CARegulatedCanada
Canada's ITSM.40.001 roadmap sets concrete migration years (initial plans by April 2026, high-priority systems by end-2031, remaining systems by end-2035) for Government of Canada departments, but it is framed as guidance whose actual binding force is deferred to a forthcoming Treasury Board policy instrument, with no published enforcement mechanism yet.
Canada's post-quantum cryptography posture is classified as regulated, led by Canadian Centre for Cyber Security (Communications Security Establishment), with a migration target of 2031. It scores 60/100 on this tracker's rubric, one of the more binding and actively enforced rules on this tracker, and that is not a measure of how secure or advanced the country actually is.
What's verified
The Canadian Centre for Cyber Security (within CSE) published ITSM.40.001, a roadmap recommending that every Government of Canada department develop a tailored PQC migration plan by April 2026, complete migration of high-priority systems by end of 2031, and complete migration of remaining non-classified systems by end of 2035. The roadmap itself is guidance/recommendation (using "recommends" language), not a binding mandate: it states that Treasury Board of Canada Secretariat (TBS) "will issue the necessary policy instruments to require responsible officials to establish a departmental PQC migration plan," meaning the actual mandate is a forthcoming TBS policy action, not something ITSM.40.001 itself imposes. The April 2026 deadline is specifically for departments to "develop an initial departmental PQC migration plan," not to complete any migration by that date.
Score rationale
Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.
| Axis | Score | Why |
|---|---|---|
| Mandate strength | 10/20 | ITSM.40.001 itself is guidance ('recommends') applying only to Government of Canada departments, not economy-wide law, and it explicitly defers the real binding force to a forthcoming Treasury Board of Canada Secretariat policy instrument ('will issue the necessary policy instruments to require responsible officials...'), so this scores as binding-for-a-subset (GC departments) rather than a present, enforceable, penalty-backed mandate. |
| Deadline concreteness | 20/20 | The source publishes three specific hard years/dates: initial departmental PQC migration plans due April 2026, high-priority systems migrated by end of 2031, and remaining non-classified systems by end of 2035. |
| Scope of coverage | 10/20 | Coverage is limited to Government of Canada departments and their IT systems ('Every organization managing information technology systems' in context refers to GC bodies), not economy-wide or all critical infrastructure, and not a specific regulated private sector like banking or telecom. It sits closest to the government-systems-only end, but with an explicit department-wide scope across all of GC. |
| Inventory/CBOM requirement | 10/20 | The roadmap requires each department to develop a tailored PQC migration plan, which implies an inventory of cryptographic assets/public-key usage as a practical precondition, but the evidence provided does not name an explicit 'cryptographic inventory' or 'CBOM' requirement directly. |
| Regulatory activity | 10/20 | A named authority (Canadian Centre for Cyber Security / CSE) published the roadmap and TBS is identified as the body that will issue policy instruments, but the evidence shows no published enforcement mechanism such as fines, audits, or certification, only a future intent to require compliance via policy instruments. |
| Total | 60/100 | A blunt sum of the five columns to its left. |
Related regulators
Sector bodies checked independently, not assumed from the primary source above.
- Has published guidance
OSFI (Office of the Superintendent of Financial Institutions)
A March 2026 Technology Risk Bulletin directs federally regulated banks and insurers to maintain a centralized inventory of cryptographic assets, including algorithms, protocols, keys, certificates, secrets, and relevant third-party dependencies, and sets phased readiness milestones toward quantum readiness across all systems by 2035. OSFI aligns its timeline with CCCS, NIST, and G7 Cyber Expert Group guidance rather than deriving it independently, but the bulletin is OSFI's own dated, binding-context supervisory document naming PQC and cryptographic inventory explicitly.
- In progress, no guidance yet
Bank of Canada
The Bank has taken real research steps short of regulatory publication: a 2023 staff working paper on post-quantum-secure payment credentials, a 2024 research engagement with evolutionQ on quantum-safe encryption for a potential digital Canadian dollar, and an internal Quantum Lab, but none of these are guidance directed at supervised institutions.
Staff working paper on post-quantum-secure payment credentials (2023) → - Not yet addressed, a gap to watch
CRTC (Canadian Radio-television and Telecommunications Commission)
The CRTC's most relevant activity is a 2025 network-resiliency consultation concerning outages and redundancy, not quantum-safe cryptography or cryptographic inventory.
FAQ: Canada and PQC
- Does Canada have a post-quantum cryptography (PQC) law?
- Partially. The rule is binding for a specific regulated subset, not the whole economy. The issuing body is Canadian Centre for Cyber Security (Communications Security Establishment).
- What is Canada's PQC migration deadline?
- 2031. See the sources below for what this deadline actually covers, since it may apply only to specific sectors or system types. The deadline came from Canadian Centre for Cyber Security (Communications Security Establishment).
- Does Canada require a Cryptographic Bill of Materials (CBOM)?
- Implicitly. The sources imply organizations will need a cryptographic inventory to comply, without naming CBOM as a formal requirement.