Instrument and legal status
Jurisdiction: Canada
Issuer: Treasury Board of Canada Secretariat
Instrument date: 2026-10-01 (effective date; backfill)
Status: Federal administrative security-policy direction — binding within the existing in-scope government policy chain
Reviewed: 2026-10-27
FACT — official development
Effective 1 October, the SPIN reinforces existing government security/digital requirements for organizations covered by section 6 of the Policy on Government Security. It prioritizes critical services, baseline controls and assume-breach recovery. It is not a universal private-sector AI statute.
LEGAL FORCE — scope and limits
This is an expressly dated backfill, effective 1 October. Section 4 identifies covered organizations through the existing Policy on Government Security; sections 6–8 set actions, phased implementation and monitoring. The prioritized critical-services list is due 30 November. It does not replace existing policies.
INTERPRETATION / IMPLICATION — enterprise relevance
Suppliers should examine contractual security requirements: departments remain accountable for third-party services and should reflect relevant SPIN requirements in procurement and contract management.