Managing Controlled Nuclear Information: What Canada’s Changing Import And Export Rules Mean For The Nuclear Sector

Summary

Those involved in importing or exporting controlled nuclear information should review this article because the applicable Canadian regime is undergoing significant change, with important consequences for both licensing and day-to-day management of information.

• New requirements take effect September 26, 2026, including a Canadian-address requirement for licensees, a written import/export process and expanded record-retention requirements (six years).
• Everyday business practices involving cloud storage, remote access, email, travel and remote work will require more regulatory consideration when they involve use of controlled nuclear information.
• Further CNSC guidance remains under development, including on how licensees are expected to meet their obligations to track and report electronic transfers or cloud storage of controlled nuclear information—an issue of particular concern for smaller organizations.

Scope of this article

This article addresses controlled nuclear information (“CNI”) only. The regulatory amendments discussed below are considerably more wide-ranging. Among other matters, they make changes relating to nuclear substances and equipment, safeguards, licensing exemptions, record retention and administrative monetary penalties. This article does not attempt to summarize those broader amendments; it is limited to the changes that are directly relevant to the import and export of controlled nuclear information and the associated proposed revisions to CNSC regulatory guidance.

Regulation of CNI generally

The Canadian Nuclear Safety Commission (“CNSC”) regulates the import and export of controlled nuclear substances, equipment and information under the Nuclear Safety and Control Act (“NSCA”) and, more specifically, the Nuclear Non-proliferation Import and Export Control Regulations (“NNIECR”). The NSCA identifies as one of its purposes the implementation in Canada of measures that Canada has agreed to respecting the international control of nuclear energy, including the non-proliferation of nuclear weapons and nuclear explosive devices. The NNIECR Schedule identifies the controlled nuclear substances, equipment and information that are subject to the import and export control regime.

The recent changes are staged:

• March 25, 2026: A number of regulatory amendments came into force, including amendments to the Schedule of controlled items and a change to the treatment of licences at the customs border.

• September 26, 2026: Further amendments that have already been enacted will come into force, including new requirements concerning the information that must accompany a licence application, including a Canadian address and a written import/export process, as well as a new record-retention requirement.

• REGDOC-2.13.2, Import and Export, Version 3: The CNSC has prepared a revised version of this document. It remains in draft form and is being revised following consultation with industry in August 2026.

Regulatory amendments effective March 25, 2026

One of the principal changes affecting CNI is the modernization of the customs-border requirements. The amendments remove the requirement for a licensee to present a CNSC import/export licence to a customs officer when importing or exporting prescribed information. This does not remove the underlying requirement to obtain a CNSC licence.

The Regulatory Impact Analysis Statement accompanying the amendments expressly explains that a licence remains necessary to import and export prescribed information notwithstanding the removal of the requirement to present the licence at the border. This change is particularly relevant to CNI because information can be transferred electronically or by other intangible means without a conventional physical shipment passing through a customs point.

The amendments also update the NNIECR Schedule to reflect more recent international control lists. The CNSC describes sections 6 to 73 of the amending regulations as updating the export-control list and explains that the six-month delay in coming into force was intended to allow industry to identify affected items and, where necessary, apply for and obtain import or export licences.

Of particular significance for CNI, paragraph A.4.1 has been replaced with a revised provision dealing with controlled “technology.” It covers technical data for the design, production, construction, operation or maintenance of Part A items and expressly includes such things as blueprints, plans, diagrams, models, formulae, engineering designs and specifications, software, manuals and instructions.

Information that is publicly available, including publications and publicly available websites, or that has otherwise been made available without restrictions on further dissemination, is excluded. Importantly, the amended provision expressly states that the technical data falling within A.4.1 is subject to control under both tangible and intangible modes of transfer.

The corresponding provision for dual-use information, B.3.1, has been amended in substantially the same manner. It identifies technical data relating to the design, production, construction, operation or maintenance of Part B items and expressly provides that such technical data is controlled under both tangible and intangible modes of transfer. Paragraph B.3.2 also provides a broader end-use or “catch-all” control for information not otherwise included in B.3.1 where the information is intended, or there are reasonable grounds to suspect that it is intended, in whole or in part, for use in connection with the design, development, production, handling, operation, maintenance or storage of nuclear weapons or other nuclear explosive devices.

These amendments therefore make particularly clear at the level of the regulations that the control of CNI is not confined to physical documents or other tangible media, something that had always been assumed and had been stated in the REGDOCs but not in the legislation itself.

Regulatory amendments coming into force September 26, 2026

A further set of amendments has already been enacted but, as of the date of this article, is not yet in force. These amendments are contained principally in sections 3 and 4 of SOR/2025-196. The amending regulations provide that these provisions come into force on the first anniversary of registration, which is September 26, 2026.

Implications for foreign nuclear organizations

One potentially significant change is a new Canadian-address requirement for licence applicants. Section 3 of SOR/2025-196 replaces paragraph 3(1)(a) of the NNIECR. Once in force, paragraph 3(1)(a) will require an applicant for an import or export licence to provide its Canada Revenue Agency business number, if applicable, its name, Canadian address, email address and telephone number. This is a very significant change: it means effectively that foreign entities will require a Canadian organization to act as licensee, rather than applying for licences directly.

New administrative requirement: A draft written process

At the same time, amended subsection 3(1) will impose another new application requirement of particular practical importance. New paragraph 3(1)(i) will require the applicant to provide “the applicant's written process for the import or export of the substance, equipment or information.” This requirement expressly includes information and will therefore apply to applicants seeking licences for the import or export of CNI.

The CNSC has not yet provided details as to what must be in such a written process. Gowling WLG has suggested that a draft template be prepared by the CNSC to provide some guidance; the CNSC noted that the were willing to provide such a draft, but it would likely be outside the REGDOC structure, in a separate note. The CNSC has stated that they wish such guidance to be a suggested approach and not mandatory, allowing organizations to provide their own policies rather than imposing a policy through regulatory requirements.

Record retention

New section 3.1 of the NNIECR will also establish a six-year record-retention requirement. A person must retain the import or export licence and all records relevant to imports or exports conducted under it for six years after the licence expires. The regulation identifies, where applicable, the licence application and supporting information, customs documentation, shipping documentation, purchase orders and certificates of manufacture, and notifications and other reports made under the licence. Although several of these examples are more naturally applicable to physical shipments of substances or equipment, the general obligation applies to all records relevant to imports or exports under the licence and therefore extends to records associated with CNI transfers.

The CNSC has explained that the one-year delay in bringing these provisions into force is intended to provide time to develop clear regulatory guidance concerning the CNSC's expectations for written procedures and to give licence holders time to ensure that their record-retention practices are up to date.

Proposed changes to REGDOC-2.13.2

The regulatory amendments are being accompanied by a substantial revision to REGDOC-2.13.2, Import and Export. It is important to distinguish these proposed revisions from the regulatory amendments themselves. Version 3 of REGDOC-2.13.2 has not yet been finalized. The stated changes include updated application instructions, a new section on reporting and a new Appendix A providing additional information concerning controlled nuclear substances, equipment, parts and information.

The CNSC consulted on the draft between February 18 and April 19, 2026, and subsequently held an engagement session with industry on August 13, 2026. Gowling WLG made recommended changes, particularly seeking clarity concerning obligations relating to cross-border exchanges of information and the use of AI, and attended the session to argue for their importance. The CNSC explained that the REGDOC had been revised both in response to the regulatory amendments and to address matters of interest to applicants and licensees, expressly identifying CNI as one such subject.

Meaning of controlled nuclear information and transfers

For CNI, the proposed REGDOC would provide considerably more detailed practical guidance than the regulations themselves. The draft explains that controlled nuclear information, referred to as “technology” in the NNIECR Schedule, encompasses information relating to the development, production or use of controlled items. It identifies both technical data—including drawings, specifications, manuals and instructions—and technical assistance, including instruction, skills, training, working knowledge and consulting services.

The draft also provides detailed guidance concerning the distinction between tangible and intangible transfers. Tangible transfers include moving electronic devices or physical media such as laptops, smartphones, tablets, CDs, DVDs, USB devices, hard drives and paper documents across the Canadian border. Intangible transfers may occur through email, cloud services, internet and intranet systems and faxes, as well as through verbal communications including conversations, telephone calls, meetings, virtual meetings and conferences.

Cloud services and remote access

The proposed guidance is particularly significant in relation to cloud services and remote access. The draft states that storage of CNI on a cloud server located wholly or partly outside Canada is considered an export and therefore requires an export licence and, in certain circumstances, may require an import licence. It also states that CNI stored on a server located entirely in Canada may nevertheless require an export licence where persons abroad have access to the information. Retrieving CNI from a cloud server may require an import licence depending on the type of information.

The proposed guidance indicates that licence applicants may be asked about matters such as the physical location of servers, governmental access resulting from the jurisdiction applicable to the cloud provider, controls over external and foreign access, records concerning user access and physical location, and encryption.

Travel and remote work

The draft similarly addresses travel and remote work. It states that movement of CNI across Canada's national boundary, whether tangible or intangible and even if temporary, constitutes an import or export subject to licensing. It further states that carrying or accessing CNI while travelling outside Canada is subject to export licensing and that import licensing may also apply when the information is brought back into Canada.

Individuals residing outside Canada but working for a Canadian organization are expected to have the appropriate licences in place to permit the exchange of CNI. The draft also addresses circumstances in which providing information to a foreign national while that person is physically in Canada may nevertheless constitute an export because the information is intended to be taken back to another country.

Public domain and research

The proposed REGDOC also addresses the distinction between public-domain information and information that is merely intended for publication. Information already in the public domain is not subject to licensing. By contrast, the draft states that CNI intended for publication but not yet in the public domain remains subject to export controls and takes the position that the act of publishing CNI requires export licensing because publication indirectly causes the information to be exported.

The draft further distinguishes basic scientific research from applied research. It states that A.4 and B.3 do not capture basic scientific research, while applied research may remain subject to licensing. This issue remains under consideration. During the August engagement session, the CNSC discussed possible revised language concerning applied research, including research directed at analysing, developing, producing or improving products or processes.

Compliance, tracking and reporting

The proposed REGDOC also provides more detailed guidance concerning how a licensee should demonstrate compliance in relation to CNI. The draft states that a licensee is expected to understand when CNI is being imported or exported regardless of the means of transfer. It recommends that licensees have a means of identifying controlled information, restricting access to it and tracking its movement. As an example, the draft states that where CNI is sent by email, the email should be associated with the requisite licence and readily identifiable to the licensee so that there is a record of the import or export.

These proposals generated significant industry comment. Concern was expressed that, if interpreted literally, the proposed guidance might imply enterprise-wide identification, labelling, access restrictions and electronic movement tracking across large repositories of information. The CNSC specifically discussed with industry what practices are currently used to ensure that CNI is imported or exported under a valid licence. Concerns were also raised about the email example and whether it might inadvertently create a new tracking requirement through guidance rather than regulation. These portions of the consultation draft should therefore not presently be treated as establishing a settled compliance standard.

The CNSC is also developing CNI-specific reporting guidance. A separate reporting template has been developed for CNI that excludes the ordinary quantity field and instead provides guidance concerning matters such as the description and date of the import or export. At the August engagement session, the CNSC indicated that the template would be published alongside the revised REGDOC if accepted. It also clarified that use of the template would be optional and that a licence holder could report in another format containing the required information.

Issues remaining under consultation and relationship to nuclear security guidance

Several important issues remain under active consideration. In particular, industry sought greater clarity concerning remote viewing, foreign servers and artificial intelligence. The CNSC's August engagement materials specifically identify questions concerning whether remote viewing of CNI constitutes an import or export depending on the location of the viewer and server, and how AI is being used in connection with CNI. These questions illustrate the difficulty of applying a traditional territorial import/export regime to modern digital information systems and remain relevant to the finalization of the REGDOC.

There is also an important relationship between REGDOC-2.13.2 and the CNSC's separate work on nuclear security. Industry proposed that REGDOC-2.13.2 provide more explicit guidance on the management of CNI in modern digital environments, including reference to recognized information-security standards and recent nuclear-sector guidance. The CNSC responded that staff are discussing this issue with the team developing the REGDOC-2.12 series dealing with nuclear security. Accordingly, REGDOC-2.13.2 should principally be understood as addressing whether and when an import or export of CNI occurs and the licensing and compliance consequences of that transfer. The broader question of how sensitive nuclear information should be protected in digital environments overlaps with the separate nuclear-security regulatory guidance and has not been finally resolved through the present REGDOC process.

The CNSC has confirmed that the consultation process for REGDOC-2.13.2 remains ongoing. At the conclusion of the August 13 engagement session, CNSC staff stated that further revisions would be made to the REGDOC before it is presented to the Commission in the fall and that staff would work with affected parties in planning implementation of changes to import/export licensing. The precise wording of the proposed guidance described above is therefore subject to further change.

Conclusion

In light of the significant changes that have already occurred, are coming into force, and are reasonably anticipated as a result of the ongoing REGDOC development process, all organizations using controlled nuclear information should be considering the following:

• their readiness for the September 26, 2026, licensing requirements, including the written-process requirement;
• their existing record-retention practices, and how they will comply with the new six-year retention requirement;
• whether they have adequately considered the compliance implications of how CNI is transmitted electronically or accessed through cloud and remote-working arrangements in their organization; and
• for international organizations, whether the new Canadian-address requirement affects existing or planned licensing arrangements.

Read the original article on GowlingWLG.com

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.