Emilie Sartoretto
Senior Communications Advisor
Standards Council of Canada

Artificial intelligence (AI) assurance takes a concrete step forward in Canada. MHM Advisory has become the first certification body accredited by the Standards Council of Canada (SCC) to deliver ISO/IEC 42001 certification, creating a clear path for organizations to demonstrate responsible AI governance.

Why This Milestone Matters

SCC accredited its first certification body that can certify organizations to ISO/IEC 42001 under its AI Management Systems Accreditation Program. The standard applies a management system (MS) approach to AI. Instead of assessing a single tool, it requires policy, roles, risk controls and continual improvement for the AI an organization builds, buys or deploys. That structure supports consistent outcomes over time and aligns with how buyers and regulators evaluate assurance.

“SCC chose to accredit the first certification body while ISO/IEC 42006 was still in draft,” said Elias Rafoul, Vice-President, Accreditation Services. “The pilot gave enough evidence to set competence and witnessing expectations so services could start without waiting for the final text. With ISO/IEC 42006 now published, the first accreditation is transitioning to the final requirements and new applicants will be assessed to the final edition.”

From the certification body perspective, demand is visible. “AI can feel like a black box. Our clients seeking certification ask, ‘Where is my data, what are you doing with it and how do I know models are trained responsibly’,” said Jose Costa, Principal, MHM Advisory Ltd.

“ISO/IEC 42001 gives us a common, credible yardstick.” Costa also cautioned about low cost, non-accredited offers. Without accreditation there is no independent check of the certifier’s competence or impartiality. Accredited certification creates a chain of assurance that checks the checkers so the audit process is repeatable, defensible and recognized across markets.

From Pilot to Full Program

Before ISO/IEC 42001 was published, SCC ran a learn-by-doing pilot with two tracks: an organizational AIMS assessment against draft 42001 using ISO/IEC 17021-1, and system-level reviews of AI-enabled products and services aligned to ISO/IEC 17065 with draft expectations for evidence and sampling. The dual track tested how management system controls connect to product evidence to demonstrate end-to-end governance.

The pilot yielded updates to requirements, guidance and assessor training. It underscored the need for AI inventories and data lineage, management of third-party and model-as-a-service risk, appropriate sector overlays and disciplined change management. Evidence expectations were tightened so audits are rigorous yet workable, and auditor competence profiles were clarified.

A key lesson was that ISO/IEC 42001 is intentionally general. In higher risk contexts it should be paired with sector or application schemes that add testable criteria and sampling rules, as in forestry chain of custody and food safety programs, which reduces interpretive drift and sharpens witnessing.

Standards Backbone and Transition

ISO/IEC 42001 is the management system anchor, with ISO/IEC 42006 as the additional requirements for certification bodies auditing AIMS built on ISO/IEC 17021-1. To accelerate availability, SCC referenced draft ISO/IEC 42006 to accredit the first certification body, then initiated a structured transition once the 2025 edition was published. The first accreditation is now transitioning to the final text. All subsequent accreditations and new applicants will be assessed against the published ISO/IEC 42006 requirements.

Early Signals and What’s Next

SCC has accredited its first AIMS certification body with additional applicants in the pipeline. Organizations are mapping inventories, clarifying ownership and aligning AI governance with existing information security and privacy programs. SCC will continue onboarding certification bodies, refining guidance and training based on assessor feedback, and sharing technical insights with peers as the program evolves.