Six words in Canada’s new cyber statute decide who has to prepare for the next generation of ransomware: “within the legislative authority of Parliament.” The Critical Cyber Systems Protection Act uses that phrase to fence its reach, and on November 3 the United Kingdom’s National Cyber Security Centre gave Canadian readers a reason to check where the fence runs. Our view is that a provincial hospital, a health authority or a municipal utility buying AI tools should stop waiting for Ottawa and write the Act’s duties into its own contracts now, because the Act will not reach them and, today, binds no one at all.
Key points
What did the NCSC actually conclude about AI and essential services?
The NCSC concluded that AI will mostly speed up attacks on weaknesses that already exist. Its November 3, 2026 assessment judges it highly likely that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure before 2028, and it adds that AI tools deployed inside that infrastructure create new openings of their own.
That second point is the one a Canadian buyer should underline. The assessment treats an operator’s own AI rollout as part of the exposure, alongside ageing systems that were never patched. The NCSC’s launch release frames the problem as years of underinvestment that AI will now expose faster, which is a judgment about budgets as much as about software. The document describes three scenarios for 2028 and is careful to call them possibilities, which is a discipline some of the coverage did not share.
Canada’s own assessment points the same way. The Canadian Centre for Cyber Security’s National Cyber Threat Assessment 2025-2026 ranks ransomware as the leading cybercrime threat to the country’s critical infrastructure and says AI is almost certainly lowering the barriers to entry for attackers. The two agencies are not describing different countries’ problems. They are describing one problem from two capitals.
The Act as printed, line by line
Which services does the Critical Cyber Systems Protection Act leave out?
It leaves out everything Parliament does not regulate, which includes hospitals, health authorities, long-term care, municipal water and the local electricity grid inside a province. Schedule 1 names six vital services, and none of them is health care or water. Section 6 lets cabinet add more, but only services within federal authority, so a hospital cannot simply be added later.
The power sector shows how tight the wording is. Schedule 1 covers “interprovincial or international” power line systems. Our reading is that a provincial transmission and distribution network, the wires that actually reach a hospital in Saskatoon or a water plant in Moncton, sits outside that phrase unless it crosses a border. Counsel at a utility will want to test that reading against its own assets, and some will find part of their network inside the federal fence and part outside it.
Someone will say this was always the design. Health and municipal services belong to the provinces under the Constitution, and nobody in Ottawa promised a national hospital cyber law. That is correct, and it is also the point. The UK warning is about essential services in general, and the Canadian statute that most people will cite when the subject comes up covers a deliberately narrower set. Nothing in Canadian law is broken by that gap. It simply means the duty to prepare sits with whoever signs the provincial operator’s contracts.
Which clauses can a provincial operator borrow from the Act today?
It should write in the same duties the federal Act will one day impose on banks and telecoms: a security program with supply-chain controls, incident reporting inside 72 hours, and a duty to act on directions. Those obligations are already drafted and debated, so a hospital or utility can copy their shape into an AI contract this quarter.
Sections 9 and 17 of the Act supply most of the list. Section 9 will require a designated operator, within 90 days of joining a class, to set up a program that manages risks “including risks associated with the designated operator’s supply chain,” and section 15 adds a separate duty to mitigate supply-chain and third-party risks. Section 17 sets a reporting window that regulations may shorten but never stretch past 72 hours, and section 20 lets cabinet direct an operator to take specific protective measures. Translated into a purchase file for an AI scheduling, triage, transcription or maintenance tool, that gives a buyer five clauses to ask for:
- Notice of any incident within 72 hours, measured from when the vendor becomes aware, with the same detail the operator would need to report it to its own board or privacy commissioner.
- A written list of the AI components and subprocessors the tool depends on, including the model provider, with notice before any change.
- The right to suspend the tool’s access to clinical, billing or control systems without penalty when the operator decides a risk is live.
- Patch and model-update timelines stated in days, plus a duty to disclose a known vulnerability before the fix ships.
- An annual review of the vendor’s controls, mirroring section 13, which makes a designated operator review its own program on every anniversary unless regulations set other dates.
None of these depends on the Act coming into force. They are ordinary commercial terms, and a supplier that already serves a Canadian bank will recognise them. Earlier columns here made the same point from other angles, on model provenance as a supplier question and on giving each AI agent a key of its own. For a smaller operator, Harper’s patch plan for who can switch your website off is a fair place to rehearse clause four.
Frequently asked questions
Is the Critical Cyber Systems Protection Act in force?
No. It received royal assent on June 15, 2026 as part of Bill C-8, but it comes into force only on a date set by cabinet order. The Justice Laws text, current to October 19, 2026, marks it not in force, and its list of designated operators is still empty.
Does the Critical Cyber Systems Protection Act cover hospitals?
No. Its schedule of vital services lists telecommunications, interprovincial or international pipelines and power lines, nuclear energy, federal transportation, banking, and clearing and settlement. Cabinet can add services only if they fall within federal authority, and hospitals are run under provincial jurisdiction.
What did the UK’s NCSC say about AI ransomware?
In an assessment published November 3, 2026, the National Cyber Security Centre judged it highly likely that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure before 2028. It also said AI tools deployed inside that infrastructure widen the attack surface.
How fast must a designated operator report a cyber incident under Bill C-8?
Once the Act is in force and an operator is designated, section 17 requires a report to the Communications Security Establishment within a period set by regulation that cannot exceed 72 hours.
Last fact-checked November 4, 2026, against the Justice Laws text of the Act, the royal assent version of Bill C-8, the NCSC assessment and release of November 3, 2026, and the Cyber Centre’s National Cyber Threat Assessment 2025-2026.
What happens next is a cabinet order, and it will arrive with little warning. When the first class of operators appears in Schedule 2, the federally regulated sectors will have 90 days to build a program. A provincial operator that has already put those five clauses on its AI contracts will be ahead of them, under a law that never applied to it.
