Public Sector Artificial Intelligence and Cybersecurity Governance Act, cybersecurity requirements for public sector entities
S.M. 2026, c. 43, ss. 1, 3, 7-9 and 10(2)
A sector security regimes rule binding government bodies.
- Obligation class
- Security, Reporting, Governance
As of .
What it requires
- This Act binds prescribed public sector entities (the government, government agencies, other reporting organizations under The Financial Administration Act, municipalities, incorporated communities and local government districts) (ss. 1, 3).
- A prescribed public sector entity must comply with the prescribed requirements for cybersecurity and the prescribed technical standards for cybersecurity (ss. 7-8).
- A prescribed entity to which the minister issues a directive on those requirements and standards must comply with it (s. 9).
- The regulations may require an entity to develop and implement a cybersecurity program and to report cybersecurity incidents to the minister or a specified individual (s. 10(2)).
These lines are LexLint's reading of the law's text, as of .
What this law does
The Public Sector Artificial Intelligence and Cybersecurity Governance Act received Royal Assent on . It comes into force on a day to be fixed by proclamation. Its purpose includes setting cybersecurity standards. It applies to prescribed public sector entities, which are drawn from the government, government agencies, other reporting organizations under The Financial Administration Act, municipalities, incorporated communities and local government districts.
A prescribed public sector entity must comply with the prescribed requirements for cybersecurity. A prescribed public sector entity must comply with the prescribed technical standards for cybersecurity. The minister may, with the approval of the Lieutenant Governor in Council, issue a directive to a prescribed public sector entity respecting the cybersecurity requirements and technical standards. The entity to which a directive is issued must comply with it.
The minister must make the directive publicly available in any manner the minister considers appropriate. The Lieutenant Governor in Council may by regulation prescribe the public sector entities that are required to develop and implement programs for ensuring cybersecurity. The Lieutenant Governor in Council may by regulation require public sector entities to submit reports to the minister or a specified individual in respect of incidents relating to cybersecurity.