The ISO/IEC 42001 Crosswalk
What an ISO 27001 certificate actually buys you, and what Canadian law still requires, for organisations between 50 and 500 people
Half of an ISO 27001 certificate is transferable. The other half is the hard half.
If your organisation holds ISO/IEC 27001, you have been told you are most of the way to ISO/IEC 42001. You are not. You are roughly halfway, the half you have is the cheaper half, and the part you are missing is the part auditors fail people on.
This paper sets out the full mapping so you can see that for yourself. It covers three things: what an existing information security management system actually contributes to an AI management system, control by control; which Canadian legal obligations apply to AI today and which ISO 42001 controls evidence them; and, just as importantly, what ISO 42001 does not do for you.
We have published the complete crosswalk rather than a summary of it, ungated, because a crosswalk you cannot check is not a crosswalk. Every clause reference, control number and statutory citation in this document can be verified against the primary source, and we would encourage you to.
Five findings
Twenty-five of the standard's clause requirements transfer well. Two do not exist in ISO 27001 at all.
Clauses 4 through 10 of ISO 42001 follow the same harmonised structure as ISO 27001, so leadership, objectives, competence, documented information, internal audit, management review and corrective action carry across with minor rework. The exception is AI system impact assessment at clauses 6.1.4 and 8.4, which has no information security counterpart whatsoever.
Of the 38 Annex A controls, six reuse strongly, twenty-four partially, and eight are net-new.
Not one is fully discharged by existing ISMS evidence. The six strong reuses are worth taking first: capacity management, deployment and change control, logging, incident communication, policy review, and supplier management. The eight net-new controls cluster in exactly two places — assessing impacts (A.5.2 to A.5.5) and data quality and provenance (A.7.4 to A.7.6).
The honest reuse figure is closer to 40–50% than the 70–80% commonly advertised.
Weighting the clause requirements at full or partial credit gives about 78% transfer. Doing the same across Annex A gives about 36%. Because Annex A is where audit days are actually spent, the effort-weighted composite lands near half. We show the arithmetic in this paper so you can disagree with our weightings rather than take our word for the answer.
There is no Canadian AI statute. There are at least six Canadian obligations that already bite.
AIDA died on the Order Paper on 6 January 2025 and no successor has been enacted. That absence is widely misread as an absence of obligation. In fact Quebec's Law 25 has governed automated decisions since September 2023, Ontario's job posting disclosure rule took effect on 1 January 2026, OSFI's Guideline E-23 lands on 1 May 2027, PIPEDA's purpose limitation constrains training data now, and the EU AI Act reaches Canadian firms extraterritorially.
Quebec s. 12.1 is the obligation mid-market firms miss most often, and ISO 42001 does not close it.
Section 12.1 requires notice before an exclusively automated decision, disclosure on request of the personal information and principal factors used, and an opportunity to make representations to a person who can review the decision. ISO 42001 contains no control requiring a named human reviewer with authority to change an outcome. You have to build that yourself, and organisations outside Quebec who serve Quebec customers are the ones who usually have not.
Why this became urgent in 2026
Three things changed, none of them a new law.
The certification market opened. ISO/IEC 42001 was published in December 2023, but for eighteen months there was no standard governing who could certify against it. ISO/IEC 42006, which sets the competence requirements for certification bodies, arrived on 7 July 2025. Accredited certification became meaningfully available after that, and the certificates now being issued carry weight that earlier ones did not.
The demand signal moved down the chain. On 2 September 2026 KPMG Canada achieved ISO 42001 certification, audited by Schellman. When a Big Four firm certifies its own AI management system, the question does not stay inside that firm. It appears in their clients' board papers, and from there in their clients' supplier questionnaires. The organisations that will feel this first are mid-market technology and professional services suppliers who sell into enterprise and into regulated sectors — and who have, until now, had no proportionate answer to give.
Adoption outran governance. Statistics Canada's Canadian Survey on Business Conditions for April and May 2026 put AI use at 19.2% of Canadian businesses, up from 6.1% in the second quarter of 2024 — a threefold rise in under two years. Among firms with 100 or more employees it reaches 27.8%, and in professional, scientific and technical services 32.4%. Governance did not triple over the same period.
The result is a specific and narrow gap. Large enterprises are being served by the global firms. Very small firms are, realistically, not in the market for certification at all. Between them sits a large population of Canadian organisations with fifty to five hundred employees who have real AI exposure, real contractual pressure, an existing ISO 27001 certificate in many cases, and no proportionate guidance on what to do next. That is who this paper is written for.
How to read the crosswalk
Each row carries a reuse rating. The ratings mean something specific, and we have been deliberately conservative with them.
No control is rated as fully satisfied, because none is. A rating of strong reuse still requires you to re-scope, re-evidence and re-test. Anyone offering you a mapping in which existing controls simply are the new controls is mapping the words rather than the obligations.
Clause requirements, ISO 42001 against ISO 27001
Both standards use the ISO harmonised structure, so the management-system machinery maps almost one to one. Read the final column rather than the second: the clause numbers matching is not the same as the requirement being met.
| 42001 | Requirement | ISO 27001:2022 | Reuse | What actually transfers |
|---|---|---|---|---|
| 4.1 | Understanding the organization and its context | 4.1 Same | Partial reuse | The Annex SL text is near-identical, but 42001 additionally requires you to determine your role or roles in the AI value chain — provider, producer, deployer, user, partner — and the intended purpose of each AI system. An ISMS context statement does not carry either. |
| 4.2 | Needs and expectations of interested parties | 4.2 Same | Partial reuse | Your ISMS interested-party register lists customers, regulators, staff and suppliers. The AIMS register must also carry people affected by AI decisions who are not your customers — declined applicants, screened-out candidates, third parties in a dataset. |
| 4.3 | Determining the scope of the management system | 4.3 Same | Partial reuse | Mechanically identical. Conceptually different: an ISMS scope is drawn around information assets, sites and services; an AIMS scope is drawn around AI systems and the lifecycle stages you control. Copying your ISMS scope statement is the single most common early error. |
| 4.4 | The management system itself | 4.4 Same | Strong reuse | Direct reuse. If your ISMS process architecture is documented, the AIMS sits inside the same frame. |
| 5.1 | Leadership and commitment | 5.1 Same | Strong reuse | Direct reuse, provided the same executive body takes the AIMS on. In practice this is a governance decision, not a documentation one. |
| 5.2 | AI policy | 5.2 Information security policy | Partial reuse | The policy lifecycle — drafting, approval, publication, review — reuses wholesale. The content does not. An AI policy has to address acceptable use, human oversight, fairness and escalation; none of that appears in an information security policy. |
| 5.3 | Roles, responsibilities and authorities | 5.3 Same | Partial reuse | The RACI mechanism reuses. The roles are new: model owner, AI risk owner, the named human who exercises oversight. Most mid-market firms have nobody in these seats on day one. |
| 6.1.1–6.1.3 | Risk assessment, risk treatment, Statement of Applicability | 6.1.2–6.1.3 Same | Partial reuse | The machinery reuses — risk criteria, register, treatment plan, SoA. The criteria themselves must be rebuilt: an ISMS assesses harm to the organisation through confidentiality, integrity and availability. An AIMS must assess harm to individuals and to society. That is a different question with a different answer, and it is where most gap analyses quietly fail. |
| 6.1.4 | AI system impact assessment | — No counterpart | Net-new build | There is no ISO 27001 equivalent. None. The nearest thing most Canadian organisations hold is a privacy impact assessment under Law 25 or PIPEDA, which covers a fraction of the ground. This is the largest single net-new build in the standard and it should be budgeted as such. |
| 6.2 | AI objectives and planning to achieve them | 6.2 Same | Strong reuse | Direct reuse of the objective-setting and measurement discipline. |
| 6.3 | Planning of changes | 6.3 Same | Strong reuse | Direct reuse. |
| 7.1 | Resources | 7.1 Same | Partial reuse | The clause reuses; Annex A.4 expands it materially into data, tooling and compute. See Table 2. |
| 7.2 | Competence | 7.2 Same | Partial reuse | Same mechanism, much harder to satisfy. AI competence is scarce, and the certification body will ask you to evidence it for named individuals, not assert it for a function. |
| 7.3 | Awareness | 7.3 Same | Partial reuse | Your security awareness programme is the delivery vehicle. The curriculum is new, and Article 4 of the EU AI Act makes AI literacy a legal obligation for anyone selling into the EU. |
| 7.4 | Communication | 7.4 Same | Partial reuse | Internal communication reuses. Annex A.8 adds outward-facing disclosure duties that an ISMS has no analogue for. |
| 7.5 | Documented information | 7.5 Same | Strong reuse | Direct reuse. Your existing document control system carries the AIMS without modification. |
| 8.1 | Operational planning and control | 8.1 Same | Partial reuse | Reuses as a frame. What sits inside it — the AI system lifecycle of Annex A.6 — is largely new. |
| 8.2 | AI risk assessment (operational) | 8.2 Same | Strong reuse | Direct reuse of the cadence and trigger logic. |
| 8.3 | AI risk treatment (operational) | 8.3 Same | Strong reuse | Direct reuse. |
| 8.4 | AI system impact assessment (operational) | — No counterpart | Net-new build | As with 6.1.4. Operationalising impact assessment — running it at the right moments, keeping it current as models change — is net-new work. |
| 9.1 | Monitoring, measurement, analysis and evaluation | 9.1 Same | Partial reuse | The clause reuses. The telemetry does not. An ISMS monitors control effectiveness; an AIMS must also monitor model performance drift, which requires instrumentation most organisations have not built. |
| 9.2 | Internal audit | 9.2 Same | Strong reuse | Direct reuse of the programme, schedule and reporting line. Your auditors will need AI competence, which is a resourcing question rather than a system-design one. |
| 9.3 | Management review | 9.3 Same | Strong reuse | Direct reuse. Add the AIMS inputs to the existing agenda rather than creating a second forum. |
| 10.1 | Continual improvement | 10.1 Same | Strong reuse | Direct reuse. |
| 10.2 | Nonconformity and corrective action | 10.2 Same | Strong reuse | Direct reuse of the CAPA process end to end. |
The 38 Annex A controls
This is the substance of the standard and the substance of the audit. Grouped by control objective, with the closest ISO 27001:2022 Annex A anchor in each case. Where we have written “None”, we mean it — there is no analogue, and the work is yours to do from nothing.
| Control | Title | ISO 27001:2022 anchor | Reuse | Assessment |
|---|---|---|---|---|
| A.2 Policies related to AI3 controls | ||||
| A.2.2 | AI policy | A.5.1 Policies for information security | Partial reuse | The policy framework, approval route and publication mechanism transfer. The subject matter does not. |
| A.2.3 | Alignment with other organisational policies | A.5.1; A.5.31 Legal, statutory, regulatory and contractual requirements | Partial reuse | You already maintain a policy hierarchy. Mapping the AI policy into it is a half-day. Resolving the conflicts it exposes — typically between the AI policy and an existing data retention or privacy policy — is not. |
| A.2.4 | Review of the AI policy | A.5.1 | Strong reuse | The same review cycle and governance forum carries it. Genuine reuse. |
| A.3 Internal organisation2 controls | ||||
| A.3.2 | AI roles and responsibilities | A.5.2 Information security roles and responsibilities; A.5.3 Segregation of duties; A.5.4 Management responsibilities | Partial reuse | The role-definition mechanism reuses. Note that segregation of duties bites hard here: the person who builds a model should not be the person who signs off its validation, and in a 200-person firm that is a real constraint, not a paperwork exercise. |
| A.3.3 | Reporting of concerns | A.6.8 Information security event reporting | Partial reuse | The channel reuses. The scope widens considerably — from security events to concerns about fairness, accuracy and appropriate use, raised by staff and, in some scope definitions, by people outside the organisation. Closer to a whistleblowing route than an incident queue. |
| A.4 Resources for AI systems5 controls | ||||
| A.4.2 | Resource documentation | A.5.9 Inventory of information and other associated assets | Partial reuse | Your asset register is the right home, but it has to grow: models, datasets, fine-tunes, prompts, vector stores and third-party API dependencies are all in scope and almost none of them are in your CMDB today. |
| A.4.3 | Data resources | A.5.9; A.5.12 Classification of information; A.5.13 Labelling of information | Partial reuse | Classification and labelling transfer. What they do not answer is whether a dataset is representative, correctly licensed, or lawfully usable for training — which is what Annex A.7 goes on to ask. |
| A.4.4 | Tooling resources | A.5.9; A.8.19 Installation of software on operational systems | Partial reuse | This is the shadow-AI control. Software installation policy gets you part of the way; it does not catch the AI features switched on inside SaaS products you already licence, which is where most undocumented AI use actually lives. |
| A.4.5 | System and computing resources | A.8.6 Capacity management | Strong reuse | A direct analogue. Extend capacity planning to inference load, GPU availability and the cost envelope. Genuine reuse. |
| A.4.6 | Human resources | A.6.1 Screening; A.6.2 Terms and conditions of employment; A.6.3 Information security awareness, education and training | Partial reuse | The HR control set reuses structurally. Evidencing AI competence for the people in AI roles is the part that is usually missing, and it cannot be closed with a one-hour e-learning module. |
| A.5 Assessing impacts of AI systems4 controls | ||||
| A.5.2 | AI system impact assessment process | — None | Net-new build | Net-new. A privacy impact assessment is the nearest artefact you are likely to hold and it addresses perhaps a third of what is required. You need a defined, repeatable methodology before you can run a single assessment. |
| A.5.3 | Documentation of AI system impact assessments | — None | Net-new build | Net-new. Document control reuses; the documents themselves do not exist yet. |
| A.5.4 | Assessing AI system impacts on individuals or groups | — None | Net-new build | Net-new, and in our experience the control that most often produces a major nonconformity at Stage 2. It requires you to reason about people who are not your customers and who never agreed to anything. |
| A.5.5 | Assessing societal impacts of AI systems | — None | Net-new build | Net-new, and the hardest to scope proportionately for a mid-market organisation. Auditors are generally reasonable about depth here; they are not reasonable about its absence. |
| A.6 AI system life cycle9 controls | ||||
| A.6.1.2 | Objectives for responsible development of AI systems | — None (A.8.25 sets a weak precedent) | Net-new build | A.8.25 establishes that you document development principles, so the shape is familiar. The content — fairness, transparency, contestability — has no security analogue. |
| A.6.1.3 | Processes for responsible design and development | A.8.25 Secure development life cycle; A.8.27 Secure system architecture and engineering principles | Partial reuse | Your SDLC is the correct insertion point and that is a real saving. The gates you add to it are new. |
| A.6.2.2 | AI system requirements and specification | A.8.26 Application security requirements | Partial reuse | Same mechanism, extended to performance thresholds, fairness criteria and defined operating limits. |
| A.6.2.3 | Documentation of AI system design and development | A.8.25; A.5.37 Documented operating procedures | Partial reuse | Structurally familiar. Note that this documentation and A.6.2.7 together are close to what Annex IV of the EU AI Act requires — worth building once, to the higher bar. |
| A.6.2.4 | AI system verification and validation | A.8.29 Security testing in development and acceptance | Partial reuse | The test-gate mechanism reuses cleanly. What you test for — accuracy, bias, robustness, drift baselines — requires skills your security test team almost certainly does not have. |
| A.6.2.5 | AI system deployment | A.8.31 Separation of development, test and production environments; A.8.32 Change management | Strong reuse | Strong reuse. Add model versioning and a documented rollback path to the existing change process. |
| A.6.2.6 | AI system operation and monitoring | A.8.16 Monitoring activities | Partial reuse | Same discipline, different signal. Security monitoring looks for compromise; AI monitoring looks for degradation. Your SIEM will not tell you a model has drifted. |
| A.6.2.7 | AI system technical documentation | A.5.37 Documented operating procedures | Partial reuse | Reuses as a documentation practice. The content set is new and is the artefact enterprise buyers and EU regulators will ask to see. |
| A.6.2.8 | AI system event logs | A.8.15 Logging | Strong reuse | Strong reuse. Extend the log schema to inference-level records: input, output, model version, confidence, and whether a human overrode the result. Retention policy carries across unchanged. |
| A.7 Data for AI systems5 controls | ||||
| A.7.2 | Data for development and enhancement of AI systems | A.8.33 Test information | Partial reuse | The principle of controlling data used in development is established. The scale and the provenance questions are new. |
| A.7.3 | Acquisition of data | A.5.31 Legal, statutory, regulatory and contractual requirements; A.5.34 Privacy and protection of PII | Partial reuse | This is where PIPEDA purpose limitation and content licensing collide. The control exists in your ISMS; the analysis behind it has probably never been done for training data. |
| A.7.4 | Quality of data for AI systems | — None | Net-new build | Net-new and technically demanding. No information security control asks whether data is representative or fit for the inferential purpose. This is the second most common failure point after impact assessment. |
| A.7.5 | Data provenance | A.5.9 (weak) | Net-new build | Effectively net-new. Lineage tracking from source through transformation to training set is not something an asset inventory delivers. |
| A.7.6 | Data preparation | — None | Net-new build | Net-new. Documented, repeatable preparation steps — cleaning, labelling, augmentation — with the decisions behind them recorded. |
| A.8 Information for interested parties4 controls | ||||
| A.8.2 | System documentation and information for users | A.5.37 | Partial reuse | Your documentation practice reuses. The audience is wider and includes people outside your organisation. |
| A.8.3 | External reporting | A.5.5 Contact with authorities | Partial reuse | A route to regulators exists. A route to affected individuals generally does not. |
| A.8.4 | Communication of incidents | A.5.24–A.5.28 Information security incident management | Strong reuse | The strongest reuse in Annex A after supplier management. Your incident process, severity matrix, comms templates and post-incident review all carry over. What you must add is the definition: a harmful output, a fairness breach or a drift threshold crossing is an incident, and today your taxonomy does not say so. |
| A.8.5 | Information for interested parties | A.5.5; A.5.6 Contact with special interest groups | Partial reuse | Partial. The obligation runs wider than the ISMS analogue contemplates. |
| A.9 Use of AI systems3 controls | ||||
| A.9.2 | Processes for responsible use of AI systems | A.5.10 Acceptable use of information and other associated assets | Partial reuse | The single best reuse candidate in the standard. Extend the acceptable use policy rather than writing a new one, and you will get further faster than any other move available to you. |
| A.9.3 | Objectives for responsible use of AI systems | A.5.10 | Partial reuse | Same vehicle, new content. |
| A.9.4 | Intended use of the AI system | A.5.10 | Partial reuse | Off-label use — a tool procured for one purpose quietly applied to another — is the most common real AI governance failure we see in mid-market organisations, and it is almost never malicious. |
| A.10 Third-party and customer relationships3 controls | ||||
| A.10.2 | Allocation of responsibilities | A.5.19 Information security in supplier relationships; A.5.20 Addressing information security within supplier agreements | Partial reuse | Your supplier framework is the right home. The new question is which party in the chain is provider, which is deployer and which is merely a user — a determination that also governs your exposure under the EU AI Act. |
| A.10.3 | Suppliers | A.5.19; A.5.20; A.5.21 Managing information security in the ICT supply chain; A.5.22 Monitoring, review and change management of supplier services | Strong reuse | The hardest-working reuse in the whole crosswalk. If your third-party risk management is mature, you are adding questions to an existing process rather than building one. If it is not, ISO 42001 will expose that before it exposes anything about AI. |
| A.10.4 | Customers | A.5.20 | Partial reuse | Contractual mechanism reuses; the commitments you are making are new and should be reviewed by counsel before they appear in an MSA. |
The arithmetic behind the headline figure
Reuse percentages are thrown around freely in this market and almost never shown. Here is ours, in full, so that you can substitute your own weightings.
Clause requirements. Twenty-five clause-level requirements were assessed. Eleven rated strong reuse and were credited at 1.0. Twelve rated partial and were credited at 0.7, on the basis that the process architecture transfers even where the content does not. Two rated net-new and were credited at zero. That gives 77.6%.
Annex A controls. Thirty-eight controls were assessed. Six rated strong reuse and were credited at 0.85, reflecting that even strong reuse requires re-scoping and re-evidencing. Twenty-four rated partial and were credited at 0.35, reflecting that a familiar mechanism carries perhaps a third of the effort when the substance is new. Eight rated net-new and were credited at zero. That gives 35.5%.
Composite. Weighting clause requirements at 40% of total effort and Annex A at 60% — because Annex A is where implementation and audit time is actually spent — produces 52.4%. Weight Annex A more heavily, as we would for an organisation with many AI systems, and the figure falls into the mid-forties.
So: roughly half, and the half you already hold is the management-system scaffolding, which is the cheaper half to build. Treat 40–50% as the planning assumption. If a supplier quotes you 80%, ask them which of the eight net-new controls they believe your ISMS already covers, and listen carefully to the answer.
Canadian legal obligations, and what ISO 42001 evidences
There is no Canadian AI statute. There are, nonetheless, obligations in force today that reach most mid-market organisations, and more arriving on fixed dates. For each one we give the citation, the status, who it reaches, what it requires, the ISO 42001 controls that produce useful evidence — and, in the last row of each card, the part the standard will not do for you.
PIPEDA
Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5
In force
- Who it reaches
- Private-sector organisations handling personal information in the course of commercial activity, federally and in provinces without substantially similar legislation. Alberta, British Columbia and Quebec have their own private-sector statutes; PIPEDA still governs interprovincial and international transfers.
- What it requires
- Meaningful consent, purpose limitation, accuracy, openness, individual access, and accountability. Purpose limitation is the provision that matters most for AI: personal information collected for one purpose cannot simply be repurposed as training data.
- ISO 42001 controls that evidence it
A.7.3A.7.4A.5.4A.8.2- What ISO 42001 does not give you
- ISO 42001 gives you no consent mechanism, no access-request workflow and no privacy officer. It will not answer whether training on customer data is a compatible secondary purpose — that is a legal determination, and it is the one most often skipped.
Quebec Law 25, s. 12.1
Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, as amended by the Act to modernize legislative provisions as regards the protection of personal information (Law 25)
In force since 22 September 2023
- Who it reaches
- Any enterprise processing the personal information of Quebec residents, wherever the enterprise is located.
- What it requires
- Where a decision is based exclusively on automated processing, the individual must be informed at or before the decision is made. On request they must be told what personal information was used, the principal factors and parameters that led to the decision, and of their right to have that information corrected. They must be given an opportunity to submit observations to a person able to review the decision. Administrative monetary penalties reach CAD 10 million or 2% of worldwide turnover; penal fines reach CAD 25 million or 4%.
- ISO 42001 controls that evidence it
A.5.2A.5.3A.5.4A.6.2.6A.8.2A.8.5A.9.4- What ISO 42001 does not give you
- ISO 42001 has no control requiring a named human reviewer with the authority to change a decision, and none requiring the individual-facing disclosure-on-request workflow. Both are bespoke builds. This is the most consequential Canadian obligation for mid-market firms and the one most frequently missed by organisations outside Quebec who nonetheless serve Quebec customers.
Ontario ESA job posting disclosure
Employment Standards Act, 2000, S.O. 2000, c. 41, as amended by the Working for Workers Four Act, 2024; O. Reg. 476/24
In force 1 January 2026
- Who it reaches
- Employers with 25 or more employees on the day a publicly advertised job posting is published. Excludes internal postings, general recruitment drives and roles performed entirely outside Ontario.
- What it requires
- Every publicly advertised job posting must disclose whether artificial intelligence is used to screen, assess or select applicants. The regulation defines AI as machine-based systems that infer from inputs to generate outputs such as predictions, recommendations or decisions that can influence outcomes — wide enough to capture most applicant tracking systems with ranking features switched on.
- ISO 42001 controls that evidence it
A.4.2A.4.4A.6.2.6A.8.2A.9.4- What ISO 42001 does not give you
- The statute does not prescribe the form or detail of the disclosure, and Ministry guidance on what counts as screening, assessing or selecting remains thin. ISO 42001 will tell you that you are using AI in hiring; it will not tell you how to word the notice.
OSFI Guideline E-23
Guideline E-23 — Model Risk Management (2027), Office of the Superintendent of Financial Institutions
Effective 1 May 2027
- Who it reaches
- All federally regulated financial institutions, applied proportionally to size, strategy, risk profile and complexity. Reaches suppliers indirectly through third-party risk requirements.
- What it requires
- Enterprise-wide model risk management framework; an inventory capturing every model with non-negligible inherent model risk; risk ratings driven by quantitative and qualitative factors; and lifecycle management across design, review, deployment, monitoring and decommission. Data must be accurate, fit for use, relevant, representative, compliant, traceable and timely. Review must be independent.
- ISO 42001 controls that evidence it
A.4.2A.4.3A.6.1.3A.6.2.2A.6.2.4A.6.2.5A.6.2.6A.7.4A.7.5- What ISO 42001 does not give you
- The overlap with Annex A.6 and A.7 is the closest in this table — but E-23 requires independence of the review function and a defensible quantitative risk-rating methodology, and ISO 42001 requires neither explicitly. For mid-market technology suppliers the commercial point is simpler: if you sell models or AI-enabled software into a federally regulated financial institution, E-23 will reach you through your customer's third-party risk process well before May 2027.
TBS Directive on Automated Decision-Making
Treasury Board of Canada Secretariat, Directive on Automated Decision-Making
In force
- Who it reaches
- Federal institutions making administrative decisions. Reaches private suppliers as a procurement condition, not as direct law.
- What it requires
- An Algorithmic Impact Assessment, with obligations scaling by assessed impact level: notice, explanation, human intervention, peer review and testing.
- ISO 42001 controls that evidence it
A.5.2A.5.3A.5.4A.5.5A.6.2.3A.6.2.4A.8.2- What ISO 42001 does not give you
- If you sell AI-enabled services to a federal department you will inherit AIA obligations through contract. ISO 42001's impact assessment discipline is good preparation but is not a substitute for completing the AIA instrument itself.
ISED Voluntary Code of Conduct
Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems, Innovation, Science and Economic Development Canada
Voluntary; signatory-based
- Who it reaches
- Firms developing or managing advanced generative AI systems who choose to sign.
- What it requires
- Commitments on accountability, safety, fairness, transparency, human oversight and validity across development and deployment.
- ISO 42001 controls that evidence it
A.2.2A.5.2A.8.2A.8.3A.9.2- What ISO 42001 does not give you
- No legal force. It carries reputational and procurement weight, and signature is sometimes raised in enterprise tenders. Do not let a vendor present it as regulatory compliance.
AIDA
Artificial Intelligence and Data Act, Part 3 of Bill C-27
Not law. Died on the Order Paper when Parliament was prorogued on 6 January 2025.
- Who it reaches
- Nobody.
- What it requires
- None. There is no federal Canadian AI statute in force.
- ISO 42001 controls that evidence it
- Not applicable
- What ISO 42001 does not give you
- We include AIDA in this table for one reason. A meaningful number of governance products and advisory proposals in this market still reference AIDA compliance as a deliverable. AIDA is not law, was never law, and no successor bill has been enacted. Treat any proposal that offers AIDA compliance as evidence about the supplier rather than about your obligations.
EU AI Act
Regulation (EU) 2024/1689, as amended by the Digital Omnibus on AI (in force 27 July 2026)
In force, phased. Prohibited practices and AI literacy since 2 February 2025; general-purpose AI obligations since 2 August 2025; Article 50 transparency from 2 August 2026; Annex III high-risk obligations deferred to 2 December 2027; Annex I high-risk to 2 August 2028.
- Who it reaches
- Extraterritorial. It reaches a Canadian organisation where the output of its AI system is used in the European Union, regardless of where the organisation sits.
- What it requires
- For high-risk systems: a quality management system (Art. 17), risk management (Art. 9), data governance (Art. 10), technical documentation (Annex IV), logging (Art. 12), human oversight (Art. 14) and post-market monitoring.
- ISO 42001 controls that evidence it
A.2.2A.5.2A.6.2.3A.6.2.4A.6.2.6A.6.2.7A.6.2.8A.7.4A.9.2- What ISO 42001 does not give you
- ISO 42001 certification is not a presumption of conformity with the EU AI Act. Harmonised standards under Article 40 are still in development at CEN-CENELEC JTC 21. A 42001 certificate is strong evidence of good practice and substantially reduces the work; it does not discharge the obligation, and any supplier who tells you otherwise is overselling.
Six things ISO 42001 does not do
A crosswalk that only tells you what a standard covers is a sales document. These are the limits, and they matter as much as the mapping.
- It is not a licence and not a defence. No Canadian law requires ISO 42001, and holding it does not discharge any obligation in Table 3. It is evidence of a governed system, which is useful in a regulatory conversation and not the same as compliance.
- It is not a presumption of conformity with the EU AI Act. Harmonised standards under Article 40 of the Act are still in development at CEN-CENELEC JTC 21. A 42001 certificate substantially reduces EU AI Act work and does not complete it.
- It certifies a management system, not a model. Your certificate attests that you govern AI systematically. It says nothing about whether any particular model is accurate, fair or safe. Buyers routinely conflate the two, and suppliers routinely let them.
- It will not fix rights you do not hold. If your training data was acquired without a lawful basis or a licence that permits the use, no amount of management system will cure it. That is a legal problem with a legal answer and it is better found in Phase 0 than in Stage 2.
- It does not scale down on its own. Proportionality is available to you but you have to argue for it, in writing, in your impact assessment methodology and your Statement of Applicability. A small organisation that simply does less will fail; a small organisation that documents why less is appropriate generally will not.
- Certificate scope matters more than the certificate. This applies to you and to every supplier who hands you one. A certificate scoped to a single platform is not a whole-company claim, and the scope statement is printed on the document.
A proportionate adoption path
Sequenced for an organisation of fifty to five hundred people that already holds ISO 27001. Without an existing ISMS, expect the whole programme to run roughly half as long again, because you will be building the management system and the AI-specific content at the same time. Timings overlap deliberately; they are planning ranges drawn from practice, not benchmarks.
| Phase | Focus | What happens | What you hold at the end |
|---|---|---|---|
| Phase 0Weeks 1–4 | Inventory and discovery | Find every AI system you are running. Not the ones on the roadmap — the ones in production, including the AI features already switched on inside SaaS products you licensed for other reasons. Nothing else in this programme is meaningful until this is done, and it almost always returns more systems than the executive expects. | AI system inventory. Shadow-AI findings. A first view of which systems touch personal information or affect individuals. |
| Phase 1Weeks 4–10 | Role, scope and policy | Determine your role for each system — provider, producer, deployer, user — because the obligations differ and so does your EU AI Act exposure. Write the scope statement. Issue the AI policy. Extend the acceptable use policy rather than writing a parallel one. | Role determination. AIMS scope statement. Approved AI policy. Revised acceptable use policy. Interested-party register. |
| Phase 2Weeks 10–20 | Impact assessment | Build the methodology, then run it on your highest-risk systems. This is the largest net-new build in the standard and the place where thin implementations are caught. Treat the time estimate here as the one least likely to compress. | Impact assessment methodology. Completed assessments for top-risk systems. Risk criteria covering harm to individuals and society, not only to the organisation. |
| Phase 3Weeks 16–28 | Control build and Statement of Applicability | Work the Annex A crosswalk in Table 2. Start with the six strong-reuse controls to build momentum and release capacity, then take the eight net-new controls with the time that buys you. Extend third-party risk management and the incident taxonomy. | Statement of Applicability. Extended TPRM questionnaire and contract clauses. AI incident definitions in the existing playbook. Data quality and provenance procedures. |
| Phase 4Weeks 24–36 | Operate, audit, review | The system has to run before it can be certified. Internal audit with auditors who hold AI competence, then management review with the AIMS on the existing agenda. | Internal audit report. Management review minutes. Corrective actions closed. Stage 1 readiness. |
| Phase 5Weeks 32–48 | Certification | Stage 1 documentation review, then Stage 2 implementation audit. Choose a certification body whose accreditation covers ISO/IEC 42001 under ISO/IEC 42006. | Stage 1. Stage 2. Certificate. |
A note on effort. We are not going to publish a day-rate estimate dressed up as a benchmark. What we will say is this: in every mid-market implementation we have seen, Phase 2 takes longer than the plan allows and Phase 0 finds more systems than the executive expects. Build both of those into the schedule at the start and the rest of the programme behaves.
Ten questions for any supplier claiming ISO 42001
Print this. It works equally well when somebody asks it of you, which is rather the point of publishing it.
- Ask for the certificate, not the claim.An ISO 42001 certificate is a document with a number, an issuing body and an expiry date. “Aligned with”, “mapped to” and “built on the principles of” are not certification.
- Read the scope statement before the logo.A certificate scoped to “the AI management system supporting the X platform” is not a whole-company claim. Scope is where the substance lives, and it is printed on the certificate.
- Check the accreditation, not just the certifier.ISO/IEC 42006:2025, published 7 July 2025, sets the requirements for bodies certifying against ISO 42001. Ask which accreditation body stands behind the certificate. Some certificates in circulation were issued before 42006 accreditation existed.
- Ask which controls are excluded and why.The Statement of Applicability records every Annex A control and the justification for any exclusion. A supplier who will not share the SoA scope is telling you something.
- Ask to see one completed AI system impact assessment.Redacted is fine. This single artefact tells you more about the maturity of an AI management system than the certificate does, because it is the control most often implemented thinly.
- Ask how model drift is detected and what the threshold is.If the answer is a monitoring philosophy rather than a number and an alert, the control is aspirational.
- Ask who the named human overseer is.Human oversight is a role held by a person with authority to intervene, not a principle in a policy.
- Ask what happens on the day the foundation model changes underneath them.Most mid-market AI systems are built on third-party models the supplier does not control. The answer reveals whether A.10.2 and A.10.3 have been taken seriously.
- Ask for their Quebec position specifically.If you or your customers have Quebec users and the supplier has not considered s. 12.1, the gap is yours to inherit.
- Ask when the certificate was issued and when the first surveillance audit falls.A first-year certificate reflects a system that has been designed. A system that has survived two surveillance audits has been operated. They are different assurances.
Where to start on Monday
If you read nothing else here, do these three things.
Build the inventory first. Not a policy, not a gap analysis, not a vendor conversation. Until you know which AI systems are running in your organisation — including the features quietly enabled inside software you bought for other reasons — every other artefact you produce is describing a system you cannot see. This is Phase 0 in the table above and it is usually the week that changes the executive's view of the programme.
Find your Quebec exposure. Not because Quebec is the largest risk, but because s. 12.1 has been in force since September 2023, applies wherever your customers are, carries penalties into eight figures, and is the obligation that mid-market firms outside Quebec most consistently have not considered. Ask one question: does any system make a decision about an individual with no human in the loop? If the answer is yes or unclear, you have work that ISO 42001 will not do for you.
Take the six strong-reuse controls early. Capacity management, deployment and change, logging, incident communication, policy review and supplier management are the controls where your existing ISMS does genuine work. Closing them early costs little, builds evidence of progress for your board, and releases the time you will need for the eight controls that have no shortcut.
Attribution, limitations and sources
Canada Cyber-Safe is an independent cyber and AI governance practice serving Canadian mid-market organisations. We are the North American sister practice to UK Cyber-Safe.
This document is published in full and without registration. It may be shared, quoted and cited freely with attribution. If you find an error in a citation or a mapping, we would rather hear about it than not — corrections are published with the version history.
Not legal advice. This paper summarises statutory and regulatory requirements for the purpose of mapping them to a management system standard. It is not legal advice and does not create a solicitor-client or equivalent relationship. Statutory positions are stated as at 12 September 2026 and change. Obtain qualified Canadian legal advice on your specific circumstances, particularly in respect of Quebec Law 25 and any EU AI Act exposure.
On the standards themselves. ISO/IEC 42001:2023 and ISO/IEC 27001:2022 are copyright works of ISO and IEC. This crosswalk reproduces clause and control numbers and titles for the purpose of mapping, as is standard practice; it does not reproduce the requirement text. You will need licensed copies of both standards to implement against them.
Primary sources
- ISO/IEC 42001:2023, AI management systems
- KPMG Canada achieves ISO 42001 certification
- OSFI Guideline E-23 — Model Risk Management (2027)
- Ontario job posting requirements in force 1 January 2026 (Osler)
- EU AI Act Digital Omnibus — postponed high-risk deadlines (Gibson Dunn)
- Statistics Canada AI adoption, Canadian Survey on Business Conditions
- ISO/IEC 42006:2025 and certification body accreditation
- Ontario Ministry guidance: requirements related to publicly advertised job postings
Version 1.0 · September 2026 · Prepared against ISO/IEC 42001:2023 (first edition, published 18 December 2023) and ISO/IEC 27001:2022. Legal position stated as at 12 September 2026.