Bill C-8 is law: what the Critical Cyber Systems Protection Act changes, and when

Update 2026-09-22: As Parliament resumed, the Act was still awaiting its coming-into-force order and designations. See where Bills C-36 and C-8 stand this fall.

On 2026-06-15, Bill C-8 received royal assent (Digital Policy Alert). Canada now has a federal law, the Critical Cyber Systems Protection Act (CCSPA), that will impose cyber security obligations on operators of vital services and systems, and new security powers over the telecommunications sector. We covered the bill when it was introduced in Bill C-8: Canada revives its critical infrastructure cyber security law.

Law is not the same as in force

Royal assent completes the legislative process, but most of the CCSPA does not apply on day one. Three things still have to happen:

• Coming into force. The government sets the date by order in council.
• Designation. Operators become subject to the Act only once they fall within a class of operators designated for a vital service or system. The schedule of designated classes starts empty.
• Regulations. Many details, including the form and content of incident reports and programs, will be set by regulation (BLG).

What designated operators will owe

• A documented cyber security program, established within 90 days of becoming a designated operator (Act text).
• Active mitigation of supply chain and third-party risks.
• Reports of cyber security incidents to the Communications Security Establishment within 72 hours.
• Compliance with confidential cyber security directions.
• Records kept in Canada, and notice to the regulator of changes in ownership, control or key third parties.

Administrative penalties can reach $15 million per violation per day for organizations and $500,000 for individuals, and directors and officers can be held personally liable (BLG).

Who is in scope

The vital services and systems listed in the Act are telecommunications, interprovincial and international pipelines and power lines, nuclear energy, federally regulated transportation, banking, and clearing and settlement systems. Regulators include the Superintendent of Financial Institutions, the Bank of Canada, the Canadian Energy Regulator, the Canadian Nuclear Safety Commission and the responsible ministers (BLG).

The ripple effect on suppliers

Most organizations will never be designated. Many will still feel the Act, because designated operators must manage the risk their suppliers create. Expect banks, telecoms, payment networks and energy companies to tighten contracts, ask for incident notification within hours rather than days, and request independent assurance such as ISO 27001 or SOC 2. Suppliers to federally regulated financial institutions are already seeing this under OSFI B-10.

What to do before the Act comes into force

1. Map which of your clients could be designated, and which of your services support their critical systems.
2. Test your incident response against a 72-hour reporting clock, including how you would notify a client in time for it to report.
3. Prepare an evidence pack your clients can rely on: policies, risk assessment, penetration test results and an independent report.
4. Review your own suppliers. Third-party risk flows down the chain.

Accel GRC tracks the program, evidence and supplier reviews in one place, and Ubitrak provides the testing and independent assessments clients ask for. Contact us.

Sources

• Digital Policy Alert: Critical Cyber Systems Protection Act (Bill C-8) received royal assent
• BLG: Bill C-8 adopted, Critical Cyber Systems Protection Act
• Parliament of Canada, LEGISinfo: Bill C-8 (45-1)
• Bill C-8, first reading text