What happened
Bill C-8, An Act Respecting Cyber Security, received Royal Assent. It amends the Telecommunications Act to add security as a policy objective and lets the government compel action against threats to telecom networks, effective immediately. It also creates the Critical Cyber Systems Protection Act, which will require designated operators in finance, telecommunications, energy and transportation to protect critical cyber systems and report significant incidents. That Act comes into force in phases. (Public Safety Canada, June 16, 2026)
What it means for Canada
Canada now has a federal cyber law for critical infrastructure. Designated operators in finance, telecom, energy and transport will have to protect critical cyber systems and report significant incidents, and they will push those duties onto suppliers.
- Sectors
- Banking and finance · Telecommunications · Energy · Transportation · Their suppliers and AI vendors
- Canadian rules
- Bill C-8 / Critical Cyber Systems Protection Act (phasing in)
Telecommunications Act security amendments (in force now)
Takeaways for Canadian businesses
- BusinessIf you sell to federally regulated banks, telecoms, energy or transport firms, map which of your systems touch their critical services.
- BusinessWrite an incident-reporting procedure you can share with those customers; the Act requires designated operators to report significant incidents.
- BusinessTrack regulations under the Act in the Canada Gazette; obligations start only as provisions come into force.
- BusinessExpect new security clauses in renewals with telecom and bank customers.
For the Canadian AI sector
AI vendors selling into banks, telecoms and utilities should expect security questionnaires, incident-reporting clauses and audit rights tied to the new regime.
Written by AgentsNorth from the source below. General information, not legal or security advice.