KPMG Canada gains ISO 42001 AI governance certification

KPMG Canada has received ISO 42001 certification for its artificial intelligence management system, placing it among the first firms in Canada to gain the AI governance standard.

Developed by the International Organisation for Standardisation, the standard sets out a framework for governing the development, deployment and use of AI systems through accountability, risk management, oversight, monitoring and continuous improvement.

The certification strengthens KPMG Canada's internal approach to responsible AI and gives it direct experience applying formal governance controls as clients expand their use of the technology. As businesses move from AI trials to broader deployment, boards, regulators and executives are increasing scrutiny of how those systems are managed.

Stephanie Terrill, Canadian managing partner of digital transformation at KPMG Canada, said the certification also reflects the firm's own governance practices.

"Our clients trust us to help them navigate complex technology transformations with confidence. Achieving ISO 42001 certification reflects our dedication to responsible AI and validates the governance, accountability and oversight practices we've put in place within our own organization. It also gives us first-hand experience so we can better support clients as they look to scale AI and build trust in their own systems," Terrill said.

Governance focus

The move comes as AI governance becomes a more prominent issue for Canadian companies. KPMG's Global AI Pulse survey found that 82 per cent of Canadian business leaders said concerns over data security, privacy and risk were causing them to pause or slow parts of their AI strategy.

The same survey found that four in five respondents said AI-related issues are already being discussed at the board level, pointing to broader concern over accountability and controls as adoption grows.

ISO 42001 is intended to address unclear accountability, inconsistent risk assessments, fragmented oversight and limited visibility into how AI is used across an organisation. The framework translates broad governance principles into documented controls, monitoring processes and independent assurance.

Kareem Sadek, partner and national leader of trusted AI and digital assets at KPMG Canada, linked the certification to those broader market concerns.

"Organisations are moving quickly from AI experimentation to enterprise-scale deployment, but the technology alone is not enough. Business leaders, boards and regulators are increasingly asking how AI is being governed, who is accountable, and whether organizations can demonstrate that they have the appropriate controls in place. By pursuing the ISO 42001 certification and further embedding responsible AI governance into our own operations, we've gained practical experience and insights we can share with clients who are facing the same questions," Sadek said.

Independent review

Schellman Compliance, which KPMG identified as an accredited ISO 42001 certification body, carried out the certification process. Independent assessment is a central part of the standard, designed to show whether an organisation has formal AI management systems in place rather than relying on informal policies alone.

For professional services firms, the certification is likely to draw close attention from clients seeking not only AI adoption strategy but also evidence of governance in advisers' own operations. The issue has become more pressing as companies deploy AI in customer service, internal productivity tools, analytics and decision-making processes that can raise concerns over data handling and accountability.

KPMG employs more than 10,000 people across more than 40 locations in Canada and provides audit, tax and advisory services to public and private sector clients. The certification adds to a growing set of external standards companies are using to demonstrate how they manage AI-related risks.

"The value of this certification extends beyond just compliance. It helps create the confidence needed to scale AI responsibly. Organisations need governance models that enable innovation rather than slow it down. When leaders have greater visibility into how AI is being used, who is accountable and how risks are being managed, they can move faster and make decisions with greater assurance," Sadek said.