What changed on 1 January 2026
O. Reg. 364/25, Health and Safety Management Systems and Procurement, made under the Occupational Health and Safety Act, came into force on 1 January 2026. Where a public buyer requires a health and safety management system accredited by Ontario's Chief Prevention Officer as a condition of bidding construction work, the regulation requires that every accredited system be treated as equivalent.
The province's own guidance puts it plainly: the organization "must recognize all CPO-accredited systems as equivalent. They cannot accept some CPO-accredited system and exclude others." Failing to comply carries an administrative penalty of $100,000 or 10 per cent of the project value, whichever is lower.
What counts as accredited
As of October 2025 the Chief Prevention Officer has accredited five standards. Any of them satisfies a public buyer's certification requirement for construction work.
- IHSA COR™ 2020
- ISO 45001:2018
- CSA Z45001-19
- Responsible Care® RC14001:2023
- Responsible Care® RCMS:2023
So why still choose COR?
Because for a 10 to 50 person Ontario contractor it is almost always the cheapest and most practical of the five. COR 2020 was built for construction, it is administered provincially by IHSA, and the audit is conducted against work your crews actually do. ISO 45001 and CSA Z45001 require a third-party certification body accredited through the International Accreditation Forum, which costs more and is written for a general industrial audience. Responsible Care is a chemical industry scheme.
The point of the regulation is not that COR matters less. It is that you now have a choice, and a buyer cannot insist on one accredited system over another.
Buyers with a published requirement
Only buyers whose own current procurement pages we could verify are listed. Requirements change, so each entry cites its source and date.
City of Toronto
In force- Applies to
- All construction contracts, at the qualification stage, maintained for the contract duration. No dollar threshold.
- Accepts
- IHSA COR® 2020, MLITSD Supporting Ontario's Safe Employers, or ISO 45001:2018. Out-of-province COR needs a Letter of Reciprocity from IHSA.
- Note
- Subcontractors are exempt from holding certification themselves. The City reserves the right to accept or reject a bidder's certificate.
Source: City of Toronto, OHSMS certificate. Page modified 28 February 2025; requirement effective 31 March 2025.
Infrastructure Ontario
In force- Applies to
- Bidders on IO construction projects, maintained for the full duration of the project. No dollar threshold published.
- Accepts
- Any CPO-accredited health and safety management system. IO's current page does not name COR specifically.
- Note
- On P3 projects, bidders must also submit the qualifications of their proposed safety coordinator at prequalification.
Source: Infrastructure Ontario, Health and Safety. Undated.
Greater Toronto Airports Authority
In force- Applies to
- Contractors taking the Constructor role on GTAA projects valued over $5 million.
- Accepts
- COR® 2020 or ISO 45001:2018. ISO certificates must come from a body accredited through the International Accreditation Forum.
- Note
- Separately, every GTAA contractor needs a safety prequalification Status Letter, renewed every three years and submitted with each bid.
Source: Toronto Pearson, Before You Start, 2025 contractor guidelines. As a federal airport authority the GTAA is not bound by O. Reg. 364/25.
Region of Durham
Phasing in- Applies to
- Phased by project value: over $25 million from 1 December 2026, over $10 million from 1 June 2027, over $500,000 from 1 June 2028. Subcontractors excluded.
- Accepts
- IHSA COR®, ISO 45001 from an IAF-recognised body, or any other CPO-accredited system.
- Note
- Nothing is mandatory yet. Durham currently encourages vendors to start the process early.
Source: Region of Durham, Purchasing, notice to vendors and bidders. Undated.
Outdated figures still in circulation
Most of the dollar thresholds quoted online trace back to one list IHSA published in November 2016. It is ten years old and nearly every figure in it has been superseded.
Two examples you will still see quoted as current:
- "The TTC requires COR on projects over $25 million." That was the original tier when the requirement began in July 2014. It was replaced through later phases, and the TTC's own page now states the requirement applies to all construction contracts irrespective of value.
- "Infrastructure Ontario requires COR on Direct Delivery projects over $10 million." That came from an IO news release dated May 2017, which is still live. IO's current health and safety page says something materially different and does not mention COR at all.
Some buyers' published pages also still name COR as the only acceptable certification and predate the regulation. If you are bidding one of those, ask their procurement contact what they currently accept and keep the answer in writing.
How to check a specific tender
- Read the prequalification requirements attached to the tender itself, not the buyer's general web pages
- Check whether the requirement applies above a project value threshold or to every contract
- Check which accredited systems are listed, and whether out-of-province reciprocity is accepted
- Ask the procurement contact directly, and keep the answer in writing
Send us what a buyer or general contractor has asked you for and we will tell you what it actually requires. It is often less than it looks.
Verified against primary sources in November 2026: O. Reg. 364/25 and the Supporting Ontario's Safe Employers accredited-systems list on ontario.ca, and each buyer's own procurement pages as cited. This page is general information, not legal advice. Confirm current requirements with the buyer before relying on them for a bid.