New Nuclear Security Regulations

Summary#

The Canadian Nuclear Safety Commission has issued the final Nuclear Security Regulations, which replace the previous rules and set new security, cyber and access controls for nuclear sites and materials. The regulations were registered on October 30, 2025 and published in the Canada Gazette on November 19, 2025; existing sites get a transition period of two years to come into compliance.

What it does#

• Replaces the old Nuclear Security Regulations with a modern, mostly outcome-focused rule set called the Nuclear Security Regulations.
• Requires each licence applicant and operator (a “licensee”) to have a written nuclear security plan and a threat and risk assessment:
  • Update the plan at least once per year and review the threat assessment at least once every 5 years (and sooner if threats change).
• Adds explicit cyber security and information-protection rules. Licensees must protect computer systems and identify and protect “sensitive information” based on their threat and risk assessment.
• Sets new area rules and access controls for sites:
  • Defines and requires protections for “protected areas,” “vital areas” and “inner areas.”
  • Tightens identity checks, escorts and who may enter these areas.
  • Requires searchable entry/exit procedures and visible signage about searches.
• Changes how people get authorized to access sites:
  • Introduces facility, site and enhanced clearances. Some clearances may last up to 10 years; enhanced clearances up to 5 years.
  • Enhanced clearances require extra checks, including a credit check.
• Strengthens security personnel and response requirements:
  • Requires trained nuclear security officers and support personnel, equipment, regular training, drills and exercises.
  • High-security sites must maintain or justify not having an on‑site nuclear response force and must have written arrangements with off‑site response forces (police, armed units, or military).
  • Central alarm station plus an independent backup alarm station are required, with a “two-person” or equivalent protection against single-person tampering.
• Sets routine testing and practice:
  • Security drills at least once every 30 days.
  • Large site security exercises at least once every 2 years; transport exercises at least once every 5 years.
• Uses international technical references by incorporation:
  • The Directive on Security Screening (for clearances) and the IAEA Dangerous Quantities of Radioactive Material (D-Values) (to decide which non‑nuclear substances need extra protection).
• Introduces administrative monetary penalties for many specific breaches.
• Provides a transition and repeal:
  • The previous Nuclear Security Regulations are repealed.
  • Existing licences and authorizations remain valid until they expire, and licensees have two years to meet the new rules.

Who's affected#

• Operators and owners of nuclear facilities and sites (the regulation calls them “licensees”), including:
  • Major power plants and other “high-security sites” that handle Category I or II nuclear material.
  • Other facilities such as research reactors, fuel processing, fuel fabrication and nuclear-substance processing sites.
• Companies and organizations that transport Category I, II or III nuclear material.
• Security staff, contractors and any workers who need access to protected, vital or inner areas.
• Local and provincial police, and other off‑site response forces that may be part of written response arrangements.
• Regulators and the public who interact with sites through inspections, exercises or licence applications.
• The CNSC engaged Indigenous communities during development; the final text does not identify specific impacts on Indigenous or treaty rights, and the CNSC said it will continue to engage any Indigenous group that requests it.

Why it matters#

• Responds to modern threats: the rules add cyber security and stronger insider‑threat and information‑protection measures. That aims to reduce the risk of theft, sabotage or cyber attack on nuclear facilities and materials.
• Real effects for workers and contractors: more identity checks, possible credit checks for higher clearances, more frequent training and searches, and stricter escorted‑access rules.
• Operational and cost impacts for operators: the government estimates a total present‑value cost of $141.3 million, and a present‑value benefit of $221.5 million, giving a net present value of $80.2 million. The largest costs are for new protections of vital areas and backup alarm stations. The biggest quantified benefit comes from allowing performance-based security approaches that could reduce staffing costs for new reactor builds (for example, small modular reactors).
• Supports new reactor technologies: the regulations move toward performance-based requirements and allow safety‑and‑security‑by‑design and off‑site response options. That is intended to lower regulatory barriers for small modular reactor projects while keeping security outcomes.
• Transition time: licensees have two years from registration to adapt their facilities and practices to the new rules.