Canada's Bill C-8 Is Law: What the Critical Cyber Systems Protection Act Requires, and When

Canada's Bill C-8, An Act respecting cyber security, became law on 15 June 2026 as Statutes of Canada 2026, chapter 9. Half of it took effect that day. The other half, the Critical Cyber Systems Protection Act (CCSPA), is the part most security teams care about, and as of 19 October 2026 it isn't in force: Justice Laws still carries the note "Part 2 not in force", and no operator has been designated under it. That gap is the window to prepare in.

This post is for security and compliance teams at federally regulated banks, telecoms, pipelines, power line operators, nuclear and transportation companies, and for the software and service vendors that sell to them. It covers what's in force now, what the CCSPA will require once it starts, what triggers each clock, what it means for suppliers, and a small script that tells you when Part 2 comes into force.

The short answer

Bill C-8 received Royal Assent on 15 June 2026. Part 1, which amends the Telecommunications Act to let the government order telecom providers to stop using or remove specified products and services, is already in force. Part 2 enacts the Critical Cyber Systems Protection Act, which starts on dates the federal cabinet sets by order and wasn't in force on 19 October 2026. Once it starts and an operator's class is added to Schedule 2, that operator has 90 days to establish a cyber security program covering risk management (including supply-chain and third-party risk), protection, detection and impact reduction. It must report cyber security incidents to the Communications Security Establishment within a period set by regulation of no more than 72 hours, and faces penalties of up to $15 million per violation, per day. Suppliers should expect their customers to start asking about supply-chain risk before the clock starts.

Two parts, two timelines

Public Safety Canada's announcement on 16 June said the CCSPA would be implemented in phases. It gave no dates.

Who the CCSPA will cover

The Act works through two schedules.

Schedule 1 lists the vital services and systems. As enacted, there are six: telecommunications services, interprovincial or international pipeline and power line systems, nuclear energy systems, federally regulated transportation systems, banking systems, and clearing and settlement systems. Cabinet can add more by order (section 6), but only services within federal jurisdiction.

Schedule 2 lists the classes of operators and their regulators. It's empty in the enacted text. Cabinet fills it by order under section 7, naming a class of operators and the regulator for it. The Act names six possible regulators: the Minister of Industry, the Minister of Transport, the Superintendent of Financial Institutions, the Bank of Canada, the Canadian Energy Regulator and the Canadian Nuclear Safety Commission.

So "who's covered" has no answer yet. It depends on orders that haven't been made. Because the Act only applies to works, undertakings and businesses within federal jurisdiction, provincially regulated operations are generally outside its reach.

What a designated operator must do

The clock for each operator starts when the order adding its class to Schedule 2 is published in the Canada Gazette, Part II.

Two details matter for planning. First, the 72 hours is a ceiling, not the deadline. Regulations will set the real period, and it could be shorter. Second, a cabinet direction under section 20 can require specific measures, and the Act says it must be "reasonable in relation to the purpose", but it can't order the decoding of an encrypted private communication (subsection 20(1.1)).

Penalties and personal liability

Penalties are administrative, and regulations will classify violations and fix amounts within the caps in section 91: up to $500,000 for an individual and $15 million in any other case. A continuing violation counts separately for each day (section 94). Directors and officers who directed, authorized or took part in a violation can be liable themselves (section 93), and due diligence is a defence (section 92). Some contraventions are also offences, and an individual convicted on indictment can face up to five years in prison.

What it means for software and service suppliers

Suppliers aren't regulated by the CCSPA directly. Their customers are, and section 9(1)(a) puts supply-chain and third-party risk inside every designated operator's program, with section 15 requiring mitigation as soon as a risk is found and section 14 requiring notice to the regulator of material supply-chain changes.

The Act doesn't say what that mitigation looks like. Section 15.1 lets the Communications Security Establishment develop guidelines, "taking into consideration" international frameworks such as ISO's work on cybersecurity in supplier relationships, which is the ISO/IEC 27036 series. Until guidelines or regulations appear, expect each operator to set its own bar, and expect questions about:

• What's in your product, meaning component inventories and how you track vulnerabilities in third-party code.
• How you handle vulnerabilities, including how fast you ship fixes and how you tell customers.
• How you'd support their 72-hour clock, since an incident in your service may become their reportable incident.
• Who can change your product, covering build integrity and change control, since a supplier change may be a "material change" the operator has to report.

For operators, the work starts with knowing which suppliers touch critical cyber systems. Here's Safeguard's interactive walkthrough of onboarding a vendor into a third-party risk program:

Know when Part 2 starts

Part 2 starts by cabinet order, and the operator clocks start with later orders published in the Canada Gazette, Part II. This script reads the annual statute on Justice Laws and checks for the "Part 2 not in force" note. Run it weekly. It exits with status 1 when the note disappears, so it can fail a scheduled job and get someone's attention:

#!/usr/bin/env python3
"""Check whether Part 2 of S.C. 2026, c. 9 (the Critical Cyber Systems
Protection Act) is in force yet, using the Justice Laws annual statute page.
Run it on a schedule; exit code 1 means the "not in force" note is gone,
so go and read the Canada Gazette, Part II."""
import html
import re
import sys
import urllib.request

URL = "https://laws-lois.justice.gc.ca/eng/AnnualStatutes/2026_9/FullText.html"


def page_text(url):
    req = urllib.request.Request(url, headers={"User-Agent": "ccspa-watch/1.0"})
    with urllib.request.urlopen(req, timeout=60) as r:
        raw = r.read().decode("utf-8", "replace")
    text = html.unescape(re.sub(r"<[^>]+>", " ", raw))
    return re.sub(r"\s+", " ", text)


def main():
    text = page_text(URL)
    notes = sorted(set(re.findall(r"\[Note: [^\]]+\]", text)))
    for note in notes:
        print("Justice Laws note:", note)
    if "[Note: Part 2 not in force.]" in text:
        print("Part 2 (CCSPA): not in force, so no operators can be designated yet.")
        return 0
    print("The 'Part 2 not in force' note is gone. Check the Canada Gazette, Part II,")
    print("for the commencement order and any order adding a class to Schedule 2.")
    return 1


if __name__ == "__main__":
    sys.exit(main())

On 19 October 2026:

Justice Laws note: [Note: Part 2 not in force.]
Part 2 (CCSPA): not in force, so no operators can be designated yet.

When it changes, read the commencement order and any Schedule 2 orders in the Gazette. They'll say which provisions started and which classes are designated.

What to do now

1. Work out whether you're likely to be designated. If you operate one of the six Schedule 1 services within federal jurisdiction, assume you're a candidate and find out which of the six regulators would be yours.
2. Draft the section 9 program now. Ninety days is short for a program that has to cover risk management, protection, detection and impact reduction, and regulations may add more.
3. Inventory suppliers that touch critical cyber systems, and record the risks you find and what you did about them. Section 30 will require those records.
4. Build the 72-hour incident path. Know who decides an incident is reportable, how a report reaches the Communications Security Establishment, and how the regulator gets its copy.
5. If you're a supplier, prepare the answers before the questionnaire arrives: a component inventory, a vulnerability handling policy and a way to notify customers fast. Our post on Canadian Cyber Centre supply chain guidance covers the Centre's existing supplier guidance, though it predates C-8 and describes the earlier Bill C-26.

The fair view

Much of this isn't new for the biggest likely designees. Federally regulated financial institutions already work under OSFI's Guideline B-13 on technology and cyber risk, in effect since 1 January 2024, and already report technology and cyber incidents to OSFI within 24 hours under its incident reporting advisory. Telecom providers have been subject to Part 1's order powers since June. For them, the CCSPA mostly adds a statutory program requirement, reporting to the Communications Security Establishment and new penalties.

The open questions are real, though. The Act is a framework, and the parts that decide cost (the reporting period, the program details, the penalty amounts and who's designated at all) are all left to orders and regulations that haven't been published. Some orders can also be kept confidential: the Telecommunications Act amendments let cabinet and the minister prohibit disclosure of an order's existence or contents after weighing specified factors, which makes it harder for suppliers to know what their customers have been told to do. A team that drafts its program now, against the text that's already law, won't have to rush when the orders arrive.

Check yourself