Bill C-8 Cyber Telecomm

An Act Respecting Cyber Security, Amending the Telecommunications Act and Making Consequential Amendments to Other Acts

Bill Type:  House Government Bill

Bill Sponsor:  Minister of Public Safety

Status: Royal Assent — June 15, 2026. This Bill is now Law. 

The Telecommunications Act amendments are in force. The Critical Cyber Systems Protection Act will come into force in stages on dates set by Government Order.

Estimated Read Time: 5 minutes

What is this Bill For?

Bill C-8 creates Canada's first mandatory cyber security framework for critical infrastructure. 

Part 1 gives Government authority to direct telecommunications providers to remove products, suspend services and implement security measures. 

Part 2 creates the Critical Cyber Systems Protection Act — mandatory cyber security requirements for federally regulated sectors including telecoms, banking, pipelines, nuclear energy and transportation. 

The Telecommunications Act amendments came into force when the Bill received Royal Assent. Most requirements under the Critical Cyber Systems Protection Act will come into force on dates set by Government Order.

WHO GAINS POWER

Government gains two types of direction powers. Under the Telecommunications Act, Government can require telecom providers to remove products, suspend services or take other security steps. Under the Critical Cyber Systems Protection Act, Government can issue cyber security directions to designated operators in banking, telecommunications, energy and transportation. Some directions can be kept confidential.

The Minister of Industry gains authority to prohibit telecommunications providers from using products or services from specified persons — effectively giving Government the power to ban specific foreign technology vendors from Canadian networks without a separate Parliamentary vote.

Six separate regulators gain enforcement authority over different sectors — the Minister of Industry, Minister of Transport, Superintendent of Financial Institutions, Bank of Canada, Canadian Nuclear Safety Commission and Canadian Energy Regulator — each with inspection, audit and compliance order powers within their jurisdiction.

The Communications Security Establishment gains a mandatory reporting pipeline — all designated operators must report cyber security incidents to CSE within 72 hours, centralizing national security intelligence about infrastructure vulnerabilities.

WHO LOSES POWER

Designated operators — telecom companies, banks, pipeline operators, nuclear facilities and transportation systems — lose discretion over their own cyber security architecture. They must establish programs within 90 days of designation, follow mandatory standards, report incidents within 72 hours and submit to inspections and audits.

⚠️ Vendors Banned by Government Direction — Government can prohibit telecom providers from using products or services supplied by named persons without passing another Bill. These orders can be challenged through Judicial Review after they are issued. The Act does not provide a compensation process or a separate appeal Tribunal for affected vendors.

Parliament does not approve individual directions issued to operators. Annual reporting to Parliament is required — but after directions are already issued and in effect.

WHO GAINS MONEY

Cyber security firms, consultants and technology providers gain mandatory business — every designated operator must build and maintain a compliant cyber security program, creating a guaranteed market for security services, audits and technology.

Legal and compliance firms gain work as designated operators navigate six different regulatory regimes with overlapping jurisdiction.

WHO LOSES MONEY

Designated operators bear the full cost of compliance — cyber security programs, supply chain risk assessments, incident response infrastructure, record-keeping and regular program reviews — with no cost-sharing or transition funding built into the Bill.

Smaller operators in regulated sectors face the same compliance obligations as large ones. Penalties reach $15 million per violation for corporations and $1 million for individuals, with criminal penalties of up to five years imprisonment for serious violations.

Vendors and suppliers removed from networks by Ministerial direction lose contracts with no compensation mechanism built into the statute.

THE CATCH

⚠️ Six Regulators, No Coordinator — Bill C-8 assigns enforcement to six separate regulators across six sectors with no statutory body responsible for consistent application. A telecom and a bank face the same framework — enforced by different regulators with no coordination requirement written into the Law.

⚠️ Government Directions, No Parliamentary Approval — Directions issued by the Governor in Council to critical infrastructure operators are protected by non-disclosure provisions. Parliament receives annual reports after directions are already in effect — not before.

⚠️ Privacy Oversight Gap — Cyber security incident reports go to the Communications Security Establishment and the relevant regulator. CSE remains subject to existing independent review by the National Security and Intelligence Review Agency. The Act does not require the Privacy Commissioner to be notified when a major cyber incident affects the personal information of Canadians.

⚠️Vendors Have No Appeal— Suppliers removed from Canadian networks by Ministerial direction have no appeal mechanism specified beyond standard judicial review. No compensation mechanism exists in the statute. This is not a right that existed and was removed — Bill C-8 creates this power from scratch and chose not to build in a dedicated appeal process. The absence is a drafting decision, not an oversight of an existing protection.

⚠️ Part 2 Depends on Government Action — The Telecommunications Act amendments are already in force. Most requirements under the Critical Cyber Systems Protection Act will begin only when Government sets the dates and completes the required Regulations.