Bill C-8 Explained: Is It in Force, and Does It Apply to Your Business?

A client's vendor questionnaire mentions Bill C-8. Or your board saw a headline about Canada's new cyber law. Either way, you need two answers quickly: is it law yet, and does it touch you?

Short answer: Bill C-8 is Canada's federal cyber security law, the same framework that used to be called Bill C-26. It received Royal Assent on 2026-06-15. Part 1, which gives Ottawa new security powers over telecom providers, is already in force. Part 2, the Critical Cyber Systems Protection Act, is law but not in force as of 2026-10-19, and nobody has been designated under it yet. When it does switch on, it will bind only designated operators in six federally regulated sectors: telecom, interprovincial pipelines and power lines, nuclear, federal transportation, banking, and clearing and settlement.

So most Canadian businesses will never carry a duty under it directly. But if you sell to one of those operators, host their data, or hold admin access to their systems, the law will still reach you, through your contract. This guide covers where the bill stands, who's in scope, what operators must do, the penalties, and the part most explainers skip: what your regulated customers are likely to start asking you for.

Not sure which side of the line you're on? Our free Bill C-8 readiness assessment takes about two minutes and shows where you stand before you spend anything.

Bill C-8 status, checked 2026-10-19

What is Bill C-8?

Bill C-8 is An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts. Public Safety Canada shortens it to ARCS. It was introduced on 2025-06-18, passed the House of Commons on 2026-03-26 and the Senate on 2026-06-04, and received Royal Assent on 2026-06-15 (LEGISinfo).

It's really two laws in one bill:

• Part 1 amends the Telecommunications Act. It adds the security of Canada's telecom system as a policy objective and lets the federal government order telecom providers to stop using, or rip out, equipment and services from a named supplier.
• Part 2 creates a new statute, the Critical Cyber Systems Protection Act (CCSPA). This is the part that will put mandatory cyber security programmes, incident reporting and record-keeping duties on critical infrastructure operators.

If that sounds familiar, it should. The same framework was Bill C-26 in the last Parliament. That bill got as far as the final back-and-forth between the chambers, with Senate amendments sent to the House on 2024-12-05, and then never received Royal Assent before that Parliament ended (LEGISinfo, Bill C-26). Bill C-8 is its second run, with amendments.

Is this the same Bill C-8 as the conversion therapy bill?

No. Bill numbers restart with every Parliament, so "C-8" has been several unrelated bills. In 2020 it was a Criminal Code amendment on conversion therapy that stopped at second reading (LEGISinfo, 43-1). In 2022 it was the bill that put the December 2021 economic and fiscal update into law, and it received Royal Assent on 2022-06-09 (LEGISinfo, 44-1).

If you searched Bill C-8 Canada for cyber security rules for critical infrastructure, you want the 2026 one, from the 45th Parliament.

Is Bill C-8 passed, and is it in force?

Passed, yes. Fully in force, no.

The bill set different start dates for its two parts. Part 1 has no separate start date, so it took effect with Royal Assent. The official copy of the Telecommunications Act shows it as last amended on 2026-06-15.

Part 2 works differently. Section 16 of the bill says the CCSPA comes into force "on a day or days to be fixed by order of the Governor in Council" (Royal Assent text). No such order has been made. The official consolidation, current to 2026-09-30, still marks every section of the CCSPA as not in force. Schedule 2, where designated operators get listed, has no entries. We also checked the two latest issues of the Canada Gazette, Part II (2026-09-23 and 2026-10-07), and neither carries a CCSPA order.

The government has said the Act will come in gradually, in phases, rather than all at once (Public Safety Canada, 2026-06-16).

So if a page tells you the CCSPA is already in force, it's wrong. If it calls Bill C-8 "upcoming" legislation, it's wrong in the other direction.

When will the Critical Cyber Systems Protection Act take effect?

No date has been published. Two separate government orders have to happen before any operator owes anything:

1. A coming-into-force order for Part 2, or for pieces of it, since the bill allows "a day or days".
2. An order adding a class of operators to Schedule 2 under section 7, which also names that class's regulator.

The 90-day clock for an operator's cyber security programme starts only after a designation order is published in the Canada Gazette, Part II, and the operator becomes a member of the designated class (s.9). Regulations will also have to fill in details, including the exact incident reporting window.

Here's our practical tip. Watch Part II of the Gazette, not the news. Its last three issues came out two weeks apart (2026-09-09, 2026-09-23 and 2026-10-07), and that's where the switch will flip.

What does Part 1 change for telecom providers?

Part 1 is live now. It applies to any "telecommunications service provider", which the Act defines as anyone who provides basic telecommunications services. That isn't limited to the big national carriers.

Under the amended Telecommunications Act:

• Supplier bans. The Governor in Council can order a provider to stop using all products and services from a specified person, or to remove that person's products from its network (s.15.1).
• Service orders. The Minister of Industry can, after consulting the Minister of Public Safety, prohibit a provider from serving a specified person or suspend that service for a set period (s.15.2).
• Security directions. The Minister can also order a provider to develop a security plan, run vulnerability assessments, put its procurement plans through specified reviews, adopt specified standards, or use a backup system (s.15.2(2)).
• No compensation. Nobody is entitled to compensation from the federal government for financial losses caused by these orders (s.15.1(8) and s.15.2(10)).
• Penalties. Breaking the Act, including these orders, can cost an organisation up to $10M for a first violation and $15M for a later one, or $25K and $50K for an individual (s.72.001, and s.72.131 for these orders).

For a regional ISP or a telecom reseller, the practical question is simple. If an order names a supplier whose gear sits in your network, can you find every unit, and how fast can you swap it out? There's no cheque coming for the stranded equipment.

Can the government cut someone off under Bill C-8?

That question took off in the fall of 2025, when civil liberties groups warned the bill could be used to cut people off their phone or internet service in secret.

Here's what the law that passed actually says. The Minister of Industry can order a provider to stop or suspend service to a "specified person" if it's necessary to secure the telecom system against a threat and reasonable given how serious the threat is. One limit was written in for individuals: an order suspending an individual's service is allowed only when it's needed against a specified threat "of a technical nature" (s.15.2(1.1)). That carve-out covers suspensions. The subsection doesn't extend it to outright prohibitions.

Three more limits sit in the text. The Minister can't order the decoding of an encrypted private communication (s.15.2(2.1)). The Minister can't order a provider to intercept private communications (s.15.2(4)). Orders can carry a non-disclosure clause, but the Minister has to table a yearly report in Parliament with the number and nature of orders made (s.15.21).

Whether those limits go far enough is a policy debate, and the Justice Department's Charter Statement on Bill C-8 sets out the government's side of it. For a business, the takeaway is narrower. These are powers over telecom providers, not over their customers' networks.

Who does the Critical Cyber Systems Protection Act apply to?

Only "designated operators", meaning organisations in a class the government adds to Schedule 2, and only in sectors Parliament regulates. Schedule 1 lists six vital services and systems. The Act gives powers to six regulators, and Schedule 2 will pair each designated class with one of them. The likely pairing looks like this:

Three things are worth knowing here.

Healthcare isn't on the list. Neither are municipal services or provincially regulated businesses in general, whatever some vendor pages claim. If you run a clinic, your rules come from privacy law, not from this Act.

The list can grow, but only so far. The government can add a service or system to Schedule 1, but only one that falls under Parliament's authority and that it judges vital to national security or public safety (s.6).

Being in a sector isn't enough. You owe nothing until your class is named in Schedule 2. For banks and for financial services generally, and for pipelines and power lines in energy and utilities, it's a readiness question today, not a deadline.

What will designated operators have to do?

Once an operator is designated, these are the core duties:

Two details here are easy to miss.

The first is that "cyber security incident" is broad. The Act's definition covers anything that "interferes or may interfere" with a critical system, so the duty can reach incidents that only might affect a system, not just confirmed breaches. The regulations may narrow that with thresholds.

The second is that the supply-chain duty in s.15 has no grace period. It applies the moment the operator's own risk work identifies a supplier risk. The Act also lets CSE write supplier-risk guidelines that draw on international standards for cyber security in supplier relationships (s.15.1). That's where the contract clauses are likely to come from.

What are the penalties under Bill C-8?

None of the CCSPA penalties can apply until Part 2 is in force. Once it is:

• Administrative monetary penalties reach $500K per violation for an individual and $15M per violation for anyone else (s.91).
• Every day counts. A violation that continues for more than one day is a separate violation for each day (s.94).
• Directors and officers who direct, authorise or take part in a violation are parties to it and can be penalised personally (s.93).
• Some breaches are offences. An individual convicted on indictment faces up to five years in prison, or up to two years less a day on summary conviction. Corporate fines are at the court's discretion (s.137).
• Due diligence is a defence (s.92). That's the strongest argument for a documented programme with evidence behind it, rather than a pile of tools.

The Part 1 telecom penalties, covered above, apply today.

Does Bill C-8 apply to my business if I'm not a designated operator?

Not directly. The CCSPA puts its duties on designated operators, full stop. A 40-person software company doesn't become a designated operator because it has a bank as a customer.

But look at what the Act asks operators to do. They have to identify and manage risk tied to their supply chain and third-party products, mitigate it as soon as it's found, report incidents within 72 hours, and keep records in Canada. An operator can't do any of that if its suppliers are a black box. So it'll push the requirements down to you, through contracts, questionnaires, audit rights and onboarding reviews.

Banks already work this way. OSFI's Third-Party Risk Management Guideline (B-10) holds federally regulated financial institutions responsible for risk from subcontracting, and expects contracts that require third parties to "promptly notify" them of technology and cyber incidents. The CCSPA carries that pattern into telecom, energy, nuclear, transportation and clearing.

Picture a 60-person managed service provider in Mississauga that runs the branch network and help desk for a federally regulated bank. Much of what the new law brings, it has already met in its B-10 vendor review. What's new is a second regulator-facing clock on the bank's side, and questions about where records sit.

Now picture a 25-person industrial automation integrator in Calgary that maintains control systems for an interprovincial pipeline operator. Nobody has asked it for a cyber security clause yet. Once that operator's class is designated, the operator will have 90 days to stand up a programme that covers its supply chain. The integrator's remote access into the control network will be near the top of the list.

What will a designated operator ask its suppliers for?

The list below is our expectation, not a quote from the law. It's built from what sections 9, 15, 17, 20 and 30 require of operators, and from how banks already apply B-10. The Act doesn't set supplier duties, and the regulations may add more.

For a small supplier, the most natural Canadian yardstick is the Cyber Centre's baseline cyber security controls, written for organisations with fewer than 499 employees. Three of them map straight onto the asks above: 3.1 (an incident response plan), 3.10 (securing cloud and outsourced IT services) and 3.12 (access control and authorisation).

If you have your own chain of vendors behind you, the operator's question becomes your question too. Our third-party risk management work maps those vendors' vendors as well.

How do the incident reporting clocks stack up?

If you supply a bank, one incident could feed three different clocks:

The CCSPA says outright that its reporting rules don't change PIPEDA's (s.18.1). So it's both, not either.

The supplier lesson is simple. Your contract window has to be shorter than your client's shortest clock, because they can't start counting until you've told them. If nobody watches your alerts overnight, a 24-hour clock is already tight. That's the gap managed security services are built to close. For the privacy side, see our PIPEDA compliance page.

How should you prepare for Bill C-8 now?

Decide which side of the line you're on first. Then do the cheap work first.

What if you might be designated?

1. Settle scope. Are you federally regulated, and in one of the six Schedule 1 sectors?
2. Find the systems that matter. List the systems whose compromise could affect your vital service. Those are your likely critical cyber systems.
3. Gap them against s.9. Identify, protect, detect, limit impact. The Cyber Centre's ITSP.10.033 control catalogue gives you the control language, including a supply chain risk management family. A threat risk assessment is the usual way in.
4. Map the supply chain. Include your vendors' vendors.
5. Rehearse the report. Run a tabletop that ends with a CSE report and a regulator notice inside 72 hours.

Ninety days is enough to document a programme you already run. It's a tight window to build one from scratch. That's the work our Bill C-8 readiness engagement covers, and the first step is checking whether the Act reaches you at all.

What if you supply a designated sector?

1. List your customers in the six sectors, and the access you hold in each.
2. Test your incident response plan for a notify-the-client step measured in hours.
3. Pick a control baseline and collect evidence: the Cyber Centre baseline controls, ISO 27001, or a SOC 2 report.
4. Map where client data, logs and backups live, especially anything outside Canada.
5. Inventory your own critical suppliers.
6. Read your next contract renewal for audit, notification and remediation clauses before you sign it.

If you've never scored your own risks, a cyber risk assessment is the place to start. It's the same exercise an operator will run on you.

Frequently asked questions about Bill C-8

Is Bill C-8 the same as Bill C-26?

Same framework, different bill. Bill C-26 was introduced in the last Parliament and never got Royal Assent. Bill C-8 brought the framework back with amendments, and it's the version that became law. If your compliance file still says "Bill C-26", update the name.

Does Bill C-8 apply to healthcare?

Not as written. Healthcare isn't one of the six vital services in Schedule 1, and most health care in Canada is provincially regulated. Health organisations answer to PIPEDA or to provincial health privacy law. Our guide to health privacy law in Canada explains which law applies where.

Does Bill C-8 replace PIPEDA?

No. The CCSPA says its incident reporting sections don't affect PIPEDA (s.18.1). A designated operator with a breach of personal information could owe a report under both. It sits alongside the other rules in a governance, risk and compliance programme. It doesn't replace any of them.

Does Bill C-8 weaken encryption?

Not on the face of the text. A cyber security direction under the CCSPA can't order the decoding of an encrypted private communication (s.20(1.1)). Neither can the Minister under the Telecommunications Act (s.15.2(2.1)), and the Minister can't order a provider to intercept private communications either (s.15.2(4)).

Where will designations be announced?

In the Canada Gazette, Part II, as an order adding a class of operators to Schedule 2. The status box at the top of this page shows the date of our last check.

What should you do next?

Bottom line: for most businesses, Bill C-8 is a supplier question, not a compliance deadline. For operators, it's a 90-day clock that hasn't started yet. Either way, the cheap work is the same. Know which systems matter, know who touches them, and know how fast you can tell someone when something breaks.

If you'd like a senior architect to look at where you stand, talk to us. The first conversation is about scope, not a pitch. If you're nearby, our cyber security pages for Toronto, Ottawa and Montreal cover local work.

This article explains the law as published on 2026-10-19. It isn't legal advice. For a decision about your own obligations, talk to your counsel.