Critics have also warned that the government could issue directives compelling companies to weaken or bypass encryption tools. The CCSPA does not prohibit such orders (McMillan, at para 3).

Unlike NIS2, which places significant emphasis on transparency, institutional accountability, and harmonized enforcement through national authorities, Bill C-8 consolidates authority within the federal Cabinet and delegates sweeping powers to the Minister without creating any independent regulatory body.