ISO/IEC 42001 in Canada
ISO/IEC 42001: start from what you already have
ISO/IEC 42001 is the international standard for artificial intelligence management systems. It uses the common structure of ISO management system standards. If your organization is already certified, much of the work is done.
The essentials
What is ISO/IEC 42001?
ISO/IEC 42001:2023, often called ISO 42001, is the international standard that sets the requirements for an artificial intelligence management system (AIMS). Published in December 2023 by ISO and IEC, it is the first certifiable standard of its kind.
It does not certify an AI system: it certifies how an organization governs the AI systems it develops, provides or uses. It contains clauses 4 to 10, shared by ISO management system standards, and an Annex A of 38 controls across nine objectives.
It applies to any organization, whatever its size, whether it builds AI systems or buys them.
- Designation
- ISO/IEC 42001:2023
- Published
- December 2023
- Annex A
- 38 controls, 9 objectives
- Type
- Voluntary, certifiable standard
What your standards already cover
A requirement-by-requirement reading.
Coverage of ISO/IEC 42001 requirements by ISO 9001, ISO 14001, ISO/IEC 27001 and ISO 56001 management systems.
| ISO/IEC 42001 requirement | Clauses | ISO 9001 | ISO 14001 | ISO/IEC 27001 | ISO 56001 |
|---|---|---|---|---|---|
| Context, leadership, policy and objectives | 4, 5, 6.2 | Covered | Covered | Covered | Covered |
| Risk assessment and treatment | 6.1.2, 6.1.3 | Partly covered | Partly covered | Covered | Partly covered |
| Impact assessment on people | 6.1.4, A.5 | To build | Partly covered | Foothold | To build |
| Life cycle: design, verification, deployment | A.6 | Partly covered | Foothold | Partly covered | Partly covered |
| Data: quality and provenance | A.7 | Foothold | To build | Partly covered | To build |
| Information for interested parties | A.8 | Partly covered | Partly covered | Foothold | Foothold |
| System use and human oversight | A.9 | To build | To build | To build | To build |
| Suppliers and third parties | A.10 | Partly covered | Foothold | Covered | Foothold |
| Monitoring, measurement and drift | 9.1, A.6.2.6 | Partly covered | Partly covered | Partly covered | Foothold |
| Internal audit, management review, improvement | 9.2, 9.3, 10 | Covered | Covered | Covered | Covered |
Legend
- Covered
- Partly covered
- Foothold
- To build
Indicative reading prepared for training purposes. It does not replace a gap analysis.
Four requirements with no equivalent
Where the work is genuinely new.
Impact on people
6.1.4, A.5
What the standard asks
Assess the possible consequences of an AI system for affected individuals and groups, not only for the organization.
What your teams already know how to do
The ISO 14001 aspects and impacts method: identify, rate, control and review.
The boundary between human and machine
A.9
What the standard asks
Define what the system may do on its own, what requires a human decision and how oversight is exercised.
What your teams already know how to do
Responsibility matrices: who decides, who executes, who is consulted, who is informed.
Drift monitoring
9.1, A.6.2.6
What the standard asks
Track the AI system’s performance over time and respond when it degrades.
What your teams already know how to do
Control charts: limits, out-of-control signals, reaction plans.
The AI system life cycle
A.6
What the standard asks
Govern each stage, from design to verification, deployment, operation and retirement.
What your teams already know how to do
Design and development control (ISO 9001, 8.3).
What we do
Three ways to support you.
Readiness assessment
2 to 4 weeks
We read your existing management system, identify the gaps with ISO/IEC 42001 and deliver a prioritized work plan.
Internal audit
2 to 5 days
An internal audit of your AI management system, conducted under ISO 19011, to prepare the management review and the certification audit.
Training
Half day to 2 days
Programs for quality managers, internal auditors and leadership teams, built on the standards your teams already apply.
Certification
How an ISO 42001 project unfolds.
With TechVibes
Readiness assessment
A reading of your existing management system, the gaps with ISO/IEC 42001 and a prioritized work plan.
With TechVibes
Implementation
AI policy, system inventory, impact assessments, statement of applicability for the Annex A controls.
With TechVibes
Internal audit and management review
A full cycle of internal audit (clause 9.2) and management review (clause 9.3), expected before the certification audit.
Accredited body
Certification audit
A two-stage audit, documentation first and then on site, conducted by an accredited certification body.
Accredited body
Maintenance
Annual surveillance audits and recertification every three years.
In Canada, certification bodies are accredited by organizations such as the Standards Council of Canada.
Across Canada
ISO 42001 support from coast to coast.
Readiness assessments and internal audits delivered remotely anywhere in Canada, or on site in Québec. Online training for teams in every province, in person in Québec.
Why now
Requirements are taking shape.
Québec’s Law 25
Since September 2023, an organization that makes a decision based exclusively on automated processing of personal information must inform the person concerned and, on request, disclose the information used and the reasons and principal factors that led to the decision.
Financial sector
The AMF guideline on the use of artificial intelligence and OSFI guideline E-23 on model risk management, applicable from May 1, 2027.
Federal government
The Treasury Board Directive on Automated Decision-Making governs automated decision systems in federal institutions and requires an Algorithmic Impact Assessment.
Ontario
The Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 sets obligations for Ontario public sector entities that use artificial intelligence systems.
EU AI Act
Transparency obligations since August 2026 and high-risk system requirements from December 2027, for organizations serving the European market.
Go further
Free guides and references.
- The Bridge, free guide
From ISO 9001 and ISO/IEC 27001 to ISO/IEC 42001: what carries over, what changes, a 90-day plan.
- Who can certify ISO/IEC 42001 in Canada?
Certification bodies accredited by SCC and elsewhere, with sources.
- ISO/IEC 42001 in Québec
What Law 25, the Québec government and the AMF already require for AI.
- ISO/IEC 42001 Lead Auditor practice exam
Free: 80 questions, 180 minutes, detailed results by domain.
Frequently asked questions
ISO 42001: your questions.
What is ISO 42001?
ISO/IEC 42001:2023 is the international standard for artificial intelligence management systems. It sets the requirements to establish, implement, maintain and improve how an organization governs its AI systems. It is the first standard of its kind that can be certified.
Are ISO 42001 and ISO/IEC 42001 the same standard?
Yes. The full designation is ISO/IEC 42001:2023, because the standard is published jointly by ISO and the International Electrotechnical Commission (IEC). It is commonly called ISO 42001.
Do we need ISO 9001 or ISO/IEC 27001 before pursuing ISO 42001?
No. But an organization that already runs a management system standard has a clear head start: clauses 4 to 10 share the same structure. The work concentrates on impact assessment, human oversight, drift monitoring and the AI system life cycle.
Is ISO 42001 mandatory in Canada?
No, it is a voluntary standard. It does help demonstrate that you meet requirements that do apply: automated decisions under Québec’s Law 25, OSFI guideline E-23 in the financial sector, and the EU AI Act for organizations serving that market.
How long does preparation take?
It depends on the number of AI systems and the maturity of your management system. Our readiness assessment takes 2 to 4 weeks and ends with a prioritized work plan.
Can TechVibes certify our organization?
No. TechVibes prepares your organization: readiness assessment, implementation, internal audit and training. The certification audit is the role of an accredited certification body, independent from whoever supported you.
Do you work outside Québec?
Yes. Readiness assessments, internal audits and training are delivered remotely anywhere in Canada. On-site work and in-person training take place in Québec, including Côte-Nord.
Do your programs lead to Lead Auditor certification?
No. Our programs are not certification courses and do not lead to a PECB exam. They prepare your teams to apply the standard and to conduct internal audits.
Start with the guide or with an assessment.
The guide The Bridge shows, standard by standard, what your management system already covers. The readiness assessment applies it to your organization.