Canada's Bill C-8: cybersecurity and supply chain rules explained

Bill C-8 received Royal Assent on 15 June 2026 as Statutes of Canada 2026, chapter 9. Part 1 amending the Telecommunications Act is already in force, while the Critical Cyber Systems Protection Act (Part 2) awaits an order in council: Schedule 2 is still empty, so no operator carries CCSPA obligations yet. Once a sector is designated, operators get 90 days to build a cybersecurity program, must report incidents to CSE within at most 72 hours and keep records in Canada.

• Part 1 of Bill C-8 on telecom security is in force since 15 June 2026
• CCSPA is not in force: Schedule 2 is empty and no date is set
• Designated operators get 90 days to implement a cybersecurity program
• Penalties reach $15 million for organizations and $500,000 for individuals