ISO/IEC 42001: how to show clients your AI is governed

Clients and procurement teams have started adding a new line to their security questionnaires: “How do you govern your use of AI?” A policy page is no longer enough for many of them. They want evidence. ISO/IEC 42001 is quickly becoming the way to provide it.

The gap is real. PwC Canada’s 2026 Trust in AI report found that 72% of organizations prioritize responsible AI, yet 36% have no AI governance function (PwC Canada). In Quebec, Raymond Chabot Grant Thornton warned this month that the biggest AI risk for small and medium businesses is not the technology but its use without a framework (RCGT).

What ISO/IEC 42001 is

ISO/IEC 42001:2023, published on 2023-12-18, specifies requirements for an AI management system. ISO describes it as “the world’s first AI management system standard” (ISO). It applies to organizations that develop, provide or use AI-based products or services.

Like ISO 27001, it is a management system standard. It does not certify that a model is safe or accurate. It certifies that the organization has a working system to govern AI: policy, roles, risk and impact assessment, controls over the AI lifecycle, supplier oversight, monitoring and continual improvement.

Why it fits with ISO 27001

Organizations already certified to ISO 27001 have most of the scaffolding: scope, leadership commitment, risk methodology, internal audit and management review. 42001 adds AI-specific elements, such as AI impact assessments, data quality and provenance, transparency to users, and oversight of third-party AI services. One integrated management system, audited together, is usually more efficient than two.

Accredited certification matters

Not all 42001 certificates carry the same weight. In 2025, ISO published ISO/IEC 42006, which sets the requirements for bodies that audit and certify AI management systems (ISO). In Canada, the Standards Council of Canada states it is “the only accreditation body in Canada offering Artificial Intelligence Management Systems accreditation”, and it requires certification bodies to transition to ISO/IEC 42006:2025 (SCC).

When a supplier shows you a 42001 certificate, ask who issued it and whether that body is accredited for AI management systems by SCC or another recognized accreditation body.

Do you need certification?

• You build AI into products you sell: certification is becoming a sales tool, especially with enterprise and EU clients.
• You use AI internally on client or personal data: you may not need a certificate, but you need the governance. Quebec’s Law 25 already imposes duties for automated decisions; see automated decisions under Law 25 and Bill C-36.
• You are early: start with an AI inventory, an acceptable-use policy and a simple impact assessment. Those become the foundation of a 42001 program later.

A practical first 90 days

1. Inventory every AI system and AI-enabled service in use, including the ones staff adopted on their own.
2. Assign an accountable owner and set an acceptable-use policy.
3. Run impact assessments on the systems that touch personal information or make decisions about people.
4. Add AI questions to your supplier reviews.
5. If you hold ISO 27001, map 42001 clauses onto your existing management system and decide whether to certify both together.

Accel GRC tracks AI governance alongside ISO 27001 and privacy controls, and KW Consulting helps organizations prepare for certification. See also ISO 27001 or SOC 2? Contact us.

Sources

• ISO: ISO/IEC 42001:2023, AI management systems
• ISO: ISO/IEC 42006:2025, requirements for bodies auditing AI management systems
• Standards Council of Canada: Artificial Intelligence Management Systems accreditation
• PwC Canada: 2026 Trust in AI report (2026-02-03)
• Raymond Chabot Grant Thornton: AI risk for SMEs is unmanaged use (2026-10-01, French)