Where we work · Canada
ISO and GRC certification consulting in Canada
Achieve ISO and GRC certification in Canada with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 21 standards, one team
- Accredited certification route
- Toronto office team
- Effivity and Academy included
Sectors that ask for certification in Canada
Clients include
ISO and GRC certification in Canada at a glance
Certification and compliance demand in Canada is shaped by federal regulators, provincial privacy law and customer procurement. The Office of the Superintendent of Financial Institutions (OSFI) sets expectations through Guideline B-13, Guideline B-10 and the Regulatory Compliance Management Guideline, while the Bank of Canada supervises payment service providers under the Retail Payment Activities Act. PIPEDA, overseen by the Office of the Privacy Commissioner of Canada, sits beside Quebec's law, enforced by the Commission d'accès à l'information du Québec, and the Alberta and British Columbia Personal Information Protection Acts. Health Canada ties Class II, III and IV medical device licences to ISO 13485, and the Canadian Food Inspection Agency requires preventive control plans from licensed food businesses. Demand comes mainly from SaaS and technology providers, financial services, fintech and payments, healthcare and medical devices, manufacturing and automotive suppliers, aerospace and defence, food processing and export, and professional services. Certificates come from accredited certification bodies, with the Standards Council of Canada as the national accreditation body. Sterling's Toronto office draws on 8,100+ client engagements in 60+ countries and 20+ years of experience, and Effivity and Sterling Academy are included with the engagement.
ISO and GRC standards Sterling delivers in Canada
Each page covers who needs the standard in Canada, its requirements, how to get it, what sets the time and cost, and the local laws behind it.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in Canada (17)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Personal Information Protection and Electronic Documents Act (PIPEDA) Office of the Privacy Commissioner of Canada (OPC) | Applies to private-sector organisations that collect, use or disclose personal information in the course of a commercial activity, and always to federally regulated organisations (including their employees' personal information); organisations in the Northwest Territories, Yukon and Nunavut are treated as federally regulated. Personal information crossing provincial or national borders in commercial activity is subject to PIPEDA in every province. Personal information must be protected by security safeguards appropriate to its sensitivity, and breaches of security safeguards that create a real risk of significant harm must be reported to the Commissioner and notified to affected individuals. | |
| Quebec private-sector privacy law Commission d'accès à l'information du Québec (CAI) | Deemed substantially similar to PIPEDA. Where a confidentiality incident presents a risk of serious injury, the enterprise must promptly notify the Commission and the persons concerned, and must keep a register of incidents that is sent to the Commission at its request. | |
| Alberta and British Columbia private-sector privacy laws the respective provincial privacy regulator | Organisations subject to a substantially similar provincial law are generally exempt from PIPEDA for activities within that province; PIPEDA still applies to cross-border flows and to federally regulated organisations. | |
| Provincial health information laws the respective provincial regulator | Relevant to health information custodians and their service providers; the specific act and regulator differ by province — confirm the provincial instrument before quoting it on a page. | |
| Office of the Superintendent of Financial Institutions (OSFI) Federally regulated financial institutions (banks, foreign bank branches, insurers, trust and loan companies) | Guideline B-13 Technology and Cyber Risk Management — expectations covering governance, technology operations and resilience (including change, incident and problem management, and disaster recovery) and cyber security; it does not name ISO/IEC 27001. | |
| Office of the Superintendent of Financial Institutions (OSFI) Third-party providers to federally regulated financial institutions | Guideline B-10 Third-Party Risk Management — where risk or criticality requires, the institution should ensure third parties with elevated technology and cyber risk comply with the institution's standards or recognised industry standards; no standard is named. | |
| Office of the Superintendent of Financial Institutions (OSFI) Federally regulated financial institutions — regulatory compliance risk | Regulatory Compliance Management (RCM) Guideline — expectations for an enterprise-wide RCM framework to manage and mitigate regulatory compliance risk; no ISO standard is named. | |
| Bank of Canada Payment service providers performing retail payment activities | Retail Payment Activities Act — a payment service provider must establish, implement and maintain a risk management and incident response framework that meets prescribed requirements, which the Bank may assess; no standard is named. | |
| Health Canada (Minister of Health) Medical device manufacturers applying for Class II, III or IV medical device licences | Medical Devices Regulations (SOR/98-282) — licence applications must include a copy of a quality management system certificate showing the quality management system meets National Standard of Canada CAN/CSA-ISO 13485, issued by a registrar recognised by the Minister. | ISO 13485 |
| Canadian Food Inspection Agency (CFIA) Food businesses licensed to import, export or trade food inter-provincially | Safe Food for Canadians Regulations (SOR/2018-108) — licence holders must prepare, keep and maintain a written preventive control plan, including critical control points, critical limits and monitoring procedures; the regulations do not name HACCP or ISO 22000. | |
| Canadian Centre for Cyber Security Small and medium organisations (cyber security guidance) | Baseline cyber security controls for small and medium organizations — describes the ITSG-33 Annex 4A Profile 1 as the Canadian specification of controls equivalent to the NIST Cyber Security Framework or ISO/IEC 27001:2013, and recommends following PCI DSS for point-of-sale terminals and financial systems. | ISO/IEC 27001, PCI DSS |
| Standards Council of Canada (program authority since 31 March 2023; previously Innovation, Science and Economic Development Canada) Small and medium organisations seeking a national cyber security certification | CyberSecure Canada certification program. | |
| Treasury Board of Canada Secretariat Federal institutions using automated decision systems, and vendors supplying them | Directive on Automated Decision-Making — applies to automated decision systems developed or procured after April 1, 2020; no ISO standard is named. | |
| Innovation, Science and Economic Development Canada (ISED) Organisations developing or managing advanced generative AI systems | Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems — measures under accountability, safety, fairness and equity, transparency, human oversight and monitoring, and validity and robustness, adopted by signatories. | |
| Federal statute and regulations (Canada Labour Code); provincially regulated workplaces follow their province's occupational health and safety law Federally regulated workplaces (occupational health and safety) | Canada Labour Code and occupational health and safety regulations made under it, including the Canada Occupational Health and Safety Regulations; the Act page does not cite ISO 45001. | |
| Federal statute (Canadian Environmental Protection Act, 1999) Environmental protection (federal) | Canadian Environmental Protection Act, 1999; the Act page does not cite ISO 14001. | |
| Federal statute (Parliament of Canada) Companies dealing with foreign public officials | Corruption of Foreign Public Officials Act; does not cite ISO 37001. |
Accreditation and recognition
- Standards Council of Canada (SCC): National accreditation body; ILAC MRA signatory for calibration and testing (ISO/IEC 17025), medical testing (ISO 15189) and proficiency testing providers (ISO/IEC 17043).
- Canadian Association for Laboratory Accreditation Inc. (CALA): Laboratory accreditation body; ILAC MRA signatory for testing (ISO/IEC 17025).
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Cities
Tenders and procurement
- Standard Acquisition Clauses and Conditions (SACC) Manual — clause D5540C, ISO 9001:2015 Quality Management Systems - Requirements (Quality Assurance Code Q) (Public Services and Procurement Canada (published on CanadaBuys)): Used in Department of National Defence contracts where line items carry Quality Assurance Code Q: the contractor must comply with ISO 9001:2015. The clause states that it is not intended that the contractor be registered to ISO 9001, but the contractor's quality management system must address all requirements appropriate to the scope of the work.
- CanadaBuys tendering service (Government of Canada): The home for doing business with the Government of Canada and the broader Canadian public sector, where tender opportunities are published. Certificate requirements, where any, are set in the individual solicitation.
Sterling in Canada
Sterling delivers in Canada from its Toronto office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
What the standards require, clause by clause
Before you start in Canada, read what each clause and subclause requires of you, how to implement it, the evidence auditors look for and the mistakes to avoid.
- ISO 9001:2026 requirements95 clause guides
- ISO/IEC 27001:2022 requirements143 clause guides
- ISO 14001:2026 requirements53 clause guides
- ISO 45001:2018 requirements60 clause guides
- ISO 22000:2018 requirements95 clause guides
- ISO/IEC 17025:2017 requirements68 clause guides
- ISO/IEC 42001:2023 requirements97 clause guides
Questions Canadian clients ask
Are certification audits in Canada conducted in English or French?
Either. English and French are Canada's official languages under the Official Languages Act, so the audit language is a matter to agree, not a fixed rule. Settle the audit language and the language of controlled documents with the certification body at application. Organisations operating in Quebec should check the French-language requirements that apply to their workplace documents before choosing the documentation language.
Does PIPEDA apply to us, or a provincial privacy law?
It depends on where and how you operate. PIPEDA covers private-sector organisations handling personal information in commercial activity, always covers federally regulated organisations, and applies to information crossing provincial or national borders. Quebec's private-sector law and the Alberta and British Columbia Personal Information Protection Acts are deemed substantially similar, so in-province activity is generally exempt from PIPEDA. Confirm your position with your counsel or the privacy regulator.
Do Canadian federal contracts require ISO certificates?
Not as a general rule. Certain Department of National Defence contracts, those with Quality Assurance Code Q line items, use clause D5540C, which requires the contractor to comply with ISO 9001:2015 while stating that registration is not intended. Other opportunities are published on CanadaBuys, where any certificate requirement is set in the individual solicitation, so read each one before you bid.
What do OSFI-regulated clients expect from their technology suppliers?
Mostly outcomes, not a named certificate. Guideline B-13 sets expectations for governance, technology operations, resilience and cyber security without naming ISO/IEC 27001. Guideline B-10 says that where risk or criticality requires, third parties with elevated technology and cyber risk should comply with the institution's standards or recognised industry standards, and it names none. Ask each institution which evidence it will accept from you.
Cities Sterling covers in Canada
Each city page sets out the industries, zones and standards that matter locally.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Personal Information Protection and Electronic Documents Act (PIPEDA) — laws-lois.justice.gc.ca; priv.gc.ca (accessed 5 Oct 2026)
- Quebec private-sector privacy law — legisquebec.gouv.qc.ca; priv.gc.ca (accessed 5 Oct 2026)
- Alberta and British Columbia private-sector privacy laws — priv.gc.ca (accessed 5 Oct 2026)
- Provincial health information laws — priv.gc.ca (accessed 5 Oct 2026)
- Guideline B-13 Technology and Cyber Risk Management — osfi-bsif.gc.ca (accessed 5 Oct 2026)
- Guideline B-10 Third-Party Risk Management — osfi-bsif.gc.ca (accessed 5 Oct 2026)
- Regulatory Compliance Management (RCM) Guideline — osfi-bsif.gc.ca (accessed 5 Oct 2026)
- Retail Payment Activities Act — laws-lois.justice.gc.ca; bankofcanada.ca (accessed 5 Oct 2026)
- Medical Devices Regulations (SOR/98-282) — laws-lois.justice.gc.ca (accessed 5 Oct 2026)
- Safe Food for Canadians Regulations (SOR/2018-108) — laws-lois.justice.gc.ca (accessed 5 Oct 2026)
- Baseline cyber security controls for small and medium organizations — cyber.gc.ca (accessed 5 Oct 2026)
- CyberSecure Canada certification program — ised-isde.canada.ca (accessed 5 Oct 2026)
- Directive on Automated Decision-Making — tbs-sct.canada.ca (accessed 5 Oct 2026)
- Voluntary Code of Conduct on the Responsible Development and Management of Advanced Generative AI Systems — ised-isde.canada.ca (accessed 5 Oct 2026)
- Canada Labour Code and occupational health and safety regulations made under it, including the Canada Occupational Health and Safety Regulations; the Act page does not cite ISO 45001 — laws-lois.justice.gc.ca (accessed 5 Oct 2026)
- Canadian Environmental Protection Act, 1999; the Act page does not cite ISO 14001 — laws-lois.justice.gc.ca (accessed 5 Oct 2026)
- Corruption of Foreign Public Officials Act; does not cite ISO 37001 — laws-lois.justice.gc.ca (accessed 5 Oct 2026)
- Standards Council of Canada (SCC) — ilac.org (accessed 5 Oct 2026)
- Canadian Association for Laboratory Accreditation Inc. (CALA) — ilac.org (accessed 5 Oct 2026)
- Standard Acquisition Clauses and Conditions (SACC) Manual — clause D5540C, ISO 9001:2015 Quality Management Systems - Requirements (Quality Assurance Code Q) — canadabuys.canada.ca (accessed 5 Oct 2026)
- CanadaBuys tendering service — canadabuys.canada.ca (accessed 5 Oct 2026)
Talk to a consultant
Plan your certification with the Toronto team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
canada@sterling-grc.com+1 201 263 4443 (global headquarters, New York) · the Toronto office is reached by e-mail at canada@sterling-grc.com
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice