What does Bill C-8 mean for you if you supply a bank, telecom or utility?

Nothing yet. Bill C-8 received Royal Assent on 15 June 2026 and is now Statutes of Canada 2026, chapter 9, but the part that creates cybersecurity obligations is not in force, no class of operators has been designated, and the Act imposes no duty on suppliers at any point. What it will do, once it starts, is oblige your critical infrastructure customers to manage and then mitigate risk in their supply chain. You will meet C-8 as a question on their form, not as a letter from a regulator.

What is actually in force?

Two parts, at two very different stages.

Part 1 amends the Telecommunications Act and took effect on Royal Assent. It adds security to the Act’s policy objectives and gives the government powers over telecommunications service providers. If you are not a telecom carrier, this is not about you.

Part 2 enacts the Critical Cyber Systems Protection Act and is not in force. The Act says so in its own words: The provisions of this Part come into force on a day or days to be fixed by order of the Governor in Council. (Justice Laws Canada, An Act respecting cyber security, S.C. 2026, c. 9, section 16, 2026). The consolidated text agrees on its face. The note under the title reads [Enacted by section 11 of chapter 9 of the Statutes of Canada, 2026, not in force.], and the line The following provision is not in force. repeats through the Act. No order fixing that day has been identified.

We checked the Canada Gazette Part II issue by issue, from Royal Assent through September 2026, and no coming-into-force order appears in any of them. The Orders in Council register could not be searched, because its search form does not respond. So the honest statement is that no order has been identified, not that none exists, and we would rather tell you which of those two we can stand behind.

Is anybody a designated operator yet?

No, and the schedule tells you so at a glance.

The Act works in two layers. Schedule 1 lists vital services and systems, and it is populated: telecommunications services, interprovincial and international pipelines and power lines, nuclear energy systems, federally regulated transportation, banking systems, and clearing and settlement systems.

Schedule 2 is where the obligations attach. It lists classes of operators and their regulators, and it is published with its two column headings and no rows underneath.

So the structure exists and the list is empty. Until an order populates Schedule 2, there is no designated operator in Canada and no live obligation on anyone.

That is worth knowing because a fair amount of commentary discusses C-8 as though it were operating. It is law, and it is dormant.

How will it reach you?

Through two provisions that speak about suppliers without speaking to them.

The first is the programme duty. A designated operator’s cyber security programme must identify and manage any organizational cyber security risks, including risks associated with the designated operator’s supply chain and its use of third-party products and services (Justice Laws Canada, Critical Cyber Systems Protection Act, paragraph 9(1)(a), 2026).

The second is sharper and less discussed. Once such a risk is identified, the designated operator must mitigate those risks (Justice Laws Canada, Critical Cyber Systems Protection Act, section 15, 2026).

Identify, manage, then mitigate. A duty to mitigate is not satisfiable by filing a risk register. It has to produce action, and when the risk in question is a supplier, the available actions are: ask the supplier for evidence, put terms in the contract, or stop using them.

That is the whole mechanism. Neither provision mentions you. Both of them end up on your desk.

What will they actually ask for?

Nobody can tell you precisely, because the regulations that will define programme content have not been made. What the statutory language points at, and what every comparable regime has produced, is a request for evidence instead of assurances.

Expect the incident response section of their questionnaire to get longer. Expect the questions that currently ask whether you have a plan to start asking when it was last tested and what came of it. Expect contract clauses on notification timelines, because a designated operator will have its own reporting obligations and will need you to tell it things quickly enough to meet them.

None of that is exotic. Large customers already ask most of it. C-8 gives the ones in banking, telecom, energy and federally regulated transportation a statutory reason to ask harder and to keep records of your answers.

What will your customers have to do?

Understanding the pressure on them explains the shape of what lands on you.

Once a class of operators is designated by order, a designated operator has 90 days to establish a cyber security programme (Justice Laws Canada, Critical Cyber Systems Protection Act, subsection 9(1), 2026). Ninety days is not long for an organisation the size of a bank or a pipeline operator, and it is the kind of deadline that gets met by sending questionnaires out early, not by inventing new processes.

The programme itself has to identify and manage organisational cyber security risks, protect critical cyber systems, detect incidents, and minimise their impact, with the supply chain named explicitly in the first of those. Then the separate mitigation duty bites on anything found.

So your customer’s timeline becomes yours. They will not wait for their own deadline to start asking, because the answers take time to collect and any finding about a supplier needs mitigating before they can call the programme established.

Is this the same as Bill C-26?

Effectively yes, and the naming trips people up.

An earlier Parliament considered a bill with the same architecture that died when Parliament was dissolved. C-8 is the successor, and it reached Royal Assent where its predecessor did not. If you read analysis written against the earlier bill, the structure carries over, though you should check any clause number you rely on against the Act as passed, not against commentary written about a draft.

Who is writing about this, and who is not

Worth saying plainly. Almost all the published analysis of C-8 is written for designated operators: what a bank or a pipeline operator must do, the programme, the reporting timelines, the penalties.

Very little is written for the fifty to three hundred person firm that sells software, professional services or facilities management to one of them. That firm has no obligation under the Act and will still carry a share of the compliance burden, because mitigating supply chain risk is something done to suppliers.

If that is you, the useful reading is not the Act. It is your largest customer’s vendor security questionnaire, which is where this will show up first.

What should you do now?

Nothing urgent, and two things that are worth doing anyway.

Know whether any of your customers sit in Schedule 1. Banking, telecommunications, nuclear, federally regulated transportation, interprovincial pipelines and power lines, clearing and settlement. If none of them do, C-8 is background reading for you.

If some of them do, get your incident response evidence in order on the ordinary timetable, not a crisis one. A written plan with a version and a date, a dated record of it having been exercised, and findings you can show were closed. That package answers the questionnaire you will be sent, the insurance application you already fill in, and the audit evidence request, which is three uses for one piece of work.

And watch for the coming-into-force order, not the commentary. When Schedule 2 gets rows in it, the questions will follow within a quarter or two.

Until then, anyone selling you C-8 readiness is selling you preparation for a regime that has not started, against regulations that do not exist yet. The work that pays off either way is the evidence package, because your customers are already asking for most of it and the Act only changes how hard they push.