Summary

  • Part 1 of Bill C-8 immediately added security powers to the Telecommunications Act. Part 2 created a separate designated-operator regime, but the latest consolidated law still marks it not in force.
  • The distinction changes the present compliance map: providers can be subject to telecommunications directions now, while the CCSPA’s security-program and incident-reporting duties are not yet operative.

A law can be in force without every part of its promise being live

Bill C-8 became law on 15 June 2026. Its title and political framing invite a simple conclusion: Canada has a new cyber-security regime for telecommunications and other critical infrastructure. The enacted text has a more consequential split. Part 1 amended the Telecommunications Act and took effect upon Royal Assent. Part 2 enacted the Critical Cyber Systems Protection Act (CCSPA), but left its start date to one or more orders of the Governor in Council. The Justice Laws version current to 21 September 2026 still labels Part 2 “not in force.”

For operators, the difference is practical. Part 1’s direction powers are live. The Governor in Council may restrict a provider’s use of products or services supplied by a named person, or direct removal of that person’s products from network facilities. The Minister of Industry has a broader list of possible actions: security plans, vulnerability assessments and mitigation, specified standards, procurement review, backup systems and other requirements. Orders must be necessary and reasonable in scope and substance relative to the threat. Decision-makers must consider operational and financial impact, service effects and privacy.

This is not the same thing as a general standing obligation for every carrier to establish a CCSPA security program. The latter is future architecture for designated operators, with classes to be set by order. The statute includes telecommunications among the vital services in its design, but designation—not the word “telecom” alone—sets the covered operator population. Its incident-reporting clause caps a future regulatory deadline at 72 hours; it does not create a clock that is already running while Part 2 remains out of force.

Direction power has a defined process and a record

Part 1 permits a direction to include a non-disclosure provision covering its existence, contents or both. That secrecy is not automatic. Before adding it, the Governor in Council or Minister must consider whether disclosure could compromise the order, whether secrecy is necessary, whether a narrower ban is possible, the effect on transparency and accountability, and representations from affected providers. A provider can therefore have duties under an order that it is not free to describe publicly.

The same Act sets two different visibility routes. If an order is not secret, the Minister must notify the persons specified in it within seven days. If it includes a non-disclosure provision, the Minister must notify the National Security and Intelligence Committee of Parliamentarians and the National Security and Intelligence Review Agency within 90 days. The annual report to Parliament must include the number and nature of orders, revocations, the number of providers affected, compliance descriptions and an explanation of each order’s necessity, reasonableness and utility. It must also report how often an order overrode a CRTC decision.

The law requires a public summary after tabling.

Those channels make a useful accountability test possible. The question is not simply whether ministers have power, nor whether every detail should be public during an active threat. It is whether the required reports arrive on time, distinguish types of direction, explain how provider and customer effects were assessed, and allow Parliament and the public to understand how often this authority altered regulatory decisions.

Security rules do not erase the legal boundary

The Telecommunications Act provisions prohibit orders to intercept private communications. The separate CCSPA also contains a no-interception safeguard for private communications. Both parts preserve the Privacy Act. These boundaries matter because security powers can affect infrastructure and procurement, while the law does not authorize turning a network-security order into a general interception instruction.

Bill C-8’s two tracks should be read on their own clocks: immediate powers to direct telecom providers, and a critical-systems program whose commencement and designation still have to be made visible. The latest official consolidation reviewed establishes that the latter is not yet in force. Operators should prepare for the structure Congress enacted, but should not report future obligations as current duties. Policymakers should publish commencement and designation steps clearly enough that a provider can tell which rules apply to it, from what date, and through which regulator.

That distinction is the first evidence test for the law. Royal Assent establishes authority. Commencement, designation, orders and public reporting establish what that authority does in operation.

Sources