For safety-sensitive positions at Canada's high-security nuclear sites, CNSC REGDOC-2.2.4 caps work at 16 hours in any 24, 28 in any 48, and either 60 hours in a fixed week or 120 in a rolling 14 days, plus a 54-hour weekly average. There is no busy-season exception. The limits go with the position rather than the employer, so contract trades in positions the licensee has listed as safety-sensitive carry the same ceiling as staff, and licensees must keep a record of every shift worked and every breach.
This article is for general information and is not legal advice. Requirements change and apply differently by site, position and collective agreement. Confirm your obligations with qualified counsel.
Nuclear power runs on a famous design philosophy: assume any single protection can fail, and make sure another one is standing behind it. Engineers call it defence in depth, and it is why a nuclear plant is one of the most carefully protected workplaces on Earth.
Then the contractor timesheets show up in a spreadsheet.
Here is the connection. A tired worker makes mistakes. That is not a character flaw, it is biology. So Canada's nuclear regulator, the CNSC, treats fatigue the way the industry treats every other hazard, with hard limits, backup rules, and records to prove it all. The rulebook is REGDOC-2.2.4, Fitness for Duty: Managing Worker Fatigue, published in March 2017 and unrevised since[1][2]. Once you see how it is built, one conclusion is hard to avoid: at a nuclear plant, the work schedule is not an admin chore. It is a safety document. The question, as Canada heads into its busiest nuclear decade since the original CANDU build-out, is whether it is being managed like one.
What the limits actually are.
For workers filling safety-sensitive positions at high-security nuclear sites, as defined in the Nuclear Security Regulations, the licensee must ensure hours worked do not exceed[1]:
| Time frame | Limit on hours of work |
|---|---|
| In a 24-hour period | 16 |
| In a 48-hour period | 28 |
| Fixed 7 days or rolling 14 days | 60 or 120 |
| Fixed period up to 13 weeks or rolling period up to 18 weeks | 54 average per week |
One qualifier belongs here, before anything is built on those numbers. REGDOC-2.2.4 says of itself that for existing facilities "the requirements contained in this document do not apply unless they have been included, in whole or in part, in the licence or licensing basis", and that a graded approach commensurate with risk may be used in applying them[1]. That is a real qualifier rather than a loophole: the document is written to be incorporated, and where it has been, the limits below are what it sets. Confirm what your own licence incorporates.
With the exception of shift turnover, all time present at work counts toward those limits[1]. And there is no busy-season exception. The same limits apply at the peak of a major refurbishment as on a quiet Tuesday. A licensee can propose alternative limits, but the proposal has to demonstrate an equivalent level of safety, has to be science-based, and has to be approved by the Commission.
Why the rules look the way they do.
Most workplaces have one overtime rule. Nuclear has a lattice of them, and each one blocks a different way of getting dangerously tired. The 16 in any 24 stops the brutal single day. The 28 in any 48 stops back-to-back doubles. The 60 in a week, or 120 in any rolling 14 days, stops the slow grind. The 54-hour weekly average, taken over as much as 13 fixed or 18 rolling weeks, stops the long drift nobody notices until it is chronic.
Recovery is regulated too. A worker gets a minimum of 8 consecutive hours free from work between shifts, and the guidance says 11 should be the norm, with 8 used rarely[1]. After that the rules split by shift length, which is the detail most summaries drop:
| Shift length | Maximum consecutive nights | Recovery after a block of nights |
|---|---|---|
| 8 to 10 hours | 5 | 48 hours after 4 or more |
| Over 10 and up to 12 hours | 4 on straight nights, but 3 where a block mixes day and night shifts on consecutive calendar days, and no more than 6 shifts on consecutive calendar days either way | 72 hours after 3 or more; 48 hours after exactly 2 |
The 12-hour band is the one most operations live in, and it is the stricter of the two. On a 12-hour rotation, three consecutive nights is already enough to trigger a full 72 hours off.
The regulator even looks at whether you employ enough people. Staffing levels must be sufficient to ensure that training, sickness, vacation and staff turnover do not lead to non-compliance with the hours limits or the recovery periods, as far as reasonably practicable[1]. If the only way to cover vacations and sick days is breaking the limits, that is a staffing problem before it is a scheduling one.
There is a detail here that anyone who has worked in nuclear will recognise as pure industry DNA. The CNSC's guidance says licensees should establish administrative limits that prevent workers from consistently working the maximum allowable hours[1]. Set your own ceiling below the legal one, so day-to-day planning never rides the regulatory limit. Keep margin. It is the same instinct the industry applies to everything else in the plant.
Which rulebook governs an Ontario nuclear schedule?
Now for the part that surprises even seasoned HR people. When you build a shift schedule at an Ontario nuclear plant, four different sets of rules have to agree.
Federal law, because the Supreme Court decided in 1993 that nuclear work belongs to Ottawa. In Ontario Hydro v. Ontario (Labour Relations Board), a divided Court held that labour relations at nuclear generating stations fall under federal jurisdiction, through the declaratory power and the national concern branch of peace, order and good government[3].
Ontario's employment rules, because Ottawa then turned around and adopted them. A federal regulation, SOR/98-181, excludes employment at these nuclear facilities from Part III of the Canada Labour Code and applies Ontario's Employment Standards Act, 2000 in its place, as amended from time to time[4]. So the substantive rules are Ontario's, adopted by federal regulation and modified in places. The jurisdiction is Ottawa's. New Brunswick has a comparable arrangement for Point Lepreau under SOR/2008-76, though it is structured differently and carves out employment related to construction[13].
The collective agreement, which decides who gets offered overtime, in what order, at what rate. Nuclear workforces are heavily unionised, and a companion regulation, SOR/98-179, does the same for labour relations, so bargaining at these sites runs under Ontario's Labour Relations Act, 1995[5]. Offer the extra shift to the wrong person and you have bought a grievance along with the coverage.
The CNSC's fatigue limits, which sit on top of everything. This is the layer that does not bend to the others: a collective agreement governs who is offered the shift, not whether the hours are permitted.
One more wrinkle. Fatigue-tracking tools built for the American market encode the US rulebook, NRC 10 CFR Part 26, and it is closer to Canada's than it looks. It shares two of Canada's numbers: 16 work hours in any 24-hour period, and a maximum weekly average of 54 hours, though the US averages that over up to six weeks where Canada allows up to 13 fixed or 18 rolling, and offers it as an alternative to a minimum-days-off rule rather than a standing cap[7]. After that they diverge. The US allows 26 hours in any 48 where Canada allows 28, and 72 hours in any rolling 7 days where Canada's alternative is 60 in a fixed 7 days, or no 7-day limit at all where the licensee has elected the rolling 14-day option[7]. Then comes the difference that matters most here. For the first 60 days of a unit outage, the US rule lifts its days-off and average-hours requirements altogether for people working outage activities[7]. Canada grants no such relief. The busy season is exactly when the American rulebook loosens and the Canadian one does not. The matching numbers are the trap, because 16 in 24 is the one most people spot-check. A useful question for any tool is simply: whose rules does it know, and can it show you the rule it applied? Because a system enforcing the wrong country's limits does it very fluently.
Worth watching: replacement regulations for the whole Ontario set were proposed in the Canada Gazette in April 2024, largely because the existing ones are still written around Ontario Hydro, which no longer exists. They remain unfinalised, and the 1998 regulations are still the operative ones[4][6].
The hard part is not the rules. It is the outage.
Every few years, a reactor unit shuts down for maintenance or a multi-year refurbishment, and the site's population explodes: thousands of supplemental tradespeople from dozens of contractor companies, working around the clock on a tight critical path.
Here is what makes that a compliance puzzle: the hour limits go with the position, not with the employer. The document notes that its definition of a worker "applies to workers directly employed by a licensee, as well as to contractors and to subcontractors", and it applies the limits to workers filling safety-sensitive positions, which the licensee must list in its governing documents[1]. A contract steamfitter in a position the licensee has listed as safety-sensitive therefore carries exactly the same ceiling as a staff operator: the fixed 7-day or rolling 14-day total, whichever the licensee has adopted. So the plant needs to know the hours every worker has accumulated, across every employer on site, which is the same consolidation problem airport contractors face under the Healthy Terminals Act. And the rules require the licensee to retain records of shifts worked and of every non-compliance with the limits, including those that happen during exceptional circumstances[1]. During a refurbishment, that is tens of thousands of shift assignments a month, each one a small compliance decision.
When those hours live in separate systems and get stitched together in a spreadsheet after the fact, rather than in one record of time worked, you do not have a safety barrier. You have a filing cabinet.
The 2 a.m. test.
Safety culture has a name for a weakness that sits quietly until exactly the wrong day: a latent condition. To be fair about where that weakness lives: nuclear operators' own scheduling systems are mature, and fatigue management is long-established practice at these sites. The weak seam is the consolidation, with contractor hours arriving late, in different formats, from different companies.
That seam does not fail on a normal week. It fails at 2 a.m. in week nine of an outage, when the critical path slips and a steamfitter on her third straight 12-hour night is asked to stay on. Everyone in the room knows the procedure for authorising an exception. That part is drilled. What the moment actually demands is the number.
Would keeping her on breach the 16 in 24, or the 28 in 48? Where does she sit against the fixed 7-day or rolling 14-day total, whichever the licensee has adopted, and do you even have the hours she worked for her own employer before she badged onto your site? Three consecutive 12-hour nights already trigger 72 hours off. On straight nights a fourth would be the last one the rule allows; if her block mixes day and night shifts on consecutive calendar days the cap is three, and there is no fourth. Nor is the recovery block quite absolute: to maintain minimum staff complement the document itself allows those 72 hours to drop to 48, once every three months per worker[1]. Which is it here, and can the outage plan absorb the answer? And is she even next in the overtime order, or does this shift belong to someone else under the collective agreement?
A spreadsheet answers none of that at 2 a.m.
Fewer people, more work, same limits.
Now stack the workforce math on top. A workforce assessment commissioned by the Canadian Nuclear Association, reported in February 2026, projects shortages beginning around 2030, with pressures intensifying into the early 2040s, and finds that between 20 and 31 percent of the current nuclear workforce is expected to reach retirement age between 2030 and 2035[8]. Separate CNA reporting in 2024, on a different study basis, put the whole industry workforce at about 89,000 people[9]. The occupations the assessment names as persistently short are the outage trades: ironworkers, industrial electricians, steamfitters and pipefitters, along with mechanical engineers and engineering managers[8].
Those people are needed exactly when the work peaks. Ontario Power Generation's Pickering refurbishment of Units 5 to 8 carries an approved budget of C$26.8 billion including interest, escalation and contingency, with the execution phase commencing in January 2027 and the four units back in service by 2034[10]. The Darlington New Nuclear Project expects to connect the first of four planned small modular reactors to the grid by the end of 2030, at a budget of C$7.7 billion for that unit including infrastructure common to all four. The remaining three are not yet approved; the total for all four is put at C$20.9 billion[10][11]. Further CANDU refurbishment work in Ontario runs in overlapping unit outages into 2033[12]. All of it draws on one skilled-trades pool, just as 20 to 31 percent of the nuclear workforce overall reaches retirement age.
When labour is plentiful, a sloppy schedule costs money. When labour is scarce, it costs the outage itself. Burn your best people to the regulatory ceiling in week three and they are out of hours in week five, exactly when you need them most. Managing fatigue and finishing the outage on time turn out to be the same problem, with hours as the shared currency.
What this asks of the system that builds the schedule.
The fix is the one nuclear applies everywhere else: move the check upstream. Put the hour limits and the recovery rules into the moment the assignment is made, so cumulative hours and rest periods are checked as the shift is assigned, rather than reconstructed after it.
In practice that means three things. When an assignment would break a rule, the scheduler sees which rule and which threshold, and can still make the call, with the override recorded as it is made. Where contractor shifts are scheduled in the same system as staff shifts, which is configuration work rather than something that arrives switched on, the same rule check runs on both, though hours worked for another employer only count if they reach the system at all. And overtime order stays a human decision under the collective agreement, but where a call list is configured it is a documented one: who was eligible, in what seniority and rotation order, who was called, when, and what they said. That log is what a grievance turns on.
None of that removes the judgement call at 2 a.m. It just means the person making it has the number in front of them, and that the record of the decision is a by-product of making it rather than a reconstruction afterwards. That is the standard WorkAxle designs workforce management to support: the rules in the system, not in someone's head. Software supports an operator's fatigue management program. It does not replace it.
The bottom line.
Canadian nuclear is heading into a decade where refurbishments, new builds and small modular reactors compete for a shrinking pool of skilled trades, while the fatigue rulebook stays exactly this strict. In that world the schedule stops being paperwork and becomes strategy. Operators who treat it like a controlled document, with the rules checked at the moment of assignment and each override recorded as it is made, are better positioned to staff the surge without betting an outage on a spreadsheet.
Fatigue is a safety barrier. The schedule is where that barrier is either engineered or improvised.