Bill C-8 Receives Royal Assent: Canada's Critical Cyber Systems Protection Act Becomes Law

Public Safety Canada announced on June 16, 2026 that Bill C-8, An Act respecting cyber security, had received Royal Assent. The Act has two parts. The first amends the Telecommunications Act to add security as an explicit policy objective and gives the government authority to compel action against threats to telecommunications systems; those provisions took effect on Royal Assent. The second creates the Critical Cyber Systems Protection Act, a regulatory framework for designated operators in four sectors: finance, telecommunications, energy and transportation. The Canadian Centre for Cyber Security and the RCMP's National Cybercrime Coordination Unit are named as the operational bodies, with sector regulators including OSFI, the Bank of Canada, the Canada Energy Regulator, the Canadian Nuclear Safety Commission, Transport Canada and ISED.

Designated operators will be required to establish and maintain a cyber security program, mitigate supply chain and third party risks, report cyber security incidents to the Cyber Centre, keep records of what they did, and comply with binding cyber security directions from the Governor in Council. Legal commentary on the bill describes a 72 hour incident reporting window and administrative monetary penalties of up to $15 million per violation per day for organizations and $500,000 for individuals; the operative details, including designation of operators and coming into force, will be set by regulation on a phased basis.

Our take

Canada's 2009 National Strategy for Critical Infrastructure said owners and operators bear the primary responsibility for protecting their assets. Bill C-8 is the first time that responsibility carries a statute, a regulator and a penalty. For the energy, telecom and transportation operators we work with, the practical question is no longer whether a cyber security program exists on paper, but whether it can withstand a regulator asking what cryptography protects the systems in scope, where the keys live, and what happens to that data when a quantum computer arrives. "Harvest now, decrypt later" is a supply chain and third party risk by the Act's own logic: every vendor tunnel, every carrier link, every cloud connection is a third party product carrying your traffic under encryption that has an expiry date. The regulations are still being written, which is exactly the window to inventory the estate. You cannot report on, direct, or defend what you have not seen. Detect first.