For AI vendors selling to Canadian enterprises
AI Trust Passport: evidence your customers can check
Enterprise buyers, and the financial institutions OSFI supervises in particular, are asking their AI suppliers for evidence of how their AI is governed, tested and overseen. The AI Trust Passport turns scattered governance evidence into a human-reviewed pack you can share with customers. We are now looking for a small number of Canadian design partners.
Why buyers are asking
- Financial services. On 15 October 2026 OSFI endorsed the Financial Stability Board’s twelve sound practices for AI, including managing risk from third-party AI. Its model risk guideline, E-23, applies to all federally regulated financial institutions from 1 May 2027.
- Privacy. PIPEDA and, in Quebec, Law 25 already reach how personal information flows through AI systems, including the systems your customers buy from you.
- Procurement. Security and AI questionnaires repeat the same questions in different formats. Answering each from scratch slows the sale.
What the Passport is
A structured review of one AI product, against a versioned control set covering ten areas: AI inventory and intended use; governance and accountability; data governance and privacy; identity, access and infrastructure security; evaluation, robustness and bias; human oversight and transparency; third-party models and supply chain; logging, monitoring and incident response; change control and lifecycle; and resilience and decommissioning.
Controls are mapped, with version labels, to ISO/IEC 42001, ISO/IEC 27001, the NIST AI Risk Management Framework and the Canadian obligations that apply to your product. You receive:
- a Passport stating scope, method, the frameworks and editions used, the review date, the reviewer and the limitations;
- an evidence register showing what each finding rests on;
- a remediation plan for the gaps;
- a redacted version you can share with customers, under your control.
What it is not
It is not a certificate, an ISO certification, a conformity assessment, a regulatory approval or a penetration test, and it does not guarantee that a product is safe. Every finding is reviewed by a person, and every statement in the Passport points to the evidence behind it or is marked as unsubstantiated. If we assess your product, we will not also sell you the fixes.
Design partners
We are working with a small number of Canadian AI vendors to shape the Passport before wider launch. Design partners help define the control set and the customer-facing format, and receive a scoped review on agreed terms. It suits vendors who:
- sell an AI product to enterprise, financial services, healthcare or public-sector customers in Canada;
- are spending time on security and AI questionnaires; and
- would rather show evidence than give assurances.
If that is you, tell us about your product. The first conversation is free.
The AI Trust Passport is offered by the Cyber-Safe group, with UK Cyber-Safe and Canada Cyber-Safe using one shared method. Terms, scope and pricing for Canadian engagements are agreed individually.