The Senate of Canada passed Bill C-8, the federal government’s cybersecurity bill for critical infrastructure, on June 4, 2026, according to LEGISinfo, Parliament’s bill-tracking service. Senators approved it without amendment at third reading, a chamber’s final debate and vote on a bill, the Senate recorded in its Journals. The House of Commons had passed the bill on March 26, so it now awaits Royal Assent, the last formal step before it becomes law.
Both chambers passed the bill without the words “quantum” or “cryptography” anywhere in its text. Its two references to encryption are limits on government power. Under the telecom part, the industry minister may not order “the decoding of an encrypted private communication,” and the federal cabinet may not order such decoding in a cyber security direction.
Federal departments already work to deadlines for moving to post-quantum cryptography, the algorithms designed to resist attacks by future quantum computers. In an October 2025 notice, the Treasury Board of Canada Secretariat set the end of 2031 for high-priority federal systems and the end of 2035 for all other federal systems, but Parliament put no comparable requirement in the bill for the operators under it, such as banks, telecoms, pipelines, and nuclear plants.
What the bill would require
Under the bill’s first part, an amendment to the Telecommunications Act, the federal cabinet and the industry minister could order telecom providers to take or stop specified actions to secure the country’s networks. In formal terms, the cabinet acts as the Governor in Council. The minister could not order a company to intercept private communications.
The bill’s second part is the text of a separate statute, the Critical Cyber Systems Protection Act. Under it, the cabinet would designate classes of operators in six areas that the bill lists as vital: telecommunications services, interprovincial or international pipeline and power line systems, nuclear energy systems, federally regulated transportation systems, banking systems, and clearing and settlement systems.
A designated operator would have 90 days after joining a designated class to establish a cybersecurity program for its critical cyber systems. It would also have to report cybersecurity incidents to the Communications Security Establishment, the federal agency that runs the Canadian Centre for Cyber Security, within a period set by regulation that may not exceed 72 hours.
The cabinet could also order operators to comply with specific security measures, known in the bill as cyber security directions. Under the House-passed text, the maximum administrative penalty would be $15 million per violation for organizations and $500,000 for individuals, with each day of a continuing breach counted separately.
The cabinet would decide by order when the act takes effect. Operators would get their 90 days only after the cabinet designates their class in an order published in the Canada Gazette.
The Senate exchange on quantum computing
During debate on June 3, Senator Mohamed-Iqbal Ravalia asked John McNair, the senator who had moved the bill’s third reading, whether there had been “any discussion about quantum computers and the severe threat that they pose, potentially using quantum technology to break standard encryption,” according to the Debates of the Senate.
“There was no direct discussion at the committee level,” McNair replied, “but there was discussion among people on artificial intelligence and quantum computing.” He called the bill “generic at this stage” so that “the regulatory process can deal with issues around quantum computing and artificial intelligence.”
The Senate adjourned the debate that day and passed the bill the next.
Federal migration deadlines
The Canadian Centre for Cyber Security published its roadmap for migrating Government of Canada systems to post-quantum cryptography, document ITSM.40.001, in June 2025. The Cyber Centre wrote it for federal departments and agencies moving their non-classified IT systems, including those on contracted and cloud infrastructure, to standardized post-quantum algorithms.
The Cyber Centre listed April 2026 for each department’s initial migration plan, with progress reports every year from then on. It set the end of 2031 for completing the migration of high-priority systems and the end of 2035 for all remaining systems.
The Cyber Centre advised departments to treat as high priority any system exposed to “harvest now, decrypt later” attacks. In such an attack, an adversary records encrypted data today to decrypt once a powerful enough quantum computer exists.
The Cyber Centre wrote that the Treasury Board Secretariat “will issue the necessary policy instruments” to require departmental plans and progress reports. It also advised departments to build post-quantum requirements into new procurements.
The Secretariat did so on October 9, 2025, in a Security Policy Implementation Notice on migrating the Government of Canada to post-quantum cryptography, effective that day. Under the notice, departments and agencies had until April 1, 2026, to draw up a high-level migration plan and begin reporting progress every year.
The Secretariat also required post-quantum procurement clauses in every contract with a digital component entered into after that date. It set the same completion dates as the roadmap, the end of 2031 for high-priority systems and the end of 2035 for remaining systems.
An earlier version of the bill
Bill C-8 has the same title as Bill C-26, a bill the government introduced in the previous Parliament in June 2022. The Senate passed C-26 with an amendment in December 2024. The parliamentary session ended on January 6, 2025, with that amendment still before the House of Commons, according to LEGISinfo.
Update, November 13, 2026: Bill C-8 received Royal Assent on June 15, 2026, as S.C. 2026, c. 9, according to LEGISinfo. In the Justice Laws consolidation current to October 19, the act’s Part 2, the Critical Cyber Systems Protection Act, was not in force.
