirming the scope of your PCI DSS assessment, which requires network diagrams, data flow diagrams, and documented justification for any system components classified as out of scope (Requirement 12.5). Then establish the information security policy required by Requirement 12.1.

Which ComplianceSME account includes the PCI DSS toolkit?

The PCI DSS agent toolkit is included from the Small level.

Related in cybersecurity and data protection: GDPR · ePrivacy Directive · NIS2 Directive · CER Directive