ISO 42001 certification, scoped to the AI you actually run
Trusted by
ISO 42001, three pillars, one operator.
One Canadian team inventories the AI, builds the AI management system, and prepares both audit stages.
Scope the system
Annex A carries 38 controls. A Statement of Applicability decides which of them bind you, and every control you leave out has to be justified in writing.
Build the AIMS
Policy, roles, impact assessment, lifecycle records, data provenance and supplier terms, written so an auditor can follow the AIMS end to end rather than take your word for it.
Prepare both stages
Stage 1 reads your documents. Stage 2 tests whether what you documented actually runs, and the gap between the two can't exceed six months or stage 1 is repeated in full.
Does ISO 42001 AI Management System work the same way in every industry?
No. The ISO 42001 AI Management System work is the same craft in every sector, but the conditions around it are not. In financial services that means OSFI's technology and cyber risk rules; in government, Protected A, B and C data handling; and in defence and aerospace, controlled goods rules, CMMC and the flow-down from your prime. We keep the service and change the part that bends.
OSFI's technology and cyber risk rules set what an examiner will ask to see.
OSFI B-13. Technology and cyber risk across three domains: governance, technology operations and resilience, and cyber security. It binds federally regulated institutions, and only those.
Protected A, B and C data handling decides where the work can run and who can touch it.
Protected A, B and C. Each level changes where the data can physically live, who can reach it, and what you have to prove about both. Most files turn on Protected B, and most disagreements turn on what counts as reaching it.
Controlled goods rules, CMMC and the flow-down from your prime set what a supplier can do.
ITAR and the Controlled Goods Program. Registration under the Defence Production Act is mandatory before anyone examines, possesses or transfers controlled goods in Canada. Technical data counts, so a drawing sitting on a laptop is in scope.
Health information sits under provincial privacy law, and your IT provider is usually the custodian's agent.
PHIPA. Ontario's health privacy act, with its own definition of a custodian and its own duties for the agents acting on a custodian's behalf. Your IT provider is usually an agent.
Solicitor-client privilege decides how a firm can handle its data.
Law Society obligations. Confidentiality and competence duties reach the technology you practise with, and the vendors who touch client information. The firm is expected to have assessed the provider, which means the provider should arrive with the answers.
What do you need from ISO 42001 AI Management System?
Tell us who you are and what you're working on. A senior engineer reads your message before replying, so the first answer is a real read on scope, risk and timing, within an hour, 24/7. Nothing here is a commitment, and we'll tell you plainly if we're not the right fit.
Your request
- Service
- ISO 42001 AI Management System
What happens next
- A senior engineer replies within an hour, 24/7, never an SDR.
- We book a 30-minute call to listen, sketch options, and flag risks.
- You get a scoped statement of work within 3 business days.
Call the 24/7 line
+1 514-465-1584ISO 42001 in Canada, made real.
No Canadian law requires this. A customer, a tender, or a board asks for it, and that turns out to be a firmer deadline.
Good work starts with a list, not a policy.
Before anything else we write down every AI system you run, who owns it, what it decides, whose data feeds it, and which of them a supplier operates on your behalf. That list is usually shorter than the internal assumption and it always contains one surprise: a model somebody bought on a credit card, or a vendor feature switched on by default. Scope comes from that list. Annex A's 38 controls then get filtered through a Statement of Applicability, and you justify every one you leave out. Then comes the unglamorous part. An impact assessment saying what happens to a person when the system is wrong. Lifecycle records showing what changed and who approved it. Data provenance you can show. Supplier terms that survive the question of who trained this. Most gaps we find aren't missing controls, they're controls with nothing written down, and stage 1 reads documents before stage 2 tests anything.
What the standard is, and what it isn't.
ISO/IEC 42001:2023 is the first international AI standard written for the management system around your models rather than for the models themselves. Buyers often ask for it as responsible AI certification, which is close enough as shorthand but not what the certificate says. The next question is always ISO 42001 vs ISO 27001. The answer is subject, not structure: both are management system standards with the same clause layout, so holding one makes the second materially cheaper. ISO 27001 governs information security, who can reach data and how it's protected. ISO 42001 governs AI systems, what a model decides, whose data trained it, and what happens when it's wrong. Same auditors, same shape, different risk.
The regulatory case changed in July.
Canada still has no AI statute in force, so nothing here is legally compulsory. AIDA halted in January 2025 and no successor has been tabled, which leaves PIPEDA, Quebec Law 25 and the voluntary code as what actually applies. The EU AI Act's high-risk deadline, the one most of the market sells against, moved from 2026-08-02 to 2027-12-02 when the Digital Omnibus on AI, Regulation (EU) 2026/1744, took effect on 2026-07-27. Article 50 transparency duties were excluded from that deferral and landed on time. So the honest reason to certify is commercial. Somebody won't buy without it, and that's a better deadline than a regulatory one because it doesn't move.
Want a Senior IT Consultant's Read on Your Setup?
Tell us what you run today and what keeps breaking. A senior SMEnode engineer replies within an hour with a first read on scope, risk and timing. No sales handoff.
Request a consultHow an ISO 42001 readiness engagement runs.
Four steps, and step 01 is counting things. Nobody wants to start with an inventory and it decides the cost of everything after it. A team that thinks it runs fourteen AI systems often runs four that matter, plus ten features inside software it already pays for. Certifying the four is months of work. Certifying fourteen is a year you needn't spend. We won't quote the rest until this is done.
Engagement phases
Phases 01 to 04
Inventory and scope
Every system, owner, decision, data source and supplier written down, then a defensible boundary drawn around the ones that belong inside the management system. The surprise in that list is why we do it first.
Statement of Applicability
The 38 Annex A controls filtered against your risk and impact assessments, each exclusion justified in writing, because stage 1 will ask about the exclusions and not the inclusions.
Build and evidence it
Policy, roles, lifecycle records, data provenance and supplier terms. Our engineers do the technical work rather than handing you a folder of templates to fill in yourselves.
Both stages, then hand off
We prepare you for stage 1, fix what it raises, and stand behind you through stage 2. The certificate comes from an accredited body, never from us, and we'll help you pick one whose accreditation is real.
ISO 42001 questions, answered straight.
Answers first, including whether this standard is mature enough to bother with and why the EU deadline moved. An architect takes the call, not a salesperson.
Where this work connects.
These disciplines share the same senior team and tend to land together. Follow the thread to the next one.
- RegulatedQuebec Law 25 ComplianceLaw 25 Quebec compliance for Canadian businesses, where retention rules, incident registers and portability requests actually work.
- RegulatedCMMC ComplianceCMMC compliance for Canadian suppliers in the US defence chain, built on the controls that survived the suspension.
- RegulatedNIST Cybersecurity FrameworkNIST Cybersecurity Framework for Canadian organisations, starting with the Function CSF 2.0 put at the centre.
