Extract from Cellbrite’s article, “Will iOS 26 Cause Your Mobile App to Fail PCI Compliance?”
iOS/iPadOS 26 introduces a new challenge for PCI DSS mobile app security testing. No current physical devices running 26 can be jailbroken, which removes the deep visibility teams rely on to verify how mobile apps handle sensitive data at rest and in transit. Without runtime evidence, organizations struggle to prove that mobile apps meet PCI, GDPR, DORA and other data protection requirements across the markets where they operate.
The short answer: iOS 26 does not automatically fail your app for PCI compliance, but it closes off jailbreak-based runtime testing on physical devices. To keep producing the runtime evidence PCI DSS v4.0.1 assessors expect, teams need virtualized iOS environments that restore deep inspection access.
