Bill C-8: Canada’s critical infrastructure cybersecurity law
Bill C-8 is Canada’s federal cybersecurity law for critical infrastructure. It received Royal Assent on June 15, 2026. The Critical Cyber Systems Protection Act it creates is not yet in force: its obligations begin on a date the Governor in Council has not yet set, and the technical requirements are left to regulations that have not been made. When it does apply, designated operators will have to run cybersecurity programs, report incidents, and manage supply chain risk, with penalties up to $15 million per day, and those requirements will extend to the AI systems they run.
This is the SecuritAI hub for Bill C-8: what it requires, who it covers, and the AI-layer controls a compliant cybersecurity program needs.
Book a Government Briefing For Government & Critical Infrastructure
Bill C-8 created the Critical Cyber Systems Protection Act (CCSPA), Canada’s first dedicated cybersecurity law for critical infrastructure. Once in force it will reach designated operators across six federally regulated sectors: telecommunications, interprovincial and international pipelines and power lines, nuclear energy, federally regulated transportation, banking, and clearing and settlement systems. It will require them to establish cybersecurity programs, report significant incidents, comply with government cybersecurity directions, and address supply chain risk.
The four obligations
Designated operators will have to meet four core obligations, each backed by documented evidence: a cybersecurity program within 90 days of designation, incident reporting to the Communications Security Establishment, readiness to act on government cybersecurity directions, and supply chain risk management. The cybersecurity program obligation extends to every critical system, and AI systems qualify. Note that the 90 day clock starts from designation by order, not from Royal Assent.
Why AI is the gap most programs miss
AI is operational in every designated sector: grid management in energy, fraud detection in banking, network optimization in telecom, logistics in transportation. These systems were never in scope for cybersecurity programs designed before AI became operational. A Bill C-8 program has to cover them, which means answering three questions for every AI system: what did you test it against, what protects it at runtime, and where are the audit logs.
The Bill C-8 guides
Three in-depth guides covering the law, the checklist, and the AI layer.
Overview
What is Bill C-8?
Which sectors it covers, the four obligations, the penalties, and where AI fits in.
Read guide →
Checklist
Bill C-8 compliance checklist
All four obligations as action items, including the AI controls most programs miss.
Read guide →
AI Layer
How Bill C-8 applies to AI
The AI-specific controls regulators will expect, and why traditional programs don’t cover them.
Read guide →
How SecuritAI covers the AI layer of your Bill C-8 program
SecuritAI provides the two AI-specific controls a Bill C-8 cybersecurity program needs:
Documented adversarial testing across the OWASP LLM Top 10, producing a findings report and remediation evidence your program can use for the security-testing obligation. Learn more →
Runtime monitoring and blocking of AI attacks, with a full audit log of every prompt and response, exportable for incident reporting and regulatory review. Learn more →
For the full compliance program (policy documentation, evidence management, risk register), SecuritComply’s Bill C-8 platform covers all four obligations.
References
Bill C-8 questions
What is Bill C-8?
Bill C-8 is Canada’s federal cybersecurity law for critical infrastructure, which received Royal Assent on June 15, 2026. It creates the Critical Cyber Systems Protection Act, which is not yet in force. Once the Governor in Council sets its start date, it will require designated operators in telecommunications, banking, energy, and transportation to establish cybersecurity programs, report incidents, comply with cybersecurity directions, and manage supply chain risk.
What are the penalties under Bill C-8?
The Critical Cyber Systems Protection Act sets administrative monetary penalties of up to $15 million per day for organizations and $1 million per day for individuals. Directors and officers can be held personally liable where they directed, authorized, or participated in a violation.
Does Bill C-8 apply to AI systems?
Yes. The cybersecurity program obligation extends to all critical systems, including AI systems operational in critical infrastructure. Operators must assess, test, protect, and document controls for any AI system that touches operations, data, or public-facing services.
How long do operators have to comply?
Once an operator is designated, it has 90 days to establish and implement its cybersecurity program. Operators in the named sectors should begin gap assessments now rather than waiting for designation.
Get your AI ready for Bill C-8
Book a 15-minute briefing to map your AI controls against Bill C-8 cybersecurity program requirements.