A TGV certificate issued by the Bureau de certification of Santé Québec is valid for five years, but it is renewed one year at a time. The bureau's attestation template (BC-D0001-01) states that "une reconduction tacite d'un an de la certification aura lieu dès l'acceptation par le BC du contenu du formulaire d'autodéclaration et du respect de tous les engagements énumérés à l'annexe 1" ("a tacit one-year renewal of the certification will take place once the bureau accepts the content of the self-declaration form and the respect of all the commitments listed in Annex 1"). One of those commitments is a penetration test every year. The bureau's register of certified products, in its October 2026 edition, lists 95 dated listings, and 28 of them were obtained in 2026: a large group of suppliers is about to meet its first anniversary.
This brief is for the supplier that already holds the certificate, or received it this year. It covers what keeping the certificate requires: the nine commitments, the 12-point self-declaration, the yearly penetration test under criterion S16.03, product changes, and a 12-month calendar. The application process is covered in the TGV certification guide and the test rules in the French guide to the TGV penetration test. Every requirement below was read on 11 October 2026 from the bureau's documents as published on Québec.ca, and from the MSSS pages as last updated 20 May 2026, 8 June 2026 and 5 May 2025, with French wording quoted and translated.
Where Stingrai fits: Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements. Stingrai performed the TGV-scoped penetration test for Bia Education, a Quebec healthtech platform, as part of its certification. The annual test is run by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, with retesting included so the report confirming the fixes can go to the bureau with the self-declaration.
Quick answer. A TGV certificate is valid for five years but renews tacitly one year at a time, once the bureau accepts the annual self-declaration and the supplier has respected all nine commitments in Annex 1 of the attestation. The self-declaration (BC-F0003-01) has 12 points and must reach the bureau at least 15 days before the certification anniversary. The supplier must undergo at least one penetration test a year with an independent firm following the bureau's orientation, fix or mitigate the findings (15 days after the report in the self-declaration, a deadline agreed with the bureau in the current attestation), report any critical vulnerability with a plan within three business days, and attach the test report confirming the fixes. Major changes must be submitted before production, and a new version is not certified de facto. Stingrai runs the annual test as a one-time engagement timed to the anniversary or as a continuous program, with retesting included.
What the attestation commits a certified supplier to
The attestation is the document both parties sign when certification is granted. Its first obligation is broader than most suppliers remember: the supplier commits, "pour toute la durée de la certification TGV, à ce que le PST certifié satisfasse en tout temps à toutes les exigences qui ont été évaluées lors de l'étape de vérification" ("for the whole duration of the TGV certification, that the certified product meets at all times all the requirements evaluated during the verification stage"), as listed in the verifying firm's report. The certificate is not a snapshot; it is a promise that the verified state holds.
Annex 1 then lists nine commitments that the attestation calls "indispensables au maintien et au renouvellement annuel de la certification TGV" ("indispensable to maintaining and renewing the TGV certification annually").
# | Commitment (attestation BC-D0001-01, Annex 1) | Frequency or deadline | Evidence the bureau sees |
|---|---|---|---|
1 | Log every change made after certification in a register | Continuous | Change register, submitted on request |
2 | Submit every major change for evaluation and approval | At least 15 days before production (20 days on the bureau's page) | Change submission, bureau approval |
3 | Undergo at least one penetration test a year with an independent firm, following the bureau's orientations | Annually | Test results and proof of mitigation, by the time the self-declaration is filed |
4 | Fix or mitigate vulnerabilities found in penetration tests; report critical ones | Deadline agreed with the bureau; critical: inform at once, plan within three business days | Mitigation plan, retest report |
5 | Report any major problem found in the product | At once; correction plan within three business days | Notice and plan |
6 | Run a disaster recovery exercise in a separate centre | Every two years | Recovery plan and exercise report |
7 | Update the product at the bureau's request to keep meeting the requirements | On request | Updated version |
8 | Interface only with products certified or approved by the bureau | Continuous | Integration list |
9 | Complete and submit the self-declaration form | At least 15 days before the anniversary | Signed BC-F0003-01 with attachments |
The same attestation closes with the consequence: failure to respect these commitments "peut entraîner des mesures correctives incluant notamment le non-renouvellement de la certification, la publication d'une non-conformité sur le site du BC, la tenue d'une vérification ciblée, une réévaluation du statut de certification ou, selon la gravité du manquement, le retrait de la certification" ("may lead to corrective measures including non-renewal of the certification, publication of a non-conformity on the bureau's site, a targeted verification, a reassessment of the certification status or, depending on the seriousness of the breach, withdrawal of the certification").
The Règle particulière sur la certification des produits et services technologiques (version 1.00, 20 June 2013) set the same duties long before the current templates, including an up-to-date change register and the duty to "se soumettre, au besoin, au processus de suivi" ("submit, as needed, to the follow-up process"). Because article 3 of that rule directs the network to acquire only certified versions where a certification exists, a lapsed or suspended status reaches the sales pipeline, not only the compliance file.
Five years, renewed one year at a time
Three documents agree on the five-year term, and the bureau's own pages qualify it twice.
The attestation says it is valid "pour une durée de cinq ans, pourvu que le FOURNISSEUR respecte ses obligations" ("for five years, provided the supplier meets its obligations"), with the tacit one-year renewal quoted above.
The certificate template (BC_TGV_CERTIFICAT) carries two dates, "Délivré le" (issued on) and "Échéance" (expiry). The expiry date on your certificate is the end of the five-year term; the anniversary of the attestation drives the annual cycle.
The register of certified products notes that "le certificat TGV a une validité de cinq (5) ans, suite au rehaussement du processus de suivi après certification" ("the TGV certificate is valid for five years, following the enhancement of the post-certification follow-up process").
The first qualification is on the About certification page: certifications "sont renouvelables annuellement après évaluation du formulaire d'autodéclaration démontrant le respect des engagements" ("are renewable annually after evaluation of the self-declaration form showing that the commitments were respected"). The second is a sentence suppliers tend to skip: "La certification est valide tant qu'il n'y a pas eu de changements, à l'application elle-même ou dans les systèmes informationnels du secteur de la santé et des services sociaux" ("The certification is valid as long as there have been no changes, to the application itself or in the information systems of the health and social services sector"). That is why the change rules later in this brief matter as much as the annual test.
The MSSS guide of 21 June 2024 (24-715-38W), still linked from the bureau's orientations page, describes a three-year term and 20 business days for both the major-change notice and the self-declaration. The current Santé Québec templates use five years and 15 days; where they disagree, the attestation you signed binds you.
What the register shows in October 2026
The bureau publishes the register as a PDF, Tableau des produits et services technologiques certifiés par familles. The edition dated October 2026 (file created 8 October 2026) lists each product with its certified version and the date certification was obtained.
Year certification was obtained | Listings (October 2026 edition) |
|---|---|
2021 | 5 |
2022 | 9 |
2023 | 15 |
2024 | 15 |
2025 | 23 |
2026 | 28 |
Shown as "Suspendu" (suspended) | 1 |
Four details matter to a certified supplier.
Suspensions are public. One listing shows "Suspendu" in place of a certification date, with no reason given. Acquirers in the network read this document.
Dates move at the five-year mark. In the January 2026 edition, eight listings carried 2021 dates. Of the three dated February and April 2021, two products from the same supplier now carry April and May 2026 dates with the same name and version, and the third has been replaced by a differently named product from the same supplier, certified in June 2026; the five remaining 2021 listings are dated 27 October to 15 December 2021. The bureau does not publish what each re-dating involved; ask it what your own five-year mark will require well before the expiry on your certificate.
Versions can move without a new date. One listing's certified version changed from 0.4.x in the January edition to 0.6.x in October while its 2023 certification date stayed the same, consistent with a change evaluation that confirmed the new version.
The AI family doubled. The family "Reconnaissance vocale et transcription basée sur IA" held five products in January 2026 and ten in October 2026.
The annual self-declaration, point by point
The self-declaration (Autodéclaration, suivi et évaluation annuelle des engagements, BC-F0003-01, publication 24-715-75W) is signed by a duly mandated representative and declares that the commitments made to the bureau were respected for the product and version named. Its signature block states that it was "complété et soumis au BC au moins quinze jours avant la date d'anniversaire de la signature de l'attestation de la certification TGV" ("completed and submitted to the bureau at least fifteen days before the anniversary of the signature of the TGV certification attestation"). Each of the 12 points is answered Oui or Non.
# | What the supplier declares (BC-F0003-01) | What to have ready |
|---|---|---|
1 | All changes since certification were logged in the change register | The register itself, dated entries per release |
2 | The change register is available and can be submitted on request | Export of the register |
3 | All major changes were submitted at least fifteen days before production, as listed in an annex | The annex listing each major change and its submission date |
4 | No major change went to production before the bureau's approval | Approval emails matched to release dates |
5 | The product interfaced only with products certified or approved by the bureau | Integration inventory checked against the register |
6 | At least one penetration test was carried out "au cours de la dernière année suivant les exigences et recommandations du BC" ("in the last year following the bureau's requirements and recommendations") | Test report, dated within the year |
7 | All vulnerabilities found were fixed or mitigated "dans les quinze jours suivant le rapport de test" ("within fifteen days of the test report") | Remediation log with dates |
8 | All critical vulnerabilities were brought to the bureau's attention with a correction or mitigation plan within three days of identification | Notices sent to the bureau and the plans |
9 | The penetration test report confirming the fixes or mitigations is attached | Retest report or updated report |
10 | Any major problem was reported at once, with a correction plan within three business days | Incident notices and plans |
11 | A disaster recovery exercise in a separate centre was carried out in the last two years | Exercise record |
12 | The recovery plan and the report summarising the exercise are attached | Plan and exercise report |
Point 9 asks for a report that confirms the corrections, which in practice means a retest; a report listing open findings does not answer it. Point 7 uses a fixed 15-day window while the current attestation (commitment 4) refers to "une échéance convenue avec le BC" ("a deadline agreed with the bureau"). Agree the deadline in writing, then plan on 15 days, because that is the box you will tick.
The annual penetration test
What the yearly test has to be
The yearly test is the same requirement as the test you passed for certification, now on a calendar. Criterion S16.03 of the criteria list of 24 April 2026 reads "Soumettre votre application à un test d'intrusion administré par un prestataire indépendant et reconnu par Santé Québec" ("Submit your application to a penetration test administered by an independent provider recognised by Santé Québec"), and its evidence instruction asks for "une copie du rapport expliquant les résultats du test, la nature du test et, le cas échéant, le plan d'action qui en découle" ("a copy of the report explaining the test results, the nature of the test and, where applicable, the resulting action plan"). Commitment 3 ties the annual test to the bureau's orientation on penetration tests, unchanged since May 2024, so the same rules apply every year. Testing happens "dans un environnement de production ou un environnement équivalent à l'environnement de production" ("in a production environment or an environment equivalent to production"). Every role is identified and tested in its intended context, whether or not it is reachable from the web. White box is "acceptée dans tous les cas" (accepted in all cases), grey box is accepted only for certain non-sensitive products with no provincial deployment planned, and black box is "non acceptée par le BCH" (not accepted by the bureau). The bureau "acceptera les résultats des tests d'intrusion ... provenant uniquement d'un prestataire de service répondant minimalement aux exigences suivantes" ("will accept penetration test results only from a provider meeting at minimum the following requirements"), six conditions that include legally authorised representatives in Canada, criminal background evidence for the testers, and the ability, with the client's agreement, to provide the report in French to the bureau at no cost. The report must contain eight minimum elements, including each test "concluants ou non" (conclusive or not); the TGV certification guide lists them.
How the yearly test differs from the first one
Question | First test (application) | Annual test (after certification) |
|---|---|---|
Source of the obligation | Criterion S16.03 and the application form | Attestation commitment 3, self-declaration points 6 to 9 |
Freshness | Application form asks for a test "moins de six mois" (under six months) | At least one test "au cours de la dernière année" (in the last year) |
Scope reference | The product as presented for verification | The certified version plus every change logged since, including approved major changes |
What goes to the bureau | Report to the verifying firm during verification | Results and proof of mitigation "au plus tard lors du dépôt de l'autodéclaration" (at the latest when the self-declaration is filed) |
Fix evidence | Action plan | Report confirming fixes or mitigations (point 9) |
Deadline pressure | Before the criteria grid is due | 15 days after the report (point 7), and the anniversary |
Planning the yearly test
Time it against the anniversary, not the calendar year. Point 6 looks back over "la dernière année" (the last year), so the test date has to fall within twelve months of each self-declaration. Running it three to four months before the anniversary leaves room for the 15-day fix window, a retest, and assembling the pack before the 15-day filing deadline. It also keeps the report under six months old if a version change sends you back to the bureau with the renewal request form, which asks the same "moins de six mois" question as the original application.
Keep scope continuity, then add what changed. Start from last year's scope and the verifying firm's report, then add every entry in the change register: new features, roles, authentication methods, integrations or hosting. A test that drops a component tested last year is hard to explain in the self-declaration.
Choose the test type with the exception in mind. White box is accepted in all cases; grey box depends on the product being non-sensitive with no provincial deployment planned. Confirm with the bureau before relying on grey box.
Write the French deliverable and the retest into the statement of work. Both are easier to buy up front than to add later.
Changing testing firm is allowed; confirm it first. Nothing requires the same firm every year, and there is no public list of recognised firms, so send a new firm's details to certification@sante.quebec before the engagement starts.
Remediation clocks after the test
Three clocks run once the report lands: the 15 days of self-declaration point 7 (a deadline agreed with the bureau in the current attestation); for a critical vulnerability, notice to the bureau as soon as you know and a mitigation plan within three business days (commitment 4); and the government remediation matrix, which the bureau shares "à titre indicatif" (for information) and which runs from 2 calendar days for a very high impact, very high probability flaw on an internet-exposed asset with a fix available to 90 calendar days at the low end. Book the retest when you book the test.
When the product changes
The bureau's Applications certifiées page (last updated 20 May 2026) sets the rules. Every change is logged in a register. Changes "doivent être transmis au Bureau de certification pour évaluation" ("must be sent to the bureau for evaluation"), and the evaluation can lead to a verification by the auditing firms, "complète ou partielle" (complete or partial), or to confirmation that "la nouvelle version de l'application reste encore certifiée" ("the new version of the application remains certified").
Major changes must reach the bureau "au moins 20 jours avant la date prévue pour sa mise en production" ("at least 20 days before the planned production date"). The page lists nine kinds: a new feature; a change in access management (new authentication methods, profiles or access types such as mobile access); an interface with a new application; a change of development, deployment (cloud) or remote-control approach; a change that alters how the product met a criterion; replacing the solution; a change of operating system; a configuration change; and a new version bundling a batch of updates.
The attestation (commitment 2) and the self-declaration (point 3) use 15 days for the same notice, and the superseded 2024 guide used 20 business days. Plan on at least 20 days, the longest current requirement, and on 20 business days if you want to cover the 2024 guide as well.
Minor changes are defined on the same page as a change "servant notamment à corriger un problème de programmation ou une fonction existante" ("serving notably to correct a programming problem or an existing function"). The page adds "ou d'inclure une nouvelle fonction" ("or to include a new function") to the minor definition while listing a new feature as major; when in doubt, the page invites suppliers to write to certification@sante.quebec, and that is the safer course.
Version numbers carry meaning. The page requires three natural integers, major.minor.extension, with the major number incremented for each major update. Criterion S09.08 asks you to identify each change by a new version number and let users see it, and criterion S01.03 requires a risk assessment "chaque fois que des changements majeurs seront proposés" ("every time major changes are proposed").
New versions are not automatically certified. The orientations page (last updated 8 June 2026) describes the Formulaire pour une demande de renouvellement d'une certification TGV: "Les nouvelles versions des produits ou des services technologiques ne seront pas considérées de facto comme certifiées" ("New versions of technology products or services will not be considered certified de facto"). The bureau, the auditing body and the supplier assess the impact of the new version, and the form gathers the information "qui appuieront la décision de reconduire ou non la certification" ("that will support the decision whether or not to renew the certification"), so that only the elements directly or indirectly affected by the upgrade are evaluated. The form, as published on Québec.ca in October 2026, asks for the version to evaluate, whether the product had a penetration test under six months old (with its date, firm, scope, fixed and unfixed findings, and willingness to share the report), "une description globale des mises à jour effectuées depuis la dernière évaluation de suivi de certification" ("an overall description of the updates since the last certification follow-up evaluation") and the known impacts. The bureau's planning document sets the recurring follow-up "annuellement ou avant la mise en place d'un changement majeur" ("annually or before a major change is put in place").
New AI features
Adding an AI capability is a new feature on the bureau's list. Since 24 April 2026 the criteria list contains 382 criteria in seven domains, including an artificial intelligence domain of 69 criteria that did not exist when products certified before that date were verified. The bureau's documents do not say which list version a partial verification uses; plan on the list in force. Several AI criteria bear directly on change management:
IA20: "Le fournisseur s'engage à ne pas changer les types d'IA ou les modèles utilisés dans la SARIA sans approbation explicite de l'acquéreur" ("The supplier commits not to change the AI types or models used in the AI solution without the acquirer's explicit approval").
IA63 and IA64: the AI solution's version is always visible on its screens, changes with each update, and is stated in each result it produces.
IA35: the supplier communicates to the acquirer any new risk arising from the AI solution, its models or its datasets.
IA12: for generative AI, a report describing malicious prompt injection tests.
IA12 fits inside the annual penetration test, with the AI endpoints exercised under every role; the guide to TGV for AI health tools covers all 69 criteria.
Requirements that moved since your certificate
Commitment 7 obliges the supplier to update the product "à la demande du BC afin de répondre continuellement aux exigences de la certification TGV" ("at the bureau's request so as to meet the TGV certification requirements continuously"), and criterion T19 reads simply "Le PST doit toujours être à jour" ("The product must always be up to date"). Two publications since 2025 are worth checking your product against before the next cycle:
The criteria list of 24 April 2026, which replaced the June 2024 list of 254 criteria with 382 and renumbered the penetration test criterion from S16.02 to S16.03.
The orientation on multifactor authentication of 19 December 2025, which sets the AU3 level as the "niveau minimal exigé pour tout PST traitant des renseignements de santé ou de services sociaux" ("minimum level required for any product processing health or social services information") and lists SMS, voice call, fax, email and paper mail as prohibited ways to send a one-time code at that level.
A 12-month maintenance calendar
Deadlines in bold come from the bureau's documents; the rest is a planning recommendation that leaves slack for findings.
When | Action | Source of the deadline |
|---|---|---|
Month 0 | Confirm the anniversary date from the signed attestation and the expiry from the certificate; agree the remediation deadline with the bureau | Attestation, commitment 4 |
All year | Log every change; send major changes to the bureau at least 20 days before production | Applications certifiées page; attestation commitment 2 (15 days) |
All year | Report critical vulnerabilities and major problems at once, with a plan within three business days | Attestation, commitments 4 and 5 |
Month 6 | Scope review: certified version, change register, new roles, new integrations, AI features, requirements published since the last cycle | Planning recommendation |
Month 7 | Book the test firm; confirm it meets the six orientation conditions; tell the bureau if the firm is new | Orientation on penetration tests |
Month 8 | Run the penetration test in production or a production-equivalent environment, every role tested | Orientation on penetration tests |
Months 9 to 10 | Fix or mitigate within 15 days of the report; retest; obtain the report confirming the fixes | Self-declaration points 7 and 9 |
Month 11 | Assemble the pack: 12 points, change register annex, test and retest reports, recovery plan and exercise report if due | Self-declaration |
At least 15 days before month 12 | File the self-declaration | Attestation commitment 9; self-declaration |
Month 12 | Tacit one-year renewal on the bureau's acceptance | Attestation |
Every second year | Disaster recovery exercise in a separate centre | Attestation commitment 6 |
Annual TGV maintenance checklist
[ ] Note the anniversary of the attestation and the "Échéance" date on the certificate, and put the self-declaration deadline (15 days before the anniversary) in the release calendar.
[ ] Keep the change register current, with a version number for every change and the version visible to users.
[ ] Classify each change against the bureau's major-change list; when in doubt, write to certification@sante.quebec.
[ ] Submit major changes at least 20 days before production and keep the approval with the release record.
[ ] Before a new version ships, decide with the bureau whether to file the renewal request form.
[ ] Review the scope of the yearly test against last year's scope and every change logged since.
[ ] Confirm the test firm meets the six orientation conditions, including Canadian representation and a free French report to the bureau.
[ ] Test in production or a production-equivalent environment, with every role tested, white box or grey box only where the exception clearly applies.
[ ] Notify the bureau of any critical finding at once and send a mitigation plan within three business days.
[ ] Fix or mitigate within 15 days of the report, retest, and keep the report confirming the fixes.
[ ] Check the product against requirements published since your certification, including AU3 multifactor authentication.
[ ] Run the disaster recovery exercise every second year and keep the plan and report.
[ ] File the 12-point self-declaration with its attachments at least 15 days before the anniversary.
How Stingrai supports the annual TGV test
Stingrai holds firm-level CREST accreditation as a penetration testing service provider (CREST marketplace listing) and is one of a small number of CREST-accredited firms headquartered in Canada, which matters for the orientation's first condition. Stingrai performed the TGV-scoped penetration test for Bia Education, a Quebec healthtech platform, as part of its certification. Each human-led engagement is run by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, with 18 published CVEs across the team, bug bounty Hall of Fame recognition at Apple, Google, Facebook, Yahoo, the US Department of Defense and the US Federal Reserve, and a founding member of Uber's offensive security team.
For the annual cycle, that means:
Scope continuity: the test starts from last year's scope and the change register, so new roles, integrations and AI features are added rather than missed. Web application, mobile, AI and LLM and cloud components are covered in one engagement, tested in production or a production-equivalent environment across every role.
Evidence for the self-declaration: findings are posted to the PTaaS portal as they are confirmed, each with a working proof of concept, so fixing starts inside the 15-day window rather than after the report; live chat with the testers, Jira and Slack integration and redactable PDF reports follow; retesting is included, producing the report that confirms the fixes for point 9; and human-led and hybrid engagements close with an attestation letter.
One-time or continuous: one-time annual engagements timed to the anniversary, or continuous programs that test every release.
Where Snipe fits: for the web application and its APIs, Snipe, Stingrai's autonomous AI agent for web applications, works alongside the penetration testers in a hybrid engagement, hunting broken authorization, IDOR and business logic flaws across roles, and its automated retests and pull-request gating help between annual tests. Mobile, cloud, network and AI-layer testing is done by the penetration testers.
Published pricing: the Autonomous Pentest is US$3,000 per assessment or US$650 per month on a 12-month plan, and the Hybrid Pentest is US$6,800 per assessment or US$1,275 per month, both covering one web application and associated APIs. The Autonomous tier delivers the pentest report without penetration testers, so a TGV scope that needs the full role matrix, mobile, cloud or AI components is normally quoted as a human-led or hybrid engagement.
Frequently Asked Questions
Does a TGV-certified product need a penetration test every year?
Yes. Commitment 3 of the attestation requires the supplier "à passer annuellement au moins un test d'intrusion auprès d'une firme indépendante suivant les orientations en vigueur au BC" (to undergo at least one penetration test a year with an independent firm following the bureau's orientations in force), with the results and any proof of mitigation sent to the bureau at the latest when the self-declaration is filed. Point 6 of the self-declaration asks the supplier to declare that at least one test was carried out in the last year following the bureau's requirements and recommendations.
How long is a TGV certificate valid?
Five years, renewed one year at a time. The attestation is valid for five years provided the supplier meets its obligations, and a tacit one-year renewal follows the bureau's acceptance of the self-declaration and of all nine commitments in Annex 1. The certificate shows an issue date and an expiry date. The 2024 MSSS guide still describes three years; the current Santé Québec templates and the register use five.
When is the annual self-declaration due?
At least 15 days before the anniversary of the signature of the TGV certification attestation, according to the current attestation (commitment 9) and the self-declaration form BC-F0003-01. The 2024 MSSS guide gave 20 business days. The form has 12 yes-or-no points and requires the penetration test report confirming the fixes and, when due, the disaster recovery plan and exercise report as attachments.
What happens if the annual penetration test is late or missed?
The attestation lists corrective measures that include non-renewal of the certification, publication of a non-conformity on the bureau's site, a targeted verification, a reassessment of the certification status or, depending on the seriousness of the breach, withdrawal. The October 2026 register shows one listing as suspended, so status changes are visible to acquirers in the network.
Does the annual test have to follow the same rules as the first test?
Yes. The annual test must follow the bureau's orientation on penetration tests: production or a production-equivalent environment, every role identified and tested in its intended context, white box accepted in all cases, grey box accepted only for certain non-sensitive products with no provincial deployment planned, and black box not accepted. The firm must meet the orientation's six conditions, including legally authorised representatives in Canada and the ability to provide the report in French to the bureau at no cost.
What counts as a major change for a TGV-certified product?
The bureau's Applications certifiées page lists a new feature, a change in access management, an interface with a new application, a change of development, deployment or remote-control approach, a change that alters how the product met a criterion, replacing the solution, a change of operating system, a configuration change, and a new version bundling a batch of updates. Major changes must reach the bureau at least 20 days before production according to that page; the attestation says 15 days.
Is a new version of a certified product automatically certified?
No. The bureau's orientations page states that new versions "ne seront pas considérées de facto comme certifiées" (will not be considered certified de facto). The bureau, the auditing body and the supplier assess the new version's impact, and the bureau recommends filing the renewal request form, which asks for the version to evaluate, a penetration test under six months old, the updates since the last follow-up and their known impacts. The outcome can be a confirmation, a partial verification or a complete verification.
Can a supplier change penetration testing firms between annual tests?
Yes. Nothing in the bureau's documents requires the same firm each year. Any firm must meet the six conditions in the orientation on penetration tests, and since there is no public list of recognised firms, confirm a new firm with the bureau at certification@sante.quebec before the engagement starts.
Related reading
TGV certification in Quebec (2026): the application process, the fee, the eight report elements and the remediation matrix.
Test d'intrusion pour la certification TGV (2026): the French guide to the test rules and the verification schedule.
TGV certification for AI health tools (2026): the 69 AI criteria a new AI feature brings into scope.
Best healthtech penetration testing companies (2026): firms that test health technology products for Canadian and US buyers.
Quebec Law 25 penetration testing (2026): the privacy statute that sits under the TGV privacy domain.
Pentest completion letter vs full report: what to send the bureau and what to send hospital customers.
Penetration test cost calculator: a scoped range for the yearly test.
Talk to Stingrai
A certified supplier's year has one fixed point, the anniversary, and the penetration test has to land early enough to fix, retest and file 15 days before it. Stingrai can time the annual test to your anniversary, carry last year's scope forward with every change since, test every role in production or a production-equivalent environment, and deliver the retest report that point 9 of the self-declaration asks for. Book a free scoping call, get a quote for your TGV scope, or see published pricing.
References
Bureau de certification de Santé Québec. Attestation, certification TGV (BC-D0001-01). https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/BC_TGV_ATTESTATION.pdf.
Bureau de certification de Santé Québec. Autodéclaration, suivi et évaluation annuelle des engagements (BC-F0003-01, 24-715-75W). https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/gabarit-formulaire-autodeclaration-annuelle.pdf.
Bureau de certification de Santé Québec. Certificat, certification du produit ou service technologique. https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/BC_TGV_CERTIFICAT.pdf.
Bureau de certification de Santé Québec. Tableau des produits et services technologiques certifiés par familles, October 2026. https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/ListeDesPSTCertifiesActifs.pdf.
Bureau de certification. Formulaire pour une demande de renouvellement d'une certification TGV. https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/Formulaire-demande-renouvellement-certification-tgv.xlsm.
Bureau de certification. Orientation concernant les tests d'intrusion. https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/orientation-tests-intrusion.pdf.
Bureau de certification. Orientation sur le délai de remédiation des vulnérabilités. https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/orientation-delai-remediation-vulnerabilites.pdf.
Bureau de certification. Orientation sur l'authentification à facteurs multiples (MFA), 19 December 2025. https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/orientation-authentification-facteurs-multiples_mfa.pdf.
Bureau de certification. Planification des vérifications TGV (24-715-53W). https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/planification-verifications-tgv.pdf.
Ministère de la Santé et des Services sociaux. Critères de vérification de la TGV, version 2026-04-24. https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/liste-criteres-TGV_v2026-04-24.xls.
Ministère de la Santé et des Services sociaux. Applications certifiées (last updated 20 May 2026). https://www.msss.gouv.qc.ca/professionnels/technologies-information/certification-produits-et-services-technologiques/applications-certifiees/.
Ministère de la Santé et des Services sociaux. Orientations, procédures et documents utiles pour la certification (last updated 8 June 2026). https://www.msss.gouv.qc.ca/professionnels/technologies-information/certification-produits-et-services-technologiques/orientations-procedures-documents-utiles-certification/.
Ministère de la Santé et des Services sociaux. À propos de la certification (last updated 5 May 2025). https://www.msss.gouv.qc.ca/professionnels/technologies-information/certification-produits-et-services-technologiques/a-propos-certification/.
Ministère de la Santé et des Services sociaux. Certification: Trousse globale de vérification (TGV) (24-715-38W, 21 June 2024). https://publications.msss.gouv.qc.ca/msss/document-003757/.
Ministère de la Santé et des Services sociaux. Règle particulière sur la certification des produits et services technologiques (version 1.00, 20 June 2013). https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/regle-particuliere-certification.pdf.
