Analysis
Bill C-8 and Critical Cyber Systems: What Suppliers Must Do
Bill C-8 received royal assent on June 15, 2026. Its telecommunications amendments are in force, but the Critical Cyber Systems Protection Act is not yet in force and no operators are designated. Once they are, banks, telecoms, energy and transport operators must manage supply chain risk and report incidents within 72 hours, so their suppliers should expect tighter contracts, questionnaires and notice clauses.
· 9 min read