Federal Bill C-8 on cybersecurity received Royal Assent on June 15, 2026, and has now officially become law.
Now known as the C-8 Cybersecurity Act, it establishes a new Canadian framework aimed at strengthening the protection of critical infrastructure against growing cyber threats.
The Act Has Two Components
The first amends the Telecommunications Act and grants the federal government broad powers to intervene directly when a cyber threat affects telecommunications networks. (In force now.)
The second component creates the Critical Cyber Systems Protection Act (CCSPA). This part applies to organizations considered critical to Canada’s national security or economy, particularly in the following sectors:
- telecommunications;
- energy;
- transportation;
- banking;
- clearing and settlement systems.
However, several obligations will only officially come into force following the adoption of implementing regulations and the formal designation of the affected organizations.
What are the main obligations?
The CCSPA imposes five major obligations on designated organizations to:
- Implement a formal cybersecurity program.
Companies will be required to identify their cyber risks, protect their critical systems, detect incidents, and mitigate their impacts. This program must be implemented within 90 days following official designation. - Manage supplier-related risks
Companies will be required to assess and mitigate risks arising from suppliers, subcontractors, and third-party technology services. This could have a direct impact on SMEs that provide services to large, regulated organizations. - Report cybersecurity incidents
Any incident that could affect a critical system must be reported to the Canadian Centre for Cyber Security within a maximum of 72 hours. - Comply with government directives
The government may order certain protective measures or prohibit the use of products, technologies, or suppliers considered high risk. - Maintain comprehensive documentation
Organizations will be required to keep documented evidence in Canada demonstrating their compliance, security measures, and incident response actions.
Significant penalties are provided for in the event of non-compliance. Administrative penalties can reach up to $15 million for organizations, and executives may also incur personal liability in certain cases.
For business leaders, the message is clear: cybersecurity is no longer solely a technological issue. It is becoming a matter of governance and regulatory compliance.
Even companies not directly targeted may face significant contractual pressure from their regulated clients.
Businesses that begin now to structure their cyber governance, supplier policies, and incident response mechanisms will be in a much stronger position when the regulations fully come into force.
Questions about cyber risks or your insurance coverage?
Write to our experts: cyber@lussier.co
Sébastien Lafond
Senior Account Manager and Practice Leader - Technology Risks, Commercial Insurance
