A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →ISO/IEC 42001 is the international standard for an AI management system (AIMS), published in 2023. It specifies how an organization should govern the development and use of artificial intelligence through risk assessment, defined roles, and continual improvement, in the same management-system shape as ISO 27001. It is certifiable by an accredited body, which makes it the first auditable AI governance standard.
The management system is the deliverable, not a model audit. ISO 42001 asks you to identify where AI creates risk, decide controls, assign owners, and show the system operates and improves, which is familiar territory to anyone who has run an ISMS.
For most Canadian companies the honest sequence is a gap assessment first, because nobody can scope the remediation until the gaps are known. We run that assessment and map it against adjacent obligations such as the EU AI Act and Quebec Law 25's automated-decision rules so the work is not duplicated.
traztech delivers ISO 42001 AI management system readiness for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
ISO 42001 enters the conversation once a company either builds AI into its product or adopts it widely enough internally that somebody asks who governs it. The pattern mirrors ISO 27001: a buyer or investor wants evidence that AI risk is managed by a system rather than by good intentions. This is what ISO 42001 readiness sets up.
Teams who hold ISO 27001 recognise the machinery immediately: scope, risk assessment, a Statement of Applicability equivalent, internal audit and management review. What is new is the subject matter, including data quality, model lifecycle, transparency and human oversight. Our whether you need ISO 42001 post walks through the decision.
No. ISO 42001 is a voluntary management-system standard you can certify against. The EU AI Act is binding law with obligations based on risk classification. Holding the certificate helps demonstrate diligence but does not by itself make you AI Act compliant.
Not automatically. They overlap in structure, so the second is cheaper to add, but 42001 is worth pursuing only when AI is material to your product or operations and buyers are asking about it.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
Track record
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation with zero exceptions.