A federal statute can receive Royal Assent without all of its obligations becoming operative at once. That distinction is central to Canada's latest cybersecurity legislation. An Act respecting cyber security, S.C. 2026, c. 9, received Royal Assent on June 15, 2026. Its telecommunications amendments took immediate effect, while the separate Critical Cyber Systems Protection Act remains subject to future commencement orders. The difference has practical consequences for organizations trying to determine what the law requires today.
Part 1 amends the Telecommunications Act and adds the security of the Canadian telecommunications system to its policy objectives. It gives the Governor in Council and the Minister of Industry powers to respond to threats affecting telecommunications infrastructure. The statute allows orders directing service providers to take or refrain from specific actions where the governing statutory requirements are met, and it establishes mechanisms for compliance, penalties and judicial review. These authorities are already part of the legal landscape, although the actual obligations of a provider depend on any applicable orders and regulations.
Part 2 contains the Critical Cyber Systems Protection Act, a framework designed to protect vital services and systems within federal jurisdiction. Its schedule identifies telecommunications, interprovincial or international pipelines and power lines, nuclear energy, federally regulated transportation, banking and clearing and settlement systems. Those sectors are broad enough to include operations on which other Canadian businesses depend, but sector membership alone shouldn't be confused with formal designation as a regulated operator.
The framework contemplates designating vital services and classes of operators, requiring security programmes, supply chain risk measures, incident reporting and compliance with cybersecurity directions. Those are significant prospective obligations. Yet section 16 of the 2026 statute provides for commencement by order of the Governor in Council, and the official Justice Laws text expressly notes that Part 2 remains out of force. A prudent compliance document should state both facts rather than presenting the entire statute as already enforceable.
A second distinction concerns which organization has legal responsibility. A supplier might provide information technology services to a regulated bank, carrier or energy operator without itself falling within a future designated class. Its contractual duties may be extensive, but they arise from an agreement and any laws already applicable to it, not automatically from every anticipated obligation in an uncommenced federal statute. The position can change if the relevant regulations later designate additional operators or create requirements that affect the relationship.
For regulated enterprises, uncertainty about commencement is a reason to map systems and dependencies while maintaining an accurate legal obligations register. Boards can identify who controls important systems, where supplier concentration creates operational risk, how an incident would be detected and escalated, and what would be needed to demonstrate compliance once duties begin. That preliminary work may be sensible risk management, but it shouldn't be labelled a statutory obligation that has already taken effect.
There are important safeguards and limits in the law. The telecommunications provisions contain statutory criteria governing the use of security direction powers, with review mechanisms that differ depending on the type of order. The critical systems framework also addresses government information exchange and the handling of sensitive information. These provisions deserve a reading in their own context. It would be inaccurate to describe the statute as either an unlimited executive power or a complete operational manual for every affected company.
The government announced Royal Assent in June and said implementation of the critical systems legislation would proceed in phases. That announcement signals the intended direction, but the operative statute and subsequent commencement instruments determine the timing of enforceable duties. Businesses need a process for tracking those instruments, not an assumption that every announced requirement is already law.
Legal readiness improves when a company distinguishes current powers, forthcoming regulatory duties and contractual commitments made in anticipation of them. Those categories may eventually converge, but until then their separate status is an essential part of responsible legal advice and sound operational planning.
Sources
Justice Laws, An Act respecting cyber security, S.C. 2026, c. 9, complete enacted text. Public Safety Canada, Royal Assent and staged implementation, June 16, 2026.